0c5212322270627d590a3f5ba421f2231a1f075594d712baa6cc2420d7f1fa3e

Analysis

user interaction
yes
max time kernel
154s
max time network
162s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/09/2026, 17:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
appFile.exe
Size 863.6MB
Sample260922-vpsemazblb
SHA256 0c5212322270627d590a3f5ba421f2231a1f075594d712baa6cc2420d7f1fa3e
MD5 5c759346daf7ef6c6df65550d1360f84
SHA1 288d0f659d78a734afd995630091aad1b45fd251
SHA512 43cff1d1219b1d46472794e1024689e199198b9b769ed55a544d607019ea38a6eb77091085b977d01896eb668eeb732c40a728d9aeb1e92d3d306b4933fdc3f4
SSDEEP 393216:5MjmdE7NDRR/LrTJ7H/oAYV5XYWLWlHSLoJY5gvgbuTWMWQn+lYLYA:+iohXllEwpJxTWSn+lYM
TLSH
T10A99BE03B7E800A5E0B7973489B79612EA36BC511B31D3DF1690A66D2E73BC09F35726
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
60	drive.google.com
167	drive.google.com
168	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4048	chrome.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134345711609089650"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-696679853-3915825385-3233721679-1000\{E9DB1E2F-502D-4265-98C3-46830596F543}	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 33 IoCs

pid	Process
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe
Token: SeShutdownPrivilege	3536	chrome.exe
Token: SeCreatePagefilePrivilege	3536	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe
3536	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3536 wrote to memory of 4160	3536	chrome.exe	92
PID 3536 wrote to memory of 5448	3536	chrome.exe	93
PID 3536 wrote to memory of 4048	3536	chrome.exe	94
PID 3536 wrote to memory of 5448	3536	chrome.exe	93
PID 3536 wrote to memory of 3036	3536	chrome.exe	96
PID 3536 wrote to memory of 3036	3536	chrome.exe	96
PID 3536 wrote to memory of 3580	3536	chrome.exe	98
PID 3536 wrote to memory of 1624	3536	chrome.exe	97
PID 3536 wrote to memory of 3580	3536	chrome.exe	98
PID 3536 wrote to memory of 1624	3536	chrome.exe	97
PID 3536 wrote to memory of 2480	3536	chrome.exe	99
PID 3536 wrote to memory of 2480	3536	chrome.exe	99
PID 3536 wrote to memory of 4884	3536	chrome.exe	100
PID 3536 wrote to memory of 4884	3536	chrome.exe	100
PID 3536 wrote to memory of 2140	3536	chrome.exe	101
PID 3536 wrote to memory of 1540	3536	chrome.exe	102
PID 3536 wrote to memory of 1540	3536	chrome.exe	102
PID 3536 wrote to memory of 2416	3536	chrome.exe	103
PID 3536 wrote to memory of 2416	3536	chrome.exe	103
PID 3536 wrote to memory of 5620	3536	chrome.exe	107
PID 3536 wrote to memory of 3152	3536	chrome.exe	106
PID 3536 wrote to memory of 5620	3536	chrome.exe	107
PID 3536 wrote to memory of 3152	3536	chrome.exe	106
PID 3536 wrote to memory of 6032	3536	chrome.exe	108
PID 3536 wrote to memory of 6032	3536	chrome.exe	108
PID 3536 wrote to memory of 900	3536	chrome.exe	110
PID 3536 wrote to memory of 1436	3536	chrome.exe	109
PID 3536 wrote to memory of 900	3536	chrome.exe	110
PID 3536 wrote to memory of 1436	3536	chrome.exe	109
PID 3536 wrote to memory of 5772	3536	chrome.exe	111
PID 3536 wrote to memory of 1208	3536	chrome.exe	112
PID 3536 wrote to memory of 5772	3536	chrome.exe	111
PID 3536 wrote to memory of 1208	3536	chrome.exe	112
PID 3536 wrote to memory of 5400	3536	chrome.exe	113
PID 3536 wrote to memory of 5400	3536	chrome.exe	113
PID 3536 wrote to memory of 4424	3536	chrome.exe	114
PID 3536 wrote to memory of 4424	3536	chrome.exe	114
PID 3536 wrote to memory of 3236	3536	chrome.exe	115
PID 3536 wrote to memory of 3236	3536	chrome.exe	115
PID 3536 wrote to memory of 4844	3536	chrome.exe	116
PID 3536 wrote to memory of 4844	3536	chrome.exe	116
PID 3536 wrote to memory of 1564	3536	chrome.exe	117
PID 3536 wrote to memory of 1564	3536	chrome.exe	117
PID 3536 wrote to memory of 4176	3536	chrome.exe	118
PID 3536 wrote to memory of 4176	3536	chrome.exe	118
PID 3536 wrote to memory of 3544	3536	chrome.exe	119
PID 3536 wrote to memory of 3544	3536	chrome.exe	119
PID 3536 wrote to memory of 940	3536	chrome.exe	120
PID 3536 wrote to memory of 940	3536	chrome.exe	120
PID 3536 wrote to memory of 4132	3536	chrome.exe	121
PID 3536 wrote to memory of 4132	3536	chrome.exe	121
PID 3536 wrote to memory of 2040	3536	chrome.exe	122
PID 3536 wrote to memory of 4860	3536	chrome.exe	123
PID 3536 wrote to memory of 4860	3536	chrome.exe	123
PID 3536 wrote to memory of 1540	3536	chrome.exe	124
PID 3536 wrote to memory of 1540	3536	chrome.exe	124
PID 3536 wrote to memory of 1436	3536	chrome.exe	125
PID 3536 wrote to memory of 1436	3536	chrome.exe	125
PID 3536 wrote to memory of 2680	3536	chrome.exe	126
PID 3536 wrote to memory of 2680	3536	chrome.exe	126
PID 3536 wrote to memory of 3344	3536	chrome.exe	128
PID 3536 wrote to memory of 3344	3536	chrome.exe	128
PID 3536 wrote to memory of 2936	3536	chrome.exe	129
PID 3536 wrote to memory of 2936	3536	chrome.exe	129

C:\Users\Admin\AppData\Local\Temp\appFile.exe
"C:\Users\Admin\AppData\Local\Temp\appFile.exe"
1⤵
PID:4116

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7fffee02c728,0x7fffee02c734,0x7fffee02c740
  2⤵
  PID:4160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1676,i,3502769890190618656,15894183862335297475,262144 --field-trial-handle=1964,i,9493074286515184580,2258982778248485418,262144 --variations-seed-version --mojo-platform-channel-handle=1960 /prefetch:2
  2⤵
  PID:5448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=1968,i,12753095858484368700,1060085989590204880,524288 --field-trial-handle=1964,i,9493074286515184580,2258982778248485418,262144 --variations-seed-version --mojo-platform-channel-handle=1996 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=2360,i,1371726651658157122,3900669691040184155,524288 --field-trial-handle=1964,i,9493074286515184580,2258982778248485418,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:13
  2⤵
  PID:3036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3296,i,791127034005762445,3175831389420791257,2097152 --field-trial-handle=1964,i,9493074286515184580,2258982778248485418,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:1624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3332,i,9026977696256256195,14704909764630624091,2097152 --field-trial-handle=1964,i,9493074286515184580,2258982778248485418,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:3580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4784,i,2621013197722527099,8899949562992729425,2097152 --field-trial-handle=1964,i,9493074286515184580,2258982778248485418,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:1
  2⤵
  PID:2480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=4904,i,6388983219727891126,3917065354377084311,524288 --field-trial-handle=1964,i,9493074286515184580,2258982778248485418,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:14
  2⤵
  PID:4884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=5400,i,3474665103730010742,16997281930518327928,524288 --field-trial-handle=1964,i,9493074286515184580,2258982778248485418,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
  2⤵
  PID:2140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5504,i,7442286582875576857,7935883541606211542,2097152 --field-trial-handle=1964,i,9493074286515184580,2258982778248485418,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:1540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5528,i,14081337582680860631,1296664592077310793,2097152 --field-trial-handle=1964,i,9493074286515184580,2258982778248485418,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:2416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5828,i,8293126583750547285,14287650376617440550,2097152 --field-trial-handle=1964,i,9493074286515184580,2258982778248485418,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:3152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=5588,i,12934893539590077954,6012652716049726250,524288 --field-trial-handle=1964,i,9493074286515184580,2258982778248485418,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:14
  2⤵
  PID:5620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5508,i,10725223761323361455,5745603502236197419,2097152 --field-trial-handle=1964,i,9493074286515184580,2258982778248485418,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:1
  2⤵
  PID:6032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5776,i,586839179840187899,12668961291295935538,2097152 --field-trial-handle=1964,i,9493074286515184580,2258982778248485418,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:1
  2⤵
  PID:1436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5844,i,4858879388399797361,9462402331828107299,2097152 --field-trial-handle=1964,i,9493074286515184580,2258982778248485418,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5864,i,8440963146271083037,9044627342424089166,2097152 --field-trial-handle=1964,i,9493074286515184580,2258982778248485418,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:5772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5416,i,10374022234518246597,14572958961494071657,2097152 --field-trial-handle=1964,i,9493074286515184580,2258982778248485418,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:1208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=4912,i,8804095473458767788,16731654097580545278,524288 --field-trial-handle=1964,i,9493074286515184580,2258982778248485418,262144 --variations-seed-version --mojo-platform-channel-handle=4652 /prefetch:14
  2⤵
  PID:5400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=6084,i,3521057353609779519,3841209672922152921,524288 --field-trial-handle=1964,i,9493074286515184580,2258982778248485418,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:14
  2⤵
  PID:4424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=4804,i,17063957277713881142,1693733987821719200,2097152 --field-trial-handle=1964,i,9493074286515184580,2258982778248485418,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:3236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=4868,i,1387031700881817896,2350270389848869421,2097152 --field-trial-handle=1964,i,9493074286515184580,2258982778248485418,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:9
  2⤵
  PID:4844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6016,i,1683868061330674111,17954436645800656794,2097152 --field-trial-handle=1964,i,9493074286515184580,2258982778248485418,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:1
  2⤵
  PID:1564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6356,i,15225872111194575389,2587058434306803322,2097152 --field-trial-handle=1964,i,9493074286515184580,2258982778248485418,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:1
  2⤵
