94e28d9e4167886c99f1297095c9714443ecdc686ae1e69ebafaab275b3107cf

Analysis

user interaction
yes
max time kernel
1800s
max time network
1796s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 12:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Road_to_Revolution (1).pptx
Size 119KB
Sample260930-pmqv5axemd
SHA256 94e28d9e4167886c99f1297095c9714443ecdc686ae1e69ebafaab275b3107cf
MD5 ba48eb71695e6f9e8f631923f4c1069b
SHA1 9dc45b454655edccfcd72228ac48bfbde96429ea
SHA512 63d263a0663a6d1f04ff3058f15f6c2049f5a406fcc4668ab32b29bbd21ed1f1bcc35bad45a54cdf37d77ffb632330c6e1d03851a222d03ee05b9d890a827478
SSDEEP 3072:0kWYODZKt3WPbsgjmnlSgW055lwoaHrjK0Ah6BeGuXv7071bU2xKQ3O:5h
TLSH
T142C395C0F1558D66DB62377890FFB100AEA8D1770381AA2D67C835F9904298E6C863FF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
106	1836	chrome.exe
136	1836	chrome.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
16	discord.com
81	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1836	chrome.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	POWERPNT.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	POWERPNT.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1404337215-1550464601-2805570857-1000\{2F2C9CBC-3814-492C-AD3C-92DB7F7D9F4C}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1176	POWERPNT.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5428	chrome.exe
5428	chrome.exe
5428	chrome.exe
5428	chrome.exe
4480	chrome.exe
4480	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1176	POWERPNT.EXE

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 27 IoCs

pid	Process
5428	chrome.exe
5428	chrome.exe
5428	chrome.exe
5428	chrome.exe
5428	chrome.exe
5428	chrome.exe
5428	chrome.exe
5428	chrome.exe
5428	chrome.exe
5428	chrome.exe
5428	chrome.exe
5428	chrome.exe
5428	chrome.exe
5428	chrome.exe
5428	chrome.exe
5428	chrome.exe
5428	chrome.exe
5428	chrome.exe
5428	chrome.exe
5428	chrome.exe
5428	chrome.exe
5428	chrome.exe
5428	chrome.exe
5428	chrome.exe
5428	chrome.exe
5428	chrome.exe
5428	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5428	chrome.exe
Token: SeCreatePagefilePrivilege	5428	chrome.exe
Token: SeShutdownPrivilege	5428	chrome.exe
Token: SeCreatePagefilePrivilege	5428	chrome.exe
Token: SeShutdownPrivilege	5428	chrome.exe
Token: SeCreatePagefilePrivilege	5428	chrome.exe
Token: SeShutdownPrivilege	5428	chrome.exe
Token: SeCreatePagefilePrivilege	5428	chrome.exe
Token: SeShutdownPrivilege	5428	chrome.exe
Token: SeCreatePagefilePrivilege	5428	chrome.exe
Token: SeShutdownPrivilege	5428	chrome.exe
Token: SeCreatePagefilePrivilege	5428	chrome.exe
Token: SeShutdownPrivilege	5428	chrome.exe
Token: SeCreatePagefilePrivilege	5428	chrome.exe
Token: SeShutdownPrivilege	5428	chrome.exe
Token: SeCreatePagefilePrivilege	5428	chrome.exe
Token: SeShutdownPrivilege	5428	chrome.exe
Token: SeCreatePagefilePrivilege	5428	chrome.exe
Token: SeShutdownPrivilege	5428	chrome.exe
Token: SeCreatePagefilePrivilege	5428	chrome.exe
Token: SeShutdownPrivilege	5428	chrome.exe
Token: SeCreatePagefilePrivilege	5428	chrome.exe
Token: SeShutdownPrivilege	5428	chrome.exe
Token: SeCreatePagefilePrivilege	5428	chrome.exe
Token: SeShutdownPrivilege	5428	chrome.exe
Token: SeCreatePagefilePrivilege	5428	chrome.exe
Token: SeShutdownPrivilege	5428	chrome.exe
Token: SeCreatePagefilePrivilege	5428	chrome.exe
Token: SeShutdownPrivilege	5428	chrome.exe
Token: SeCreatePagefilePrivilege	5428	chrome.exe
Token: SeShutdownPrivilege	5428	chrome.exe
Token: SeCreatePagefilePrivilege	5428	chrome.exe
Token: SeShutdownPrivilege	5428	chrome.exe
Token: SeCreatePagefilePrivilege	5428	chrome.exe
Token: SeShutdownPrivilege	5428	chrome.exe
Token: SeCreatePagefilePrivilege	5428	chrome.exe
Token: SeShutdownPrivilege	5428	chrome.exe
Token: SeCreatePagefilePrivilege	5428	chrome.exe
Token: SeShutdownPrivilege	5428	chrome.exe
Token: SeCreatePagefilePrivilege	5428	chrome.exe
Token: SeShutdownPrivilege	5428	chrome.exe
Token: SeCreatePagefilePrivilege	5428	chrome.exe
Token: SeShutdownPrivilege	5428	chrome.exe
Token: SeCreatePagefilePrivilege	5428	chrome.exe
Token: SeShutdownPrivilege	5428	chrome.exe
Token: SeCreatePagefilePrivilege	5428	chrome.exe
Token: SeShutdownPrivilege	5428	chrome.exe
Token: SeCreatePagefilePrivilege	5428	chrome.exe
Token: SeShutdownPrivilege	5428	chrome.exe
Token: SeCreatePagefilePrivilege	5428	chrome.exe
Token: SeShutdownPrivilege	5428	chrome.exe
Token: SeCreatePagefilePrivilege	5428	chrome.exe
Token: SeShutdownPrivilege	5428	chrome.exe
Token: SeCreatePagefilePrivilege	5428	chrome.exe
Token: SeShutdownPrivilege	5428	chrome.exe
Token: SeCreatePagefilePrivilege	5428	chrome.exe
Token: SeShutdownPrivilege	5428	chrome.exe
Token: SeCreatePagefilePrivilege	5428	chrome.exe
Token: SeShutdownPrivilege	5428	chrome.exe
Token: SeCreatePagefilePrivilege	5428	chrome.exe
Token: SeShutdownPrivilege	5428	chrome.exe
Token: SeCreatePagefilePrivilege	5428	chrome.exe
Token: SeShutdownPrivilege	5428	chrome.exe
Token: SeCreatePagefilePrivilege	5428	chrome.exe

Suspicious use of FindShellTrayWindow 40 IoCs

pid	Process
5428	chrome.exe
5428	chrome.exe
5428	chrome.exe
5428	chrome.exe
5428	chrome.exe
5428	chrome.exe
5428	chrome.exe
5428	chrome.exe
5428	chrome.exe
5428	chrome.exe
5428	chrome.exe
5428	chrome.exe
5428	chrome.exe
5428	chrome.exe
5428	chrome.exe
5428	chrome.exe
5428	chrome.exe
5428	chrome.exe
5428	chrome.exe
5428	chrome.exe
5428	chrome.exe
5428	chrome.exe
5428	chrome.exe
5428	chrome.exe
5428	chrome.exe
5428	chrome.exe
5428	chrