f570dda67955360e3afaff9f0cf61053b94b1ad07549b301020942ad90eb682d

Analysis

user interaction
yes
max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/09/2026, 19:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Riot Client.7z
Size 91.2MB
Sample260919-ymr8maeq21
SHA256 f570dda67955360e3afaff9f0cf61053b94b1ad07549b301020942ad90eb682d
MD5 da5a61d9fd576752b7f30b8a77dbbd46
SHA1 db45e26c673dd30143c9dec220e06a7682a5cc48
SHA512 a6518362171b1ff4755cdfcf2a57cab8d30867a53029ac0ff83fb75291f75570e3fece75785b63efba1e91458bb3f937e0f523ca5e1fc88798b57c3f9f1d5152
SSDEEP 1572864:crZJ9ZmRqksdDUujQV4wrDcLnsSJ3QDISFPETkQW96GGsh+PB5dQWe9r0BwKyi98:m/ZSqk6EvfgnsQ3bSF8TkQW96GIPzdQr
TLSH
T1312833101FF37623F95F7334DC2A04340CB96203B0117B9AAECE546BBDBA6689D5199B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3760	XFAAQBJCKJQQCSKY.exe
3932	XFAAQBJCKJQQCSKY.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5532	chrome.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134343214348769728"	chrome.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-524788801-3318743092-4051225893-1000\{200B855D-660C-4BFB-B86E-C96B7AE61DCC}	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5272	chrome.exe
5272	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4460	7zFM.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 59 IoCs

pid	Process
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	4460	7zFM.exe
Token: 35	4460	7zFM.exe
Token: SeSecurityPrivilege	4460	7zFM.exe
Token: SeDebugPrivilege	4308	firefox.exe
Token: SeDebugPrivilege	4308	firefox.exe
Token: SeShutdownPrivilege	5272	chrome.exe
Token: SeCreatePagefilePrivilege	5272	chrome.exe
Token: SeShutdownPrivilege	5272	chrome.exe
Token: SeCreatePagefilePrivilege	5272	chrome.exe
Token: SeShutdownPrivilege	5272	chrome.exe
Token: SeCreatePagefilePrivilege	5272	chrome.exe
Token: SeShutdownPrivilege	5272	chrome.exe
Token: SeCreatePagefilePrivilege	5272	chrome.exe
Token: SeShutdownPrivilege	5272	chrome.exe
Token: SeCreatePagefilePrivilege	5272	chrome.exe
Token: SeShutdownPrivilege	5272	chrome.exe
Token: SeCreatePagefilePrivilege	5272	chrome.exe
Token: SeShutdownPrivilege	5272	chrome.exe
Token: SeCreatePagefilePrivilege	5272	chrome.exe
Token: SeShutdownPrivilege	5272	chrome.exe
Token: SeCreatePagefilePrivilege	5272	chrome.exe
Token: SeShutdownPrivilege	5272	chrome.exe
Token: SeCreatePagefilePrivilege	5272	chrome.exe
Token: SeShutdownPrivilege	5272	chrome.exe
Token: SeCreatePagefilePrivilege	5272	chrome.exe
Token: SeShutdownPrivilege	5272	chrome.exe
Token: SeCreatePagefilePrivilege	5272	chrome.exe
Token: SeShutdownPrivilege	5272	chrome.exe
Token: SeCreatePagefilePrivilege	5272	chrome.exe
Token: SeShutdownPrivilege	5272	chrome.exe
Token: SeCreatePagefilePrivilege	5272	chrome.exe
Token: SeShutdownPrivilege	5272	chrome.exe
Token: SeCreatePagefilePrivilege	5272	chrome.exe
Token: SeShutdownPrivilege	5272	chrome.exe
Token: SeCreatePagefilePrivilege	5272	chrome.exe
Token: SeShutdownPrivilege	5272	chrome.exe
Token: SeCreatePagefilePrivilege	5272	chrome.exe
Token: SeShutdownPrivilege	5272	chrome.exe
Token: SeCreatePagefilePrivilege	5272	chrome.exe
Token: SeShutdownPrivilege	5272	chrome.exe
Token: SeCreatePagefilePrivilege	5272	chrome.exe
Token: SeShutdownPrivilege	5272	chrome.exe
Token: SeCreatePagefilePrivilege	5272	chrome.exe
Token: SeShutdownPrivilege	5272	chrome.exe
Token: SeCreatePagefilePrivilege	5272	chrome.exe
Token: SeShutdownPrivilege	5272	chrome.exe
Token: SeCreatePagefilePrivilege	5272	chrome.exe
Token: SeShutdownPrivilege	5272	chrome.exe
Token: SeCreatePagefilePrivilege	5272	chrome.exe
Token: SeShutdownPrivilege	5272	chrome.exe
Token: SeCreatePagefilePrivilege	5272	chrome.exe
Token: SeShutdownPrivilege	5272	chrome.exe
Token: SeCreatePagefilePrivilege	5272	chrome.exe
Token: SeShutdownPrivilege	5272	chrome.exe
Token: SeCreatePagefilePrivilege	5272	chrome.exe
Token: SeShutdownPrivilege	5272	chrome.exe
Token: SeCreatePagefilePrivilege	5272	chrome.exe
Token: SeShutdownPrivilege	5272	chrome.exe
Token: SeCreatePagefilePrivilege	5272	chrome.exe
Token: SeShutdownPrivilege	5272	chrome.exe
Token: SeCreatePagefilePrivilege	5272	chrome.exe
Token: SeShutdownPrivilege	5272	chrome.exe
Token: SeCreatePagefilePrivilege	5272	chrome.exe
Token: SeShutdownPrivilege	5272	chrome.exe

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
4460	7zFM.exe
4460	7zFM.exe
4460	7zFM.exe
4308	firefox.exe
4308	firefox.exe
4308	firefox.exe
4308	firefox.exe
4308	firefox.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe

Suspicious use of SendNotifyMessage 34 IoCs

pid	Process
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe
5272	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4308	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4628 wrote to memory of 4308	4628	firefox.exe	116
PID 4628 wrote to memory of 4308	4628	firefox.exe	116
PID 4308 wrote to memory of 464	4308	firefox.exe	117
PID 4308 wrote to memory of 464	4308	firefox.exe	117
PID 4308 wrote to memory of 464	4308	firefox.exe	117
PID 4308 wrote to memory of 3384	4308	firefox.exe	118
PID 4308 wrote to memory of 3384	4308	firefox.exe	118
PID 4308 wrote to memory of 3384	4308	firefox.exe	118
PID 4308 wrote to memory of 3384	4308	firefox.exe	118
PID 4308 wrote to memory of 2168	4308	firefox.exe	120
PID 4308 wrote to memory of 2168	4308	firefox.exe	120
PID 4308 wrote to memory of 2168	4308	firefox.exe	120
PID 4308 wrote to memory of 2168	4308	firefox.exe	120
PID 4308 wrote to memory of 4016	4308	firefox.exe	121
PID 4308 wrote to memory of 4016	4308	firefox.exe	121
PID 4308 wrote to memory of 4016	4308	firefox.exe	121
PID 4308 wrote to memory of 760	4308	firefox.exe	122
PID 4308 wrote to memory of 760	4308	firefox.exe	122
PID 4308 wrote to memory of 760	4308	firefox.exe	122
PID 4308 wrote to memory of 760	4308	firefox.exe	122
PID 4308 wrote to memory of 5772	4308	firefox.exe	123
PID 4308 wrote to memory of 5772	4308	firefox.exe	123
PID 4308 wrote to memory of 5772	4308	firefox.exe	123
PID 4308 wrote to memory of 5772	4308	firefox.exe	123
PID 4308 wrote to memory of 5904	4308	firefox.exe	124
PID 4308 wrote to memory of 5904	4308	firefox.exe	124
PID 4308 wrote to memory of 5904	4308	firefox.exe	124
PID 4308 wrote to memory of 5904	4308	firefox.exe	124
PID 4308 wrote to memory of 5912	4308	firefox.exe	125
PID 4308 wrote to memory of 5912	4308	firefox.exe	125
PID 4308 wrote to memory of 5912	4308	firefox.exe	125
PID 4308 wrote to memory of 5912	4308	firefox.exe	125
PID 4308 wrote to memory of 6004	4308	firefox.exe	126
PID 4308 wrote to memory of 6004	4308	firefox.exe	126
PID 4308 wrote to memory of 6004	4308	firefox.exe	126
PID 4308 wrote to memory of 6004	4308	firefox.exe	126
PID 5272 wrote to memory of 5288	5272	chrome.exe	128
PID 5272 wrote to memory of 5512	5272	chrome.exe	129
PID 5272 wrote to memory of 5512	5272	chrome.exe	129
PID 5272 wrote to memory of 5532	5272	chrome.exe	130
PID 5272 wrote to memory of 5404	5272	chrome.exe	131
PID 5272 wrote to memory of 5404	5272	chrome.exe	131
PID 5272 wrote to memory of 4124	5272	chrome.exe	133
PID 5272 wrote to memory of 4764	5272	chrome.exe	134
PID 5272 wrote to memory of 4124	5272	chrome.exe	133
PID 5272 wrote to memory of 4764	5272	chrome.exe	134
PID 5272 wrote to memory of 4272	5272	chrome.exe	135
PID 5272 wrote to memory of 4272	5272	chrome.exe	135
PID 5272 wrote to memory of 5644	5272	chrome.exe	137
PID 5272 wrote to memory of 1956	5272	chrome.exe	140
PID 5272 wrote to memory of 1956	5272	chrome.exe	140
PID 5272 wrote to memory of 5792	5272	chrome.exe	141
PID 5272 wrote to memory of 5792	5272	chrome.exe	141
PID 5272 wrote to memory of 3572	5272	chrome.exe	142
PID 5272 wrote to memory of 3572	5272	chrome.exe	142
PID 5272 wrote to memory of 3368	5272	chrome.exe	144
PID 5272 wrote to memory of 6064	5272	chrome.exe	143
PID 5272 wrote to memory of 6064	5272	chrome.exe	143
PID 5272 wrote to memory of 2064	5272	chrome.exe	145
PID 5272 wrote to memory of 2064	5272	chrome.exe	145
PID 5272 wrote to memory of 2736	5272	chrome.exe	146
PID 5272 wrote to memory of 2736	5272	chrome.exe	146
PID 5272 wrote to memory of 1776	5272	chrome.exe	147
PID 5272 wrote to memory of 1776	5272	chrome.exe	147

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Riot Client.7z"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4460

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4156

C:\Users\Admin\AppData\Roaming\Riot Client\Session Storage\XFAAQBJCKJQQCSKY.exe
"C:\Users\Admin\AppData\Roaming\Riot Client\Session Storage\XFAAQBJCKJQQCSKY.exe"
1⤵
- Executes dropped EXE
PID:3760

C:\Users\Admin\AppData\Roaming\Riot Client\Session Storage\XFAAQBJCKJQQCSKY.exe
"C:\Users\Admin\AppData\Roaming\Riot Client\Session Storage\XFAAQBJCKJQQCSKY.exe"
1⤵
- Executes dropped EXE
PID:3932

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4628
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4308
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2008 -prefsLen 27099 -prefMapHandle 2012 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {dbbd17ba-3b59-41cb-a839-8b444380d38a} -parentPid 4308 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4308" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:464
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2480 -prefsLen 27135 -prefMapHandle 2484 -prefMapSize 270279 -ipcHandle 2492 -initialChannelId {a01bf5b6-272c-4fb9-a05b-4fd3091adeb5} -parentPid 4308 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4308" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:3384
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3836 -prefsLen 27276 -prefMapHandle 3840 -prefMapSize 270279 -jsInitHandle 3844 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3852 -initialChannelId {571f7099-85a1-47fa-aa2d-225f3e53d5d5} -parentPid 4308 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4308" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:2168
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4024 -prefsLen 27276 -prefMapHandle 4028 -prefMapSize 270279 -ipcHandle 4044 -initialChannelId {d1a20e82-cf89-489c-88e5-cd1b2645b0d7} -parentPid 4308 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4308" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4016
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3148 -prefsLen 34775 -prefMapHandle 3152 -prefMapSize 270279 -jsInitHandle 1656 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1352 -initialChannelId {1b941df6-d857-4098-8a02-0f511278422e} -parentPid 4308 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4308" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:760
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4992 -prefsLen 35012 -prefMapHandle 4996 -prefMapSize 270279 -ipcHandle 5004 -initialChannelId {52aabac6-8582-4e3f-a711-f5a878deb9ac} -parentPid 4308 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4308" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5772
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5128 -prefsLen 32900 -prefMapHandle 5132 -prefMapSize 270279 -jsInitHandle 5136 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5144 -initialChannelId {dd825853-70e8-43e0-9734-8c348be02f8e} -parentPid 4308 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4308" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5904
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5160 -prefsLen 32900 -prefMapHandle 5164 -prefMapSize 270279 -jsInitHandle 5168 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5176 -initialChannelId {b679d6ee-88af-405a-b2df-3af768e13bc5} -parentPid 4308 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4308" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5912
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5304 -prefsLen 32952 -prefMapHandle 5316 -prefMapSize 270279 -jsInitHandle 5128 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5472 -initialChannelId {36370e46-de29-4726-8925-ba2dbe0cad51} -parentPid 4308 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4308" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:6004

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff83d94c728,0x7ff83d94c734,0x7ff83d94c740
  2⤵
  PID:5288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1748,i,2305039667488460933,7518263281754227682,262144 --field-trial-handle=1916,i,7865119129525640314,16016088491051975089,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:5512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1616,i,10297222371114813821,18086629732834157662,524288 --field-trial-handle=1916,i,7865119129525640314,16016088491051975089,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2392,i,9310629990640283083,4080093691487127172,524288 --field-trial-handle=1916,i,7865119129525640314,16016088491051975089,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2600 /prefetch:8
  2⤵
  PID:5404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3252,i,14445557372328017358,3028599985963218030,2097152 --field-trial-handle=1916,i,7865119129525640314,16016088491051975089,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3296,i,7078407338235173209,6510184673233150744,2097152 --field-trial-handle=1916,i,7865119129525640314,16016088491051975089,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:4764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4572,i,17732438305712534339,16226150556906231239,2097152 --field-trial-handle=1916,i,7865119129525640314,16016088491051975089,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4552 /prefetch:1
  2⤵
  PID:4272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5340,i,12573062020529241552,3237159023009615439,524288 --field-trial-handle=1916,i,7865119129525640314,16016088491051975089,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5048 /prefetch:8
  2⤵
  PID:5644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5708,i,6387420389181751263,15164242943865608525,2097152 --field-trial-handle=1916,i,7865119129525640314,16016088491051975089,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:1956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4680,i,11406115160393811718,7807470566206008962,2097152 --field-trial-handle=1916,i,7865119129525640314,16016088491051975089,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:5792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4660,i,13898921070113982961,10045670600904588596,2097152 --field-trial-handle=1916,i,7865119129525640314,16016088491051975089,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:3572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=4628,i,2315126311724102860,14948676263224287617,524288 --field-trial-handle=1916,i,7865119129525640314,16016088491051975089,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4668 /prefetch:8
  2⤵
  PID:6064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4636,i,3894601988806609062,13988657688685305138,524288 --field-trial-handle=1916,i,7865119129525640314,16016088491051975089,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4608 /prefetch:8
  2⤵
  - Modifies registry class
  PID:3368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3252,i,14543848956145243015,2451633168700305683,2097152 --field-trial-handle=1916,i,7865119129525640314,16016088491051975089,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4540 /prefetch:1
  2⤵
  PID:2064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6004,i,10278136797832079846,5408067940575627079,2097152 --field-trial-handle=1916,i,7865119129525640314,16016088491051975089,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5976 /prefetch:1
  2⤵
  PID:2736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6140,i,16044002855222126438,2269828444209762482,2097152 --field-trial-handle=1916,i,7865119129525640314,16016088491051975089,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6020 /prefetch:1
  2⤵
  PID:1776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6288,i,15382940727320457446,18389069630714258731,2097152 --field-trial-handle=1916,i,7865119129525640314,16016088491051975089,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6320 /prefetch:1
  2⤵
  PID:5336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6592,i,11169784788445922897,5142735312294435045,2097152 --field-trial-handle=1916,i,7865119129525640314,16016088491051975089,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6608 /prefetch:1
  2⤵
  PID:6032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6580,i,6511987344275187868,1654590444673445270,2097152 --field-trial-handle=1916,i,7865119129525640314,16016088491051975089,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6768 /prefetch:1
  2⤵
  PID:5592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6520,i,11245698954976878323,17398610176461545976,2097152 --field-trial-handle=1916,i,7865119129525640314,16016088491051975089,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6452 /prefetch:1
  2⤵
  PID:5908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6936,i,48228450606698899,827299871447903114,2097152 --field-trial-handle=1916,i,7865119129525640314,16016088491051975089,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6120 /prefetch:1
  2⤵
  PID:5924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6924,i,16636841793890112270,6510253788731346206,2097152 --field-trial-handle=1916,i,7865119129525640314,16016088491051975089,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6004 /prefetch:1
  2⤵
  PID:4764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=3552,i,14558088601558126807,5514853279002181202,2097152 --field-trial-handle=1916,i,7865119129525640314,16016088491051975089,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7128 /prefetch:1
  2⤵
  PID:5176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=7132,i,14272094153163092391,8621163043316134418,2097152 --field-trial-handle=1916,i,7865119129525640314,16016088491051975089,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7236 /prefetch:1
  2⤵
  PID:1172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=7332,i,16957102304999202626,15866446899827840480,2097152 --field-trial-handle=1916,i,7865119129525640314,16016088491051975089,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7340 /prefetch:1
  2⤵
  PID:4676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=7568,i,11843526099735528335,17204277560934052486,2097152 --field-trial-handle=1916,i,7865119129525640314,16016088491051975089,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7540 /prefetch:1
  2⤵
  PID:4240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=7700,i,11077830331237992829,10381899525488405038,2097152 --field-trial-handle=1916,i,7865119129525640314,16016088491051975089,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7672 /prefetch:1
  2⤵
  PID:4780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=7836,i,7532759309997029597,2601045113424595191,2097152 --field-trial-handle=1916,i,7865119129525640314,16016088491051975089,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7804 /prefetch:1
  2⤵
  PID:4744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=7956,i,5474536692698013853,2609046853453525900,2097152 --field-trial-handle=1916,i,7865119129525640314,16016088491051975089,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7968 /prefetch:1
  2⤵
  PID:1752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=8124,i,11017234192459046154,7355331357429826733,2097152 --field-trial-handle=1916,i,7865119129525640314,16016088491051975089,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7348 /prefetch:1
  2⤵
  PID:2112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=6312,i,11567060316187219596,8586391143242131541,2097152 --field-trial-handle=1916,i,7865119129525640314,16016088491051975089,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6652 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=6316,i,18237136939518409222,1220106432382591811,2097152 --field-trial-handle=1916,i,7865119129525640314,16016088491051975089,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6656 /prefetch:1
  2⤵
  PID:4020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=6448,i,9841705448514111333,13604707441298280287,2097152 --field-trial-handle=1916,i,7865119129525640314,16016088491051975089,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:3004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=6808,i,8120884833203976820,12009576724402993000,2097152 --field-trial-handle=1916,i,7865119129525640314,16016088491051975089,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4496 /prefetch:1
  2⤵
  PID:4128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=7520,i,3591353473568893999,8071649967669378347,2097152 --field-trial-handle=1916,i,7865119129525640314,16016088491051975089,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6220 /prefetch:1
  2⤵
  PID:5140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=7504,i,11457597958342327859,8322264288220942598,2097152 --field-trial-handle=1916,i,7865119129525640314,16016088491051975089,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6024 /prefetch:1
  2⤵
  PID:3008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=7508,i,2696943633473411960,15469996742448995335,2097152 --field-trial-handle=1916,i,7865119129525640314,16016088491051975089,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6396 /prefetch:1
  2⤵
  PID:436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=3320,i,3312899361469958561,14236930699221832248,2097152 --field-trial-handle=1916,i,7865119129525640314,16016088491051975089,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:3308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=3468,i,15376376020393484799,7167060004724922181,2097152 --field-trial-handle=1916,i,7865119129525640314,16016088491051975089,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --metrics-shmem-handle=7672,i,853575127452742279,4557053055709260323,2097152 --field-trial-handle=1916,i,7865119129525640314,16016088491051975089,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7488 /prefetch:1
  2⤵
  PID:4508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=7576,i,13893454561108100062,14202206033142630837,2097152 --field-trial-handle=1916,i,7865119129525640314,16016088491051975089,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7680 /prefetch:1
  2⤵
  PID:1648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=9164,i,539844998220497156,14810747499177733413,2097152 --field-trial-handle=1916,i,7865119129525640314,16016088491051975089,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=8928 /prefetch:1
  2⤵
  PID:6048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --metrics-shmem-handle=9024,i,10028162390807962009,13946370823922634606,2097152 --field-trial-handle=1916,i,7865119129525640314,16016088491051975089,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=9048 /prefetch:1
  2⤵
  PID:6112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --metrics-shmem-handle=8424,i,4896805448075745070,16416457793042145163,2097152 --field-trial-handle=1916,i,7865119129525640314,16016088491051975089,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=8820 /prefetch:1
  2⤵
  PID:4272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --metrics-shmem-handle=8588,i,16716385026824914515,2492731162131490262,2097152 --field-trial-handle=1916,i,7865119129525640314,16016088491051975089,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=8584 /prefetch:1
  2⤵
  PID:3140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --metrics-shmem-handle=9052,i,15493324058159357812,18423132101236610333,2097152 --field-trial-handle=1916,i,7865119129525640314,16016088491051975089,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=8896 /prefetch:1
  2⤵
  PID:3340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --metrics-shmem-handle=9160,i,9749202870032565062,12763499737010649038,2097152 --field-trial-handle=1916,i,7865119129525640314,16016088491051975089,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=8932 /prefetch:1
  2⤵
  PID:5128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --metrics-shmem-handle=8924,i,14382999926440516303,175141674333366667,2097152 --field-trial-handle=1916,i,7865119129525640314,16016088491051975089,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=9008 /prefetch:1
  2⤵
  PID:3308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --metrics-shmem-handle=9024,i,12065682521563828365,8707409121621185045,2097152 --field-trial-handle=1916,i,7865119129525640314,16016088491051975089,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=8908 /prefetch:1
  2⤵
  PID:3584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --metrics-shmem-handle=9260,i,17790715766609641973,1794944306294245050,2097152 --field-trial-handle=1916,i,7865119129525640314,16016088491051975089,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=9272 /prefetch:1
  2⤵
  PID:1044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --metrics-shmem-handle=9408,i,8766991342829643697,17084098603050995769,2097152 --field-trial-handle=1916,i,7865119129525640314,16016088491051975089,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=9424 /prefetch:1
  2⤵
  PID:4084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --metrics-shmem-handle=9556,i,10061597235474097830,2871347003797769532,2097152 --field-trial-handle=1916,i,7865119129525640314,16016088491051975089,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=9572 /prefetch:1
  2⤵
  PID:3788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --metrics-shmem-handle=9704,i,11233438095206963351,2093824524718278906,2097152 --field-trial-handle=1916,i,7865119129525640314,16016088491051975089,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=9720 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --metrics-shmem-handle=9864,i,9310794032983095459,315351704406711370,2097152 --field-trial-handle=1916,i,7865119129525640314,16016088491051975089,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=9860 /prefetch:1
  2⤵
  PID:5896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --metrics-shmem-handle=10004,i,4797422042219797453,16226725140211917776,2097152 --field-trial-handle=1916,i,7865119129525640314,16016088491051975089,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=10012 /prefetch:1
  2⤵
  PID:2472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --metrics-shmem-handle=10152,i,612049886198751640,7157595398234300565,2097152 --field-trial-handle=1916,i,7865119129525640314,16016088491051975089,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=10148 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=7744,i,13660157652862918319,4695127477322369013,524288 --field-trial-handle=1916,i,7865119129525640314,16016088491051975089,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7724 /prefetch:8
  2⤵
  PID:6340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=8548,i,15234919981680972272,1842229895840000293,524288 --field-trial-handle=1916,i,7865119129525640314,16016088491051975089,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7768 /prefetch:8
  2⤵
  PID:6348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=8616,i,1778319504817024252,16123903716815437143,524288 --field-trial-handle=1916,i,7865119129525640314,16016088491051975089,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7788 /prefetch:8
  2⤵
  PID:6356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --metrics-shmem-handle=7480,i,12445948018060381021,10038354794674020790,2097152 --field-trial-handle=1916,i,7865119129525640314,16016088491051975089,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=8588 /prefetch:1
  2⤵
  PID:6640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --metrics-shmem-handle=9664,i,14057455183723628214,14283382840592778560,2097152 --field-trial-handle=1916,i,7865119129525640314,16016088491051975089,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=9652 /prefetch:1
  2⤵
  PID:6836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --metrics-shmem-handle=8824,i,14287688411850320778,11384138527761709003,2097152 --field-trial-handle=1916,i,7865119129525640314,16016088491051975089,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=9672 /prefetch:1
  2⤵
  PID:6844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --metrics-shmem-handle=7760,i,18271597981906150201,660529271448221234,2097152 --field-trial-handle=1916,i,7865119129525640314,16016088491051975089,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=9768 /prefetch:1
  2⤵
  PID:6852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --metrics-shmem-handle=10112,i,1681745881561369277,18252251146308342788,2097152 --field-trial-handle=1916,i,7865119129525640314,16016088491051975089,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=9832 /prefetch:1
  2⤵
  PID:6948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --metrics-shmem-handle=10048,i,2496699060080024673,9227187683623750670,2097152 --field-trial-handle=1916,i,7865119129525640314,16016088491051975089,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=9444 /prefetch:1
  2⤵
  PID:6956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --metrics-shmem-handle=10000,i,10235266985604190761,842651719878058567,2097152 --field-trial-handle=1916,i,7865119129525640314,16016088491051975089,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=9888 /prefetch:1
  2⤵
  PID:7056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --metrics-shmem-handle=10104,i,457703719968156686,16277322992470470228,2097152 --field-trial-handle=1916,i,7865119129525640314,16016088491051975089,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=9000 /prefetch:1
  2⤵
  PID:7108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --metrics-shmem-handle=9032,i,2480199402859434418,11790892474548178635,2097152 --field-trial-handle=1916,i,7865119129525640314,16016088491051975089,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=9144 /prefetch:1
  2⤵
  PID:7116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --metrics-shmem-handle=10084,i,9512689707394385390,16216114028995985256,2097152 --field-trial-handle=1916,i,7865119129525640314,16016088491051975089,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7756 /prefetch:1
  2⤵
  PID:3760