  PID:4176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6472,i,7148590659672986520,4454735615449655077,2097152 --field-trial-handle=1964,i,9493074286515184580,2258982778248485418,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:3544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6360,i,1331955996299162781,4649081895893561262,2097152 --field-trial-handle=1964,i,9493074286515184580,2258982778248485418,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:1
  2⤵
  PID:940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6008,i,4146837062333065747,16331539384172826836,2097152 --field-trial-handle=1964,i,9493074286515184580,2258982778248485418,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:4132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=6676,i,5071975597334012126,5959351820675597526,524288 --field-trial-handle=1964,i,9493074286515184580,2258982778248485418,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:14
  2⤵
  - Modifies registry class
  PID:2040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=6664,i,8982072377353843941,4630809940391124824,524288 --field-trial-handle=1964,i,9493074286515184580,2258982778248485418,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:12
  2⤵
  PID:4860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=3672,i,9756984886629204242,13761915001515995621,2097152 --field-trial-handle=1964,i,9493074286515184580,2258982778248485418,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:1
  2⤵
  PID:1540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=5980,i,1877214186476985255,608931480679801949,2097152 --field-trial-handle=1964,i,9493074286515184580,2258982778248485418,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:1
  2⤵
  PID:1436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=6032,i,17911742861794133957,848588332773162454,2097152 --field-trial-handle=1964,i,9493074286515184580,2258982778248485418,262144 --variations-seed-version --mojo-platform-channel-handle=6940 /prefetch:1
  2⤵
  PID:2680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=6296,i,16034979653394431397,6195925169137763414,2097152 --field-trial-handle=1964,i,9493074286515184580,2258982778248485418,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:1
  2⤵
  PID:3344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=3732,i,7708276995632720590,2619510480740690460,2097152 --field-trial-handle=1964,i,9493074286515184580,2258982778248485418,262144 --variations-seed-version --mojo-platform-channel-handle=7024 /prefetch:1
  2⤵
  PID:2936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=6328,i,7325318887854204514,6029159501321364143,2097152 --field-trial-handle=1964,i,9493074286515184580,2258982778248485418,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:1
  2⤵
  PID:5916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=5756,i,18010901220861412989,10419882826429473104,524288 --field-trial-handle=1964,i,9493074286515184580,2258982778248485418,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:14
  2⤵
  PID:888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=4764,i,12504181191873952259,282186024912571547,524288 --field-trial-handle=1964,i,9493074286515184580,2258982778248485418,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:14
  2⤵
  PID:1440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=5632,i,5462424452251471413,11606632358635883000,524288 --field-trial-handle=1964,i,9493074286515184580,2258982778248485418,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:14
  2⤵
  PID:4340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=5456,i,2058097206131010940,7018844822885956379,2097152 --field-trial-handle=1964,i,9493074286515184580,2258982778248485418,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --metrics-shmem-handle=7184,i,7128568588926865572,12726261721949065417,2097152 --field-trial-handle=1964,i,9493074286515184580,2258982778248485418,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:5500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=7352,i,11657804806080852952,2627439327106085699,2097152 --field-trial-handle=1964,i,9493074286515184580,2258982778248485418,262144 --variations-seed-version --mojo-platform-channel-handle=7240 /prefetch:1
  2⤵
  PID:2304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=6096,i,18426455540949905825,14453484405006810943,2097152 --field-trial-handle=1964,i,9493074286515184580,2258982778248485418,262144 --variations-seed-version --mojo-platform-channel-handle=7220 /prefetch:1
  2⤵
  PID:5484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --metrics-shmem-handle=7268,i,11817203844545143475,3297764578727908248,2097152 --field-trial-handle=1964,i,9493074286515184580,2258982778248485418,262144 --variations-seed-version --mojo-platform-channel-handle=7264 /prefetch:1
  2⤵
  PID:5820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --metrics-shmem-handle=7436,i,17769936393665431913,2144863515372436836,2097152 --field-trial-handle=1964,i,9493074286515184580,2258982778248485418,262144 --variations-seed-version --mojo-platform-channel-handle=7232 /prefetch:1
  2⤵
  PID:2972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --metrics-shmem-handle=7344,i,15538315339252120561,13782557410234081365,2097152 --field-trial-handle=1964,i,9493074286515184580,2258982778248485418,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:3244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --metrics-shmem-handle=5712,i,13539829107678242170,10513283507664344118,2097152 --field-trial-handle=1964,i,9493074286515184580,2258982778248485418,262144 --variations-seed-version --mojo-platform-channel-handle=7504 /prefetch:1
  2⤵
  PID:5884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --metrics-shmem-handle=6564,i,10476175973257296279,2878140848081366105,2097152 --field-trial-handle=1964,i,9493074286515184580,2258982778248485418,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:1
  2⤵
  PID:1948

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4388

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5356

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:1676

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0b13ae7043a670e234acf4b019434968112d4a9893b5c085e99045d24fd9ac5e
MD5 21b1a8c54250904388d4a585212d04df
SHA1 67ad7efbc393d35452ba5f8bb9e88a1670988895
SHA512 d229602581412db19591105d8553754272d51f148b5faed3ffec1fe1913a0998cadd30c559dfcf72f24a4945a36639f69d2c19700b1538a26959030cbbaa322a
TLSH
T1F0814155D0C8D400FF74FB7CACD51ED921389E2DC94A0B0E728A9A602F53FE61956C95
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en_GB\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000003.log
Size 267KB
SHA256 cd9bee32aaddfcb99a4683800bf738c1b18830d0775d1816d1ddc68bf76d6e2c
MD5 43257eb946bfbc33a505a1e2c5d2e580
SHA1 0739eda1d7b530b15ac5768af7d25af05e1cd711
SHA512 8de6d936d52b34988e6a4211986851e3c8b609468199adf877d987e75f8032edff737feef014c9ecfcca8c4a43eb94b307caafd2cb02798d453692a7df2dd2ae
SSDEEP 3072:70rbPBPDWnfKIlC5hAVhYS/Vfq9Y6HQ2SCQz5+2cS/Vf59YrFLPIVsFFxW7z1Kxn:LK670Q2qXA9IaOKxKS
TLSH
T11144FB2822D132E6A21E837716519D13C3F949CC955CB09BB8A17E1D27F7F843BA472B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\LOG
Size 349B
SHA256 bd33daa60d587cf9976f180498c903c61a15a9a33847b53532c332ccb697f4de
MD5 c0b4530f11921602269ca62ff42f83f7
SHA1 5f88280854e7f2667e3129bd7f456126f288ed49
SHA512 6e883647141abcec9c810c8850a3b238a3ac60eba4a08af30b884c56e81e681144bce8fd5dc17c39b47d904c6cf6de6bbe54139b538fe8196f9a28264b860bf9
TLSH
T1F4E0201C9DC9C59F209480B755367B0ED9DA550DD7CDAD464F02D41474CB80C5468361
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 36KB
SHA256 71e8bf1ae2558ccdd34fce206cb60cfd7b6613709a379df05e17ee5ecf8570ad
MD5 9d47c9d66921258d089129f4fa247204
SHA1 e52d61903c49fe054c8769aed91c0e4c5d869355
SHA512 69a2f2bb54fb1f73ba8a43ffb2aad52f6cc6e9454f900e8c1bb5067e6dd0717918e2700d1780e5862d9656deab999fa0d772aed40cca39fbc5d29e4a9414ac18
SSDEEP 384:D7V2YvPx+q1+C0bEGP8DgLof6seeo1vRAmvOyrFaKeUrg2fTdnG2FVqutw2OBXJF:TGc3ABCY/vtjZvY
TLSH
T142F28BF7C3D8C62DD81156F4A7547E2BCE2D0A28432C3D26C8E9AF4BA3E2471D25564E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 46adb480450b7737c8fc69ec8fda71668d8353f38c3b3ec6b1c06de00899b8de
MD5 c372e50094ebfd8b108990cdba7d973f
SHA1 9bd0402aa3bfeb430017f2254a6654bdf4f56247
SHA512 5d54eb9672aa69b81ed8e55300542cbfe1334c3698902b9663dbd939791b8b6bc72f8bb24caddc6fafd571a0c1ed2caf8cf6452b243f7fcd23eda6de8b264417
SSDEEP 192:ER0cBz2XHM04v7+APRp2H8XNZGBb5bK4599zHsb+WNDDDZlIf4el2neTegfwZVyI:ER0mz2LkTXWlwUr2nyOvt
TLSH
T17662A46FE920297F8DDBD226F955BB1BD3F11021A1C51E84EAFC896E11EBADC2107407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 bb55aa2fc48d99af75b881bcf45b0983241f7d30514f7373602fa7094d2bf746
MD5 5387cd6c4687360e219d507b4318138e
SHA1 3b20a5d547e5a2f67238cc8056af7585b9968396
SHA512 677089f3add86104495d6fd8f2877caf25005d106b73b19c7298f9b66247fea981fc0acdc7cd5508c618e7f0291b2d5addaa743888ba731af3c6ab522293b14f
SSDEEP 192:ER0cBz2XZ0Av7uAPRp2HAcv9zHsb+WNnIf4el2ReTegfwiVyIsnAUge:ER0mz2Wc7X8lwYr2RyHe
TLSH
T17342C52EEE14757B4CDBC21AF926BB27D6F1002161C52E84EAFC897D11EB9CC221711B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 cfae261ae8b095312af0c6b03c609ff772f9a90b3af4be65a02d99bae1c39688
MD5 f54a9a7870d51d510e517225b2adb615
SHA1 260af53d934aed24c1017fcd2ba6de7cd3d96e77
SHA512 0530470bb6478c8fc7bc4d345d02a58e61c9186c3445067df00da400e9e4370b407df2576ce714fbf009a7ce9fc14e324af1033445d0b181c7d58f95fb34e5aa
SSDEEP 192:ER0cBz2XHMA4v7+APRp2H8XNt7Bm59uw4969zHsb+WNfucQLIf4el2neTegfwZVR:ER0mz2jkTXOlwnr2nyOvt