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5712

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 bb0d1440376d196ba6eb50d41ec24b02612bfe82aa23cc86b85552c4b4d05a12
MD5 7bf358d6f6fc0f1940a460f6cc1aea4d
SHA1 69f0fccf0ccc813fda3d0bb60edf4e409b32c808
SHA512 4fd7d494cdebe1bd1d3e29c92e939505876496302609cadceb192f2737284b4acdc49b4da26272f51b5d2173b18141f489c95160c4e6ffb153244488a3efa755
TLSH
T145F0F4A9DC21AC6718FD0B6960681B47F76113673691894B3B3C820D8FB553B8689D1C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000025

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000025
Size 73KB
SHA256 f3d2fda12260ccf193da50e70fe5efb8b89d3c5d4e246eaa053f2cbf4fb07ca4
MD5 345c1023e3d262fb90bd367013335e0f
SHA1 30fd5c4da80ace38caa4fc0da1c950b6ea210787
SHA512 9ae18642326e9e10579bf7b137e14cf5da51953fd2884db14dc6050c4734ec9ad58f7afa35e1d9ee2d0672827845fba2a076bf25069ad40a31de93179c76c842
SSDEEP 1536:gJJpWKEN0+OUU0C2XYIyfDqHbs9hB09CfZlKMVOSUFV+qnCQalSYnUxMv:cjW1b1U09DGyQPKzSUFVXCQalSYntv
TLSH
T1D87312C66BCE83A9791BCF3D0D254488AB74C4F0329AEFC3957AA08D7515134B1C63A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000026