TLSH
T10962B56FE920297B8DDBC22AF955BB1BE3F11021A1C51E84EAFC896D11EB6DC3107507
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 ebf588cb2048b17533855df94e16b750355c2ad2f5370afbd0975d4940208f1f
MD5 4c35a1e1e3cf6e9659321f6c8c019d1a
SHA1 5835b69801be979b24d42b71d7e9acb456b455df
SHA512 bc776972c0088c59a6c60bc897e2fcb22c83dacee17d02058971da574da9ecc61e0f90a1b60a0605ce710c83ba140fa3731fff2dedef47e77e7cb9f69be2afc1
SSDEEP 192:ER0cBz2XHMI4v7+APRp2H8XNt7nmN9uw4969zHsb+WNfuc0rLIf4/cWYeTegfwZX:ER0mz2rkTXElwZzWYyOvt
TLSH
T17C62B56FE920297B8DDBC22AF955BB5BE3F11021A0C51E84EAFC896E11DB6DC3107507
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 123e1ce0ca8624b60524f4b99068fb6e0a6e5199a7f94d3cf15a82193dbacccd
MD5 90acf7790c3865b8330681ffcf035880
SHA1 5468a8e825a5fb7a4271058841d4cf573de0345b
SHA512 5cbcee750f62fa779ce8d33e4a05dc97640b6b9549205750edde3cd753f34acdf5f715fa25cbe116e1f4bf0421ee11e022f1eafb8cfa02d1288e8920172b6f00
SSDEEP 192:ER0cBz2XHM06v7+APRp2H8iZGBb6bKM599zHsb+WNDDDZlIf4el2ReTegfwiVyIz:ER0mz2LWTXOlwUr2RyH5t
TLSH
T1AE52942EE920297F8DDBC22AF955BB1BD3F51021A1C51E84EAFC896E11DBADC3107407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 e67f8b18e4fa35e2bfe8568390ae272a22e5769f34122c1f2ba1eb079d3b0d8e
MD5 d2db03f88bb8c6598d8a65af0bf31907
SHA1 ab2f9388162aad1b9c4494ef58c2c780e852114c
SHA512 3777debdfcd507c60bd22f5ed3ff7e8d2b767348a4a35579a260575b6ef5598c553519b758fa0b904e96c434d8a5edb5acb3146ec0cba10d321c8261306fd46c
SSDEEP 192:ER0cBz2XHMIcv7++PRpoH8XNt7nV+N9uw4969zHsb+WNfugNrLIf4/c0GlYseTel:ER0mz2rItXElwQzrYsyyvt
TLSH
T17062B46BE920297B8DDFC22AF855BB5BE2F1102191C51E84EAFC892E11DB6DC310750B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 7c26fe2af21594cec0b3383b027e0c1bd85ee2e02a277164669e4e7cd207d9f4
MD5 e1e669ebe3b8783ddce24dbefe8e9dcd
SHA1 d7012f95099b61ada83a47334f6e272fbe67f65e
SHA512 50e38bc50ebfcb97c66871e6508a0536b7f3a39a2857d2293c6036edaaca36f9a1729490bfe14725c09af529eb706f1bf2cbaffde62e30124c2619fdf39f1aa1
SSDEEP 384:GkjKF7KxkXqKf/pUZNCgVLH2HfgslVNXODKF+ErU3xgHG5oe6TY:GoKF7KxkXqKf/pUZNCgVLH2HfgsbpO+a
TLSH
T1AE520727A84C9A7F4FC8D68CDC166F4FADF502576268482857FA9C0803D97CB114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\5f6daeb9-7db1-43d8-b25d-d61dbc9870a6\index-dir\the-real-index
Size 744B
SHA256 7366e8ed63ba2fc8486b81e18f220211a188fb9ee93d7311c4e127397d8127e0
MD5 cf3a4b29e548c07957e3b04645356ed1
SHA1 a6d8f3dafaca6d92655996fee8abc784af76356f
SHA512 136604466188f82740a9d03e69fbf54906b55d9955b60c8aad02ac5f64263dba3756a382e0e4767612392a0bb316d89278405ce933dec00b2b78ca793d973089
TLSH
T11201978DEA50230DC06066B80AC917A2DE352C29FDA907A080C0B276F07298E171FEFC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a6cc5.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\5f6daeb9-7db1-43d8-b25d-d61dbc9870a6\index-dir\the-real-index~RFe5a6cc5.TMP
Size 48B
SHA256 8835327fcc1691bd81e950cb24b237a0941c0771f6a82fd1acd604abb7ee13a6
MD5 1098dcfa77304f2af6b515f7c9b8de7e
SHA1 f0642ef42ec0ef2ae3ceeb5b8fbdb979f4016d97
SHA512 e7a60996aeda1caf06ef94e8423ce308163b87b741e5dfac62c92ac25ae6cbc42a92ab72b0fc8c7b470e3595dc137d0f7f54a195a50102fb879d929a423a01c6
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\b80e8731-aeba-4c1f-adfd-dfdc4be62618\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 214B
SHA256 147d3998286ba17e1a1234b966a104bd6362bf5a8322ba3dd689d7beb050df5e
MD5 b3c99fe98c670aedaa69766002027d5f
SHA1 0cbd914df68ae5e67164589b634510fdd100670a
SHA512 013e4a44dfd71f112c6833de56da5dea6d028db8de6cb91dcd7d8185c1a26b81755ad315fd123538dd1a2f749331598851fb41f74f82464df75c8367a3ff579d
TLSH
T191D022CA7132D99632F4EFC5203C10CE411B8D0ACCC4C8EDD984B04B70BCA0BC626A3A
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 130B
SHA256 94d01ff9c0a380754edd305e04effba8958b28bbf0954f7f9ea82361eaf1d482
MD5 1cef31a9b809a0407780a1b5a3712a8e
SHA1 a7e11449ae4682867e1b36d2a4f05629def792a4
SHA512 afa57090f51a7f3d4c04028d2e23dded2010b43e373c21f8005a54f4ec46e5a208ae40deebf373b2845ed8d70f7480bd4fbbdb9c41cc1618f876a42a81c306f2
TLSH
T16DC09BD76410D59645F4EFC5303C625E911F4558C4D4CCE8D448B0477578D174912E39
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 132B
SHA256 8258d33e2f199ea8672c0906cfdd6d6860b60ed23c89c344a8b8fc974a85aeff
MD5 6bf8c3df4eb34aa8adac8839aafc5a96
SHA1 74c59a38e5761af0a1a525e6b0dbcf796d492a2f
SHA512 292e0683dd7115bdc7bea0557a538e04ac7cb64f81fc8e6928f88da9d1a0fd2ed2895431d29a51bef86d3a4951925186a9eb887cb10437e56b466a2dd50acfe5
TLSH
T12CC09BD76410959655F4EFC5303C725E911F8558C4D4CCE4D444B0477178D574915E39
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 216B
SHA256 103ae0badb8c8ce425487f48984932c6caa58acdc3d39c257d92b617cfa9b57e
MD5 6e9aa48ce59d7ce97d530d917622a1cc
SHA1 8d4736c5b90fecfc156807ea2b3b776316f3702e
SHA512 d5ae5be83a4a0aa2f38254197ac59bdfe64bf7939b4245361dd272d20c575b179269b5e54a9cfcefc11da248e82fdd5784b36c7228af9f41f1773b052f04feb3
TLSH
T126D0A98B9030A857AAF4AB86203C204E815A8C05E885D8D8EC08F08635B890A8921A29
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5a1510.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe5a1510.TMP
Size 137B
SHA256 0e26102187fe2ec39c686790c0e3948f37ccb3ecb96802c772e111e5f757f51f
MD5 649e640528a558e98d2de0501cc17746
SHA1 f98637e7050c6d7e811a3ba607337f919759898c
SHA512 bd4ba0bfa2c6095d379ab3a2b5dfc13730c70d13799f917a2c114a5d709b87a8bdb2bfbb9f47e6df650c4d70ed7c18ab1f1bc3530bd6d6c4b8122224a0529c64
TLSH
T12BC09BD75414959647F5EFC5203C624E911F4D59C8C4CCE4D445B0477178D178915E39
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 1b888b8dde303107d6a555754a848e7f796531ac7009d4eaec2f6fbd3e3c978a
MD5 2815782be38300142bc8b44411a6dc8e
SHA1 e2667f3df9b47cee84c61dd0a39f0cde91c1f1f1
SHA512 f7a2ec8aca024075a87a05d817a1b416b37a5cb1dc884e149954954455cd9533743deb5205b866d5fb110acea10c8bc1deb96aed31aaa4eccfa7026a5a7c5dee
TLSH
T11AB01200804B5B40DC0047B01518144F22516E258100130297D895C9AC471F11114300
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 5c38653ae83b916d692127453acd68f94ed4089ef6cc9816319a7e8b39a45d4b
MD5 9ac01f1014f0fe5d8fe9a6d0d31df6f7
SHA1 51ea945a436db913b8c16dd1a2f736333c668b1d
SHA512 12ff7da5cd5268c70045695de3cbf6de920f0d7d16e86c485baa38ea43036eba1707050e30d39142f28c014abf9d3e392b2ef248ba51b9ce788767056b6a39bc
TLSH
T1C8B0220C20023B23EB08A330E3C20CC033228EEC33EB008B00A0000ACC322838E00200
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 91d0a0e59857dac4fd7237195ce377b4fae3e3fee41f5b5a76f815df60e81e79
MD5 167298f07f3d681531388c6fd2a7a415
SHA1 b3c80988610f062187fd67f2d2d7fa5ee574446e
SHA512 54f46aa4838da00cdde78b8a5325b04f903c644fb9710cb67450b8cc8e92ef91ab12a827894256eade0750fe5e82b092fbfbe29639bb3d8bec8968c633913969
TLSH
T18AA0025081D44812FD416775A6611A4136555C1C2A954753ECD134849CAB3C44501510
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 bf4d1deb087280ff8a7b0bd7aaf0e881011574c0991df4b19c981c81f3d256a6
MD5 6e65a28dcb462d8ef4234269e2f32128
SHA1 b74431a28edcface324732a5e6eb850af17de37a
SHA512 14a605f5aa3a85167013e9f90d69a8de2a27f4968a90e9ccdccc52c9b6463c2dcf19f3e781c5cd14fbecb49445aefc2686ceb212f58abce8e9de9750afa2da83
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