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000026
Size 104KB
SHA256 f6499c5a75f12233d2ba2561b39f9e78b79bc59b6848a99dd2bd921fc2580829
MD5 d3198b98f218f7560b3bf9ee7f66cf56
SHA1 1269a7d97c74eb5830fc26e98294ed35b5119274
SHA512 bdaecfac790fc4de2f8e4c12abf485eed93bb24b1da8bb4528b4e55293fea5d32b6ad0d04f1534a2710147114ce4b7a0f070db8412d3bd03ffe05f4b7175a9d6
SSDEEP 3072:+lXmlqomEToTDoBYPgbUgcJ1xWIUo2UYFmmTBU:OXvomB4BGgbdWIoxCTC
TLSH
T160A312F4C7AD108C6902761F693F01E4742F57DA36225D34AC864F6BAF267031DA27AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fe8b7ca011cc9644_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\fe8b7ca011cc9644_0
Size 261B
SHA256 6bdb3cb6e925ba9c66fb297b3fce63c9a405435f625ff5c2e763ff199e8bb65b
MD5 3a7e9e911382b0b0d7b7dfd23f88c1d1
SHA1 3c0927366487416fc4f7f15c7589a6f22843eceb
SHA512 41925f243da735283b72f321b81a502ce470b861dc43b870e8efba3666b6ad7588d6d1a67fbb97e155f2f0215bd446495f6f42ea367f631805b22c75fe87eb9d
TLSH
T117D0A7F3859A5876CD2A82B0ED6FE35A860AD18C04DEA1C7977890F3A654DF5C680232
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 7b473707224f45d798edd23b77082aaba79439ce3f0957f973bf6f6572a9abaf
MD5 0cf29cf388949c34ef4d3efc9e486ec5
SHA1 be9a87b88f929e1a5788219430d834c9bd014350
SHA512 729aab8ff93ae7feab4f3f0e2c46fb2877385d42434e4c054d6814bc8a069843b1df193084309f2d6018d378bc14fc0854654dca76f950630e64ae2aec265cd0
TLSH
T1C451CA4160E02D49DB0C3C769AD64D6FFAF8566DAD437E0AB50BD6B80B367A3C0C481B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 c85c862875252467e460d5fd03af0077a144682aa01ad13dcb51908f7848eb39
MD5 3ee3c1d77ccb8ed8a6d234ab1fc72a8b
SHA1 36a5ecef9ea820037af4beb4f59dd9440bfe4d30
SHA512 df7d125a89af9d0593bef487d1b0cc61e04de37d269360c66523a5b30d05874ece2a8746e5e9dd0161535a055165293ba3ac94448c45b17f3940ef5fb6b704b1
TLSH
T12551DB4160A02D09DB0C3C769AE64D6FF6F8562DAD437E06F50BD6B90B367A7D0C481B
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_poczta.interia.pl_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 34KB
SHA256 12e60f349df0d07969229b0394a8243556f3e311bd06fef8a8aecc5c9651a903
MD5 4aac4899919f6422e8bef8541b8b1c61
SHA1 9edca3c352ba6b7cfd85da192a382db8bf1233cf
SHA512 73f7c851b960b5e74800254fe5ada19122a18dbdd94cc69e48a661d905075064bb68e21b4097ceb9f8d6ad526ca9210cb1b17fe0854c919cfb8f46220b4788f2
SSDEEP 384:Dvk/f7WZPeSeWekLO3zNe4XpBeyFlJDJIVqmd8aLc/jbivUH7jC8iKfgxER3M/yq:sTxrlf0pWXp257k6l
TLSH
T177F26DF7C3E4A62D8D1191F57A243E1FCD2949641F1C3A2A87D8DE0AE3F1971E20265E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 7KB
SHA256 79ed47036aa108e55c58c749cd4a22c459de9c0f3f2ad2431bd2c90d4c7cfb2d
MD5 2d651c316a440c927d0d8b8a152ad764
SHA1 dbd987fa776ad94ca0e057ff987037504350cb9b
SHA512 c69288c910682512ae58167542fd90dabfd96348822ffd75ff88404356d2ddd3062be6c262862f6d20ca8ddbd02111e167e2939cf761399ad43fa1cc2c39c4f6
SSDEEP 192:bUOeUpU0U5EUqU6U7UlUNsUnULUfUvU+UvUCRUrULUz6UHUzUPIURUgKUbUBU9Ux:bdew5gExtUcssOmGIVaBRe8Q60mcIIpm
TLSH
T1B8E1ADB3977EB59F203D19A71E08780969BAFC32915274F4DE97826D70898F7061342B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 0e6e6127f581db456b2f7651348ccc1cfb5e719beaf925ddbc5856e356d215cb
MD5 4a350178aec25a99618f0d9eaeecb184
SHA1 daad3596e93b3e59f2088e917522200b037234ee
SHA512 931fec5760d47eaf203c6374aa7f5859a63b923ea09f08764859a41bb0210c9ae14520c0b2aef07f5574ec18bc43b9c8b9febd785356b586ea0cc30ce2769054
SSDEEP 192:SRuYbkiv7RpAPRp2gD19vHsb+WNnqCNZd2FKQkw8oWVyIsnAUgtaJ:SRuYguNUX9hw3N29c/8
TLSH
T1F142932DBD14757B5CDAD62AFA227B53D3F6202164991E80EAFCC93C24E75CC6227407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 eff4472df129bc4e2b803cc39a1ba520374d3b607d22cd6393104a3be124b9c2
MD5 8607790a422ecb522e4c0dbd3b269b34
SHA1 e5c7ec8f685c74ebdd01a67f0e763209d8676d75
SHA512 27cdf461b3cdb01cf1d4a2f802f426248ba3f5fe8ed4c31dd046a71cdb0f38b25a10db78f318bacc40577b31c54a1cd046ec06e134194cc0934ab8961d501a55
SSDEEP 384:ftjDu7KxkXqKf/pUZNCgVLH2HfgslHEXODDK+ErU3gbHGVQoiTCGY:ftDu7KxkXqKf/pUZNCgVLH2HfgsdWOHH
TLSH
T120521927A88C9A7F0FD4D98DDC176F4FACF501576568486852FB9C0803A6BCA114E2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 8e09757004c9b6a870e610e324639e812e47832c4d2f76cff86f66828315a249
MD5 d6f70c5bcf341ed4136f4205d053449e
SHA1 f64cb58d96ce344372a5e1f740ab25d8d2825711
SHA512 d95539825ff3320b231c756c161b90b6864168b38886544c977f471b88b385720e6b603ba6264ae60f647a2456bc1bf66ce2228a157c9669f844d2ecdf30c102
TLSH
T144B0021057419413C000837969C6577877308CA80763A36778E80078DEEDB85CF52950
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 24426885b7d254807bf4eecf5bc4e620588d46ef6d1e5b6698b18dc4658a8692
MD5 5cb3651f487a8b00bc715c962a8e1c3e
SHA1 0b14992e8d33aaeccdca7d51743c726fd79f0117
SHA512 a16807fbc0540576df9fb167e6948212e60ca09845cc4f29782cb84c012164e0652572db69e74fa5ed958c0f0c682ab4d5fab45b9b2e2c4097f1f4b1db1cd15e
SSDEEP 3:MsEllllkEthXllkl2zEklzy:/M/xT02znz
TLSH
T1B544040CFFCC0C05CD0074704031C35107F0D41505115F43345114335DC5F401C40000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 261KB
SHA256 792eadc9a933fb1f4e89faab8806c6958ee5a4eea8713fa6917d0cd84565d93a
MD5 6bc67519ebbacad0c22e0e738903f464
SHA1 9a3b4ff4568eee8a4345418ce85941bfc0a76de9
SHA512 5a6950bad0fa5e49880dc4970057eba4bfd9fd1e08bee76c62d59e44cf18bf79671fee152885697b16401d260704c7fea66d4931ad4643823aaf78c906aa6e1d
SSDEEP 6144:4xEhyHuhD8tzc4Ul2+hFD+7t56OD9ZfSApprf:4u2GD8tQ4Ul2yFSXD9ZfS4N
TLSH
T11A4423637F59E93387BC6186A24B9386CCB5A8ED12DDA30900069F4B50DF9CD0767727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 261KB
SHA256 110e6c122197fd79e668e531a77b3dc917e15080027680e69face274a16a0dd2
MD5 781f336301c695176444c6ed9cbaed29
SHA1 e10d0a6b18b1eb3245323696d2fc3757346291c6
SHA512 9d04227f29586612770639db84196a1242866b88829d02297a65e81afdb631851d3d3b909a2c8aa3ecb4ebfa663855b7650c3aaaeb11705fc153929df41b8f3b
SSDEEP 6144:xxEhyHuhD8tzc4Ul2+hFD+7t56OD9ZfSApprf:xu2GD8tQ4Ul2yFSXD9ZfS4N
TLSH
T1E44423637F59E93387BC6186A24B9386CCB5A8ED12DDA30900069F4B50DF9CD0767727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 8e94bdbfcacb86bcc52bc10873efd9fc942e9d1beccffdf7d1e6d91fe4b6a321
MD5 42d3bcb56a4792c8a08da67d8528aa07
SHA1 aa1c2f68fcb3c0fd11218ef86418475bf47c069a
SHA512 b240584f469e92bd0aecf62feb05d07c97e07263ce37869415d0e8190044d5219a38c65b4b6c97a0d5d3308f6e8f1d760b5c13231bef3fa301dc156e9511bd45
SSDEEP 3072:b+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gZ:b+hFD+7t56OD9ZfSApprZ
TLSH
T1A2D31232AA91C8BBC9FC6541B197A300DE666CED45DE7A09444A5F8EE09FC4C0773A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 261KB
SHA256 f1bf4b197e02d29d048fab60017064dd3d71fc90cc81231b0abb3745efec4865
MD5 ecd8b8e05aab5c298ec0f85db33fab94
SHA1 0b0ef8841ea4a5f0f089c1b1a78e636c4b93ac75
SHA512 f28cfa3d04313d5328f9e54970d8f6f7b3a3fccb9a89c8769a12cff899c12e8569ccfff5856e0db665a1cbbc00044711b3a2591a199fd508b2f4b7d60fa08011
SSDEEP 6144:wOEhyHuhD8tzc4Ul2+hFD+7t56OD9ZfSApprf:w/2GD8tQ4Ul2yFSXD9ZfS4N
TLSH
T1634423237F59E93386BC6186A24B9386CCB5A8ED12CDA30900069F8B50DF9CD0767727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000060

Path C:\Users\Admin\AppData\Local\Temp\7zEC6186AA8\Riot Client\Cache\Cache_Data\f_000060
Size 346KB
SHA256 153ddb3e5ba7126b7e687aa05becefa0d795a086ac1508c0c9f9f9036c66feff
MD5 9df8d63af2e860cc25668a697bb35214
SHA1 d859d90d0218f19daecd0e21c466d507cf5ddaa8
SHA512 80f60cc7ed7861901a18b046a568ca5ad875ef6f399a35509ab4556e8734d9c8ae84ceedc5c438b215822ec3cbcd8165c2b4ae688039d01051dc6e1135dc2aa2
SSDEEP 384:9Rwz279wwdLI6fUVu2ixrvQQ+ktvTqXtDGIjvejU5gk1UASnoE0DufbtEjQjjonN:jwu9js6fCnw+kxOXtqUwgjjibthzoVh
TLSH
T1BC74D0025E4657B8DF917F709197426197B892A731C083FB3B75C88A3525B08EC6EAE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007f

Path C:\Users\Admin\AppData\Local\Temp\7zEC6186AA8\Riot Client\Cache\Cache_Data\f_00007f
Size 292KB
SHA256 2a77c4c500321750c1cdd0d152de2a612aeb792f7c86717f2f14d7a4721d07bd
MD5 f2b22dacae1a954bc3779bff012e4038
SHA1 30b1a04ca46bf022a637520a6a438e483c299452
SHA512 6e343284ac0779fe1cfb65886d1e05c9e3c28b4ce4289089359a139ac9a0b0661efd1d68fc4c81ec4b7227afac82b58efa300536b85077422b33ceed650877d4
SSDEEP 1536:uH+wac+DeDY09sqyNWoaxuwVkyx9y3pqpCYWp/YvD1hfLbZbeV+Bw+J8+Yn:tRDnBa8n
TLSH
T1ED54D782EA58623DF933613602C9F3CD6227A8C6DE125E9EE410505885CBFF35277B5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000080

Path C:\Users\Admin\AppData\Local\Temp\7zEC6186AA8\Riot Client\Cache\Cache_Data\f_000080
Size 9.3MB
SHA256 2ce37525fd96fb21c622d24475cc68a69b9a36de90567fa0c38ddc49019111e9
MD5 4fcaed74b0b3fbd79d6c87c47da404cb
SHA1 c1ec5d8a16bebff6390a29824f464746f52357db
SHA512 551c6b639eb52af652a4c559ec9acbc13b00703e19d83441b5abe88fb3f975bc4d4da428a5f3278483be583238b147e7355fa8cdef77d238fda20fcc7f03a834
SSDEEP 98304:NPVfLv0FCFYxjanoOsrXnaT1uBSJ84BSew4S3U:NtTv0FCFYxjanoOsrXna+k
TLSH
T16FA67ED63294B479075711DA843B3009F334282A6109E8E8F6EDC8DD5FE96899237F7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000081

Path C:\Users\Admin\AppData\Local\Temp\7zEC6186AA8\Riot Client\Cache\Cache_Data\f_000081
Size 35KB
SHA256 6e9f8709a913df30c4ee9efdb0af34ad0f5bec88deb8b1801c89681772ef31a0
MD5 c6f6f219c94772a0d3c5f1c1b2bee112
SHA1 0716c3492ccbd5dee852d286bddaa283cfcf6417
SHA512 76b30c8422429ddeb46d5f15e13946bda054c33f800d48ff36621368608f8e8efc1a1c22d2ced1a3759a3dc5f435e8df54ffd197e4ea6835d7d597548edcbcea
SSDEEP 768:UoMsRUlpvZffBdPaC86FP7WMo0wBSiwAguQuTYhheUhAAEDj:UoMkUlbnDPaCdP7PwBSiwAguJT3UhA1j
TLSH
T187F2F1B9C5C435BCC9B78CECD603684AD48797522C7D74326F6AA4F0B426F8B23D6122
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000082