512.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir3536_403050464\Shortcuts Menu Icons\0\512.png
Size 4KB
SHA256 d345d2dbe2efd56ff9494cb31cae0e28cde5bdf176a22bca9aee27465b117c88
MD5 97193e4d969021cb6e6ad1b25bb7499a
SHA1 69cb3acd8bc0b31b63791efc9dc47d5657bbf40b
SHA512 1df06713846ea152089ea40434f3fcff250ba2d2c0b5afcbc546b82a65b68f3ad1cf503dbc4e8246765c01f191b4f8389c4c55efb7da507f443d858a8dfd704b
SSDEEP 96:TTcYKfambSQTNpzzBOWUjfRVS/TFm9BfyKhnaBS8ZP9jeLWfbOGp:SbSQTNh9gD+mLfB49ZILWfCW
TLSH
T1B0A1968E8CB5488E66658747D48538A2C5B030A7A7BFC3BE719D174851E32C6FF29B06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

512.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir3536_403050464\Shortcuts Menu Icons\1\512.png
Size 7KB
SHA256 1e0b1b2e4dac49da1e2ce91a72e01f77fdb3bbb26ed3422e5d4037745cc307a4
MD5 cc525d60c0dc9696ddfe9524dc9abe82
SHA1 fc94cbd2a45bf2ff0fbe411f57a7cafa31126bfd
SHA512 09ab42f7dc3d6a08b9635ef229539a5c4c240506378a9de4eccf1f69d52b266222cdf084e9a567c6d21f19e61c4da7ccd98928870d6f10cd74e9158c64a4142e
SSDEEP 192:U3/tgbWgm8Xl2X+xqWwB3kUXPmv9rCywxAQU:2/rgXXExWKdXPa+txrU
TLSH
T159F1AF6F639B59EA3AF8493D4BD7A21FD62E108A2F275B71C5101045628A1C1FC69F0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