Path C:\Users\Admin\AppData\Local\Temp\7zEC6186AA8\Riot Client\Cache\Cache_Data\f_000082
Size 112KB
SHA256 6f75025856f8db1b2186e9cb89be9de9894932c8b7b20f4df5e65916ff714e34
MD5 f43eb79660eaa908c9db16251bc68eaf
SHA1 cac03874db7248d2d45a780dc6192026d0f17542
SHA512 e41bd2eba0080ebccbbd9baafb5d5e2ceee56caa2a15ccd224e9f7e1ccececdab492210c817085f7da62c83798058d7a99936ec633a8891094f3924f26ed189e
SSDEEP 3072:UHFWrMAZu+PvkDDVxLyai8NHW5qsZdu6bkn8vR30:aMrMguwv2Df+josN30
TLSH
T1DCB3129C299B65A4CBA64178D8BC3659769CCC00876F0FEC4A813573BB97330069F5ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000083

Path C:\Users\Admin\AppData\Local\Temp\7zEC6186AA8\Riot Client\Cache\Cache_Data\f_000083
Size 21KB
SHA256 3ad4d8fd6130945599e63cd725015a9ab79b73fa9d33a05b418f5f238dd36471
MD5 ebe7497b5f890ca35b632e420e10f429
SHA1 eb7efec813b789be9e4ac2a95e6114ee0cc74953
SHA512 7a7ec7661cd2fc7883bbf6b792279aa2d97648c678cb33f748b5ea8987bedabe87d1d65586754074d736ac2974574ace12157db0e42dd6c0a6d7831c3ab54284
SSDEEP 192:5SLOeRgq0nbKyTIiTvkTr1Znixb0lJdIsj80wNm:gqcgq0bNcW2hbIvNm
TLSH
T191A2066BE211026CE4B9C77206D70F747BB319F5A5824739DA3C24287C6B71E7C7A982
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\7zEC6186AA8\Riot Client\shared_proto_db\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\7zEC6186AA8\Riot Client\shared_proto_db\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ld7bw5bn.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 b2e89037ac8cf37d7cbc4dcaead1eede6c06db71d352787e3966d764b8d4129a
MD5 95c183f88be5be841f152e189ee95659
SHA1 5fe8de5c83a8ad825eb4e32695adb4dbd7bbd2c0
SHA512 33e31309ab36e6f0b65f2a55ac3e9f93ae5854ad02aa1f5b64d3f6a6f5dc5478d3d6bc0d3828f0db64592f469f8511b13ce4543ea6f69a65fce351bca2ea810c
SSDEEP 192:e1d66JozGzgCl6mc0dW3d+Ov5zboPTZSNnyjxdQcN:4d66JozGzgC1jYbo7Z0nyj/
TLSH
T1F5E10FA4FA28863FC008027BCCA61B414F3A395BD84E3F15759D645C2C5B2DE3A9E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ld7bw5bn.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 3f4c98f4d357b3e1bc7dec8d5ffafeab02f5507daf3687add80b6672836ce8d4
MD5 634b287bfa732614be7a17a72a359f8d
SHA1 b1c1f472143786c7bbb03bcf3705ec66d7638ffe
SHA512 ca68c3f9f12e2577c21a941aaaac3f5b93002aabeed94f4c7fa70038ad6cfba40433732399c96856ebc556da77b5da7b849f722e9ebcc1ed893b20cdb034a3b1
SSDEEP 192:s3d+Ov5zbowbSNnyjxdkcf1d66JozGzgCl6mc0d:4bowb0nyjvd66JozGzgC1j
TLSH
T19DD1ED64FB28863FC448123FCCA61B414F7A395B984E3F15319C68092D5B2DE7A9D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ld7bw5bn.default-release\datareporting\glean\events\events
Size 1KB
SHA256 475c7927d9c2b8cdb24aaabb295cf7c8a83c0cd02a059740fbfe19cf0a297e10
MD5 b36c67f62128d5f9bc2d0cee68ea903a
SHA1 3f80b22cc9963ce628ce1e98a3c615a5004754c5
SHA512 71854c1f851f730b58fca29b0a3693b5effc2b38e86754d55c7a03cf0b8feae494748e89d9334a9b32bd0ab664900a54e1e77bb1041dc141e152875d378f356d
TLSH
T1FB213A6C3EB94EAF9CC7F29C7441018E63558E0606871D4B0D12EF8DCED1AD9326A83E
MD5 SHA1 SHA512 TLSH

Submit Download

1bb93b8e-cb5c-4ad1-a201-f3919fce412f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ld7bw5bn.default-release\datareporting\glean\pending_pings\1bb93b8e-cb5c-4ad1-a201-f3919fce412f
Size 883B
SHA256 ce7e5fc4e11d928896e28d026178a54fa1963fd324bfd31ae69775858601b662
MD5 e7de93387786c7ec03115ba3c10fd041
SHA1 eca7aecc0b107dd0e1546c867ac67af38e5963fb
SHA512 efe0127cfe5d6953244e6e0d41a4b2f6eead1513eab2e63bd36944a2b358e58b7d210c7a1dcd07185f94a54ec82be83643694469874f0f9ba257fad74cc290d7
TLSH
T19E110080A6397AB6CCACD15FC962374287F4362384CA81007EA15E180C7E50E53BA647
MD5 SHA1 SHA512 TLSH

Submit Download

7514d4fe-e6eb-477e-9f97-32ba514bd90d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ld7bw5bn.default-release\datareporting\glean\pending_pings\7514d4fe-e6eb-477e-9f97-32ba514bd90d
Size 235B
SHA256 22dd849f184a2486a3c29c32a805411fc4126ba705a96017e79946272710e98b
MD5 638a1c8d51c0ba4ba315e4fa762e1617
SHA1 b3cb3ad05aa69ccd364506a907527dba6aff80f2
SHA512 29c119762b523199e5175c6d5c7d87dfbf083429c2d2e7ef088d2b1e3dcec6214e24b6696780759f98d4ef714fcdf12d33154a85e67f87ebacf9072331afe6f7
TLSH
T19FD097C068983B3D48040F07F0B4A9C230488C3314B5B868DD5240358EFD9C48121C16
MD5 SHA1 SHA512 TLSH

Submit Download

77317d35-ec7b-43fa-8cd7-cd63e3a1b93e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ld7bw5bn.default-release\datareporting\glean\pending_pings\77317d35-ec7b-43fa-8cd7-cd63e3a1b93e
Size 886B
SHA256 4daa9074ef4e057a0e07dc2f05cd36e3c7fec8dc48eeb19516effa7f9a3dcca7
MD5 3f15519bb646d06dff694a1e94bcb5b0
SHA1 33d1a4a4262571fdc2d0488cb0787ac3558b8194
SHA512 482a4fe553917922dc08dbc084af5f1eeb4a7b0761253ea56e7fc633364ab2d7fa4828f294ae6a1690ea949d0505b1e16ed581feddf877ce700c4dbba884d9fc
TLSH
T17A11C0816B28BAB2C8A8D55BD8A2374687E47523C0C65A14BE644E184CFB90E537A617
MD5 SHA1 SHA512 TLSH