512.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir3536_403050464\Shortcuts Menu Icons\2\512.png
Size 9KB
SHA256 ad08077126e7106674e4219f5f9cfac2305e8b3f627247c1d3e72136399e6fd2
MD5 660ae59d489be5b5e1e9036b88b4a033
SHA1 b1ebdb9421bf14b5c43a399b4dbd92288d91a604
SHA512 3bf52f4d1e92ececb7691bedf1f53dea75041615447eac2c1ec9f99d07417a571e08fbd2db58896506350e8af831e8fc943d35e35747a8cb6db9a03d880331f9
SSDEEP 192:uJTyU9sUZdxl59pfNK8EliT9Tjx/t0xM6LwZx4nwBmJH/Rr6O:g9sUxXM8iiJKMfcTJIO
TLSH
T1F022BE9744E4E7A3427CAEBF4684D914DF4E1B7384366E10020B199F0D7AA8268E8B93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\4\CacheStorage\index.txt
Size 237B
SHA256 5826974d566495694789573e2ef1601547910a9af9ae47f07a6dfff0b16f208c
MD5 8f9f4bfd4e327afc8c6de44331a36a44
SHA1 b41cf88715dfb5016873414a5f0a6e19e3ccd26a
SHA512 ce39add45d51703394f19e415b3c66a6e5db88c4c24f19f454b6cb113ed513cdc4c75c5189d227ab9a57140234d6ec3d8e6af5bdc779ed36e998a3fc432c3a70
TLSH
T1A4D097FA8220CC0A1730AAE44110320CC0874F1CCCCDC8A09C06B003213CB138002836
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\4\CacheStorage\index.txt
Size 153B
SHA256 44e063d9a1b510563d154522ee001340e9b8680ba690079fb0bfe27a32d5d807
MD5 1756c26bd7bf9db71740bea8f682bd65
SHA1 fb45fd5ede88e6a2d941d32db1a0726da8d8c806
SHA512 142757f5fed2e47d75e0f4149a3865cc4c54f1394ec74c39bee53c2170853f7a7e67bdeaa6e3626fc472361c5cd604376e2f8ab80c1f63b29870281b129c5341
TLSH
T144C08CEB44008C8E0BB0ADE45414770CE54B871C88CAC8E095590002123CF270802932
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5a35c7.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\4\CacheStorage\index.txt~RFe5a35c7.TMP
Size 160B
SHA256 85b620570e1e9b9b8c9345ce803dd7e65836b71384f900a55f9fc992176ca75d
MD5 49e1fe1de7f53b8f6e8d962c3afc725a
SHA1 e47f593df8bcd15e89d8f2f11bb35cb26f65bda8
SHA512 9fbc2bdd20ed02ed797f8d0370db1f3b611c157edcc7472add225ad2460b753e865c475275d29f1c40875bceaf3f67302d5256ae00de04575cf0a67ebb97e9ca
TLSH
T1FCC08CEB44104C8A0BB068E09024770EE58B8E2D8ECAC8E0A51A3102223CF274805832
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 135KB
SHA256 e741ff3f4e1d989cf543df6b6de31663206383259c6cae7d56753457fc25be38
MD5 23b27370b1a3112684c79bd91e9e293a
SHA1 264a81f719fbe6227338d1563aca2fe9646e090f
SHA512 c674ae8183eed4c398db2f93758ef3857c505df37ebadce9949734e218be8b8c91be1e6d41d3324a20f4aae41ff983684d69450630e68d56f8d967fd618bfa39
SSDEEP 3072:lYdRwSdWz4id1Us4da60CBpifyNLK7s5KPp5Rm/H4E:lYdRwzlT48FCBpi6Leah
TLSH
T1CED312763CED7EA6AF56FC25A88615039D6D38599DC1DFE62EBA8F8B480D0F00316406
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 1c46eacbe8c6bf1d582db39b78c7a877b3747f3c588cdeb66dc74efdc10883af
MD5 ca368ff624c8157ded6aca15ecd8b403
SHA1 aa2b8a9474bd80eeda3fe92e112dd606a1bdd6ff
SHA512 986f632115b03fca7494eab43019fe502d86cb6e6f2f4ff8d36e58862cb3078511d1f339978b5d230426528f1edce594e294b30683448b170a8055d18d59cbbf
SSDEEP 96:OC0d+2+07WJ3aJPWyqgfdfNgxSl8h4otop54sD7B60GyvQClg7cOqWeSNJQL0j9u:OC0d57WJ3aJ+yh2iU2HFUlBq2NJQLUHO
TLSH
T1F8C119B1B47DA87B55F79852F5073E43CDE8619B9910AF50CAD60F0A11EB4EC2386227
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 6b6e49b940a8df9d789efe62fea631d7846a1220c850bde8cbf38f1d3060351b
MD5 d24792ec90327785539ba67e7739c482
SHA1 0ddcd0366028d80c94709434a0e502f39f26eac7
SHA512 d78ad565116d2a7a6471911d77813a096269f999202fd271e4aeeb5ab13821f885e004a6ba20daacd7f104d720d89392ec8e20b361cafeee09dcd2304956f51e
SSDEEP 96:8C0d+2+07WJ3aJPWyqgfdfrgnRDotok544D7B6FJGyvQCl47YQZPE4/Rv4a:8C0d57WJ3aJ+yhYDUDrFS0rYQZsM
TLSH
T166A10970F469997794F6C986F9023A07DEA8A15A9921AF80D8D90E0A21E74E81342123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 135KB
SHA256 99397270b2939d123c74d5028a544260bc812af56d2b60263587202296a8b920
MD5 239a199754f9cbb864e410ef7107f75b
SHA1 a80efcdfe02dd2686992f1bbe2ad489a51fb9ac5
SHA512 c54730c947ed625c4eed54bbb6f0cf48809d860d1db13901c1903e0f8a6054508ba0d78b5e560b7614927833446887ec4fbef7b28e17ee8426182d2f5a4f479c
SSDEEP 3072:AOdRwSdWz4id1Us4da60CBpifyNLK7s5KPp5Rm/H4E:AOdRwzlT48FCBpi6Leah
TLSH
T1E2D312763CED7EA6AF56FC25A88615039D6D38595DC1DFEA2EBA8F8B480D0F00316405
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 136KB
SHA256 9e3c9f351aa8e7684374b090a410742742f4f16b10999fd9162b5af025f55b3f
MD5 160270a3bc00dead1a0cb87fc84cf718
SHA1 925c218adc1057237ab703667e1c75370865e34f
SHA512 66d7845c81d68969b8dcae2ec405c0e0b188e067eda9750636a54ee0f0657c740c174b91518721ee3695aa8fe731a4b1694bd65c23a3a59d8994e8c4169f5fd9
SSDEEP 3072:lgdRwSdWz4id1Us4da60CBpifyNLK7s5KPp5Rm/H4E:lgdRwzlT48FCBpi6Leah
TLSH
T1D4D312763CED7E96AF52AC54A84615039CAD785F9DC5EFEA2DB98F8B480E0E10313406
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 135KB
SHA256 39e449d0cd495b53b19ac6e87c83cfab0fdaf15eef84987ea9766d4f730bb90a
MD5 68a672886983a9c1825efd13e09ef514
SHA1 7da0b9ab17dc31d2890d46ca3ea370ed72372e16
SHA512 8a552ee335264405089529b646e7127ba6bac61532fbc082e88390b8d5158f30c7e41f7d0b9c8856d3de4ce5749815638f76fa65a478ff54abfaa95189f4b4ee
SSDEEP 3072:lIdRwSdWz4id1Us4da60CBpifyNLK7s5KPp5Rm/H4E:lIdRwzlT48FCBpi6Leah
TLSH
T1A8D312763CED7EA6AF56FC25A88615039D7D38595DC1DFEA2EBA8F8B480D0F00316405
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3536_1610266692\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4116-0-0x0000000140000000-0x000000014003D000-memory.dmp

Download

memory/4116-1-0x0000000140000000-0x000000014003D000-memory.dmp

Download