Submit Download

80207413-e8a7-4106-b86e-06f7bab9130d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ld7bw5bn.default-release\datareporting\glean\pending_pings\80207413-e8a7-4106-b86e-06f7bab9130d
Size 235B
SHA256 81103d8e0a2a974ee1ef607e510a0cd305e364dcf0c9ebd6c7dd226bef4687cf
MD5 64ccb851ad407f97cbd2d4a3d62615fd
SHA1 133354fbdcfaa9dfd59a55f686c531ce1f745fa4
SHA512 13a24b1b325a80560fd5208b007576beee6000fc5b8b35a7aa01c5a5fa3c5b18c63ff8c9d68f905d15c5480b9b5ab76a742c7d7b1e7a48367620d94d6215c497
TLSH
T140D0979024C82B5C0C041F02B1A139CA35584C3310F45CA0EEA4457499FAEC4521281A
MD5 SHA1 SHA512 TLSH

Submit Download

d76d2941-7bcb-4581-bd5c-c04b8ad0d4f5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ld7bw5bn.default-release\datareporting\glean\pending_pings\d76d2941-7bcb-4581-bd5c-c04b8ad0d4f5
Size 2KB
SHA256 a82269ec0e5c7c2c1d4ad7b15f370d39e70ef5852de925a2f08339a6a884f5c5
MD5 769d0ffee3eeb125333676f87ddde31a
SHA1 a7dc59b99bcef3fa3b538266b0ce30d678379558
SHA512 a707ade0c6e452a1bd1428cfe98188abb08459b2082eda439aeffb2e8434a6ffb975c8655d1e8bacee17f520e919d91ce6ebc0400447745738b8453b5eae9fb5
TLSH
T17E41535875B86D369CCAF14DD442338E53748E8340C21993AE82DF0C8DA675E237E52B
MD5 SHA1 SHA512 TLSH

Submit Download

fd1214e4-104c-4d92-8815-005736eb2073

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ld7bw5bn.default-release\datareporting\glean\pending_pings\fd1214e4-104c-4d92-8815-005736eb2073
Size 16KB
SHA256 d9a79175df3d3bed61c2ecfdb2623499fb1c01fa52705b9bffaa82e3a60a3ab7
MD5 6cf3cb1ab48ae47c8ca294c255d9f1fa
SHA1 8109237d1971bf5dbb8628e94af4a6feba732bd9
SHA512 6d4e132214c688dd89746eb8148d61e1bcef2e888d9ba9ceba9e0f5b0b9be165ce284e409c11c9a64fb41446400537a7c734a796b383676c0ae5db27d3534576
SSDEEP 192:pybmY9EmmQWkAU+Iq5fBFwy921Yuz/8AicSWaXtnTsNmUZULm3s4JpfdbUfZFxW3:y1mQWkAU6xfw+qD8AicSWaFIN29UMO
TLSH
T1F572CB16286045BA8691E369D4FC7FC3E5F528CF4C418FCA9BE4BD086DDE06E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ld7bw5bn.default-release\prefs-1.js
Size 6KB
SHA256 303ff48235b5f15809ec916af969c251dc9f363ce5fc397b2c5b4b177096e468
MD5 481a8cb3a7c5247420dc4dd062fa4b7a
SHA1 781038ed557755fb7b04cbe741e3c138e5056ad4
SHA512 a08029d5b814d771ddfb0f74b25136d2b09f76c9645836a104842999e39427900a000fe271f935cb2a6ef6df154885c5f2326836aaae0c07c3997662e5307510
SSDEEP 96:xHL0UTUrqGqNXfRi51zSLmSSlSdv9jxnGRHvtcXMgBw88n8L4cnkVtOJP:eWRNXfRi5+mSSl9vtc8gBw885aN
TLSH
T1FCE12F7891488F7F64B677AC6C6488316AB2013BBBBF68D750B654C4050CF3841F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ld7bw5bn.default-release\prefs.js
Size 6KB
SHA256 900face8956c5a61839a03f2a892c1c2f96802c1e822e7af68e9fea4aa7e1b83
MD5 36433067935c5c258db42fad713e797a
SHA1 3ea9c2a026b12a81b57f106da8fc05c2325f781d
SHA512 85d85ba471ba96b8b228a13cd23e4a2cedb34e8b8113f08299ce702d8037a9750d5876cabff802a40710b13640201a9d3db3b014fc90d812c0ce6219ae901516
SSDEEP 96:xHL0UTUrqGqNXfRbS1zS3SSlSdv9jznGRHvtcXMgBw88n8L4cnkVtOJP:eWRNXfRbSeSS79vtc8gBw885aN
TLSH
T1A8E1207891488F7F64B677AC6C6488316AB2013B7BBF68C750BA54C4051CF3841F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ld7bw5bn.default-release\prefs.js
Size 6KB
SHA256 f17b40faed0fa6d37d7533b03b994fc4f6ebe0549e644338d9ebd53785c3392e
MD5 265e9caea8d34b6729299213f76c812b
SHA1 b498abc44d010e71c613322a7e22b41f07854f71
SHA512 cab2abeb6f31c57349682a4f1d74344aaf9c66216212b0eda8acbcf72234f3dae700d52b59d0f0492bf839492ddb1377808e29fcc257db24befbf5b0a27c1e9f
SSDEEP 96:xHL0UTUrqGqNXfRbS1zSLmSSlSdv9jznGRHvtcXMgBw88n8L4cnkVtOJP:eWRNXfRbS+mSS79vtc8gBw885aN
TLSH
T157E1207891488F7F64B677AC6C6488316AB2013B7BBF68D750B654C4051CF3841F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XFAAQBJCKJQQCSKY.exe

Path C:\Users\Admin\AppData\Roaming\Riot Client\Session Storage\XFAAQBJCKJQQCSKY.exe
Size 249KB
SHA256 f481c802da68d9ce7aa9fbf37cefe85042bc55fc4b3b289a49990a09fe36a0ee
MD5 be62095e57f3f937fd7712691138020f
SHA1 7d5cf5d8d81b0550254e33d3079a7282f524a7e7
SHA512 3c020602678a52edc23fd76b0aebc3942f02878b2bb4d936cd8ac60ed24929a136da59bfaa3c6acb4fd1cf4bb30056ac5321118359cac9e9825a6d3d91ec651f
SSDEEP 3072:k7UhXkpYEVzDO+2dlbUXm+1Y9GjfD4C0rhrauZnBzNuy5pCkTZcpPSUyuOyA2c5v:kCRLhWuHtQUZcpFlIvYlJW
TLSH
T1B1442847625A61E1D0728134877347E2AB3D7D225761CA9F13907B669E3F2C0FD2AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XFAAQBJCKJQQCSKY_0.dat

Path C:\Users\Admin\AppData\Roaming\Riot Client\Session Storage\XFAAQBJCKJQQCSKY_0.dat
Size 10.0MB
SHA256 8f65290165e1597319b3e22d7fd3afabf79fb105e142b59e1d19a7c0a9a6ddaa
MD5 c8cd66e9632f72810ee68dd7a94ef732
SHA1 5f818a06a890ae48eae9f2e4b09ebf9322bd447b
SHA512 5a8f74554ccfb6e4b1ccb19748bd89c9f67d13488d499397f9eb543ecc714091a4a6a0fa5cc0408c0b6e41f6ae970e6753ef1790dac91986affb0d9d7b98bfb2
SSDEEP 98304:2ShiAhmlEhKLdnIkeH33KFDYpSEXOjkLcAU0+dmQCZq6ls2p8r9:2DSh0JIkem2Sac8+Q9q+u9
TLSH
T107B6C0C5D486CAA290B4734E1F36D74A9239C027031CE64F15B2869E77CCED89AC6F67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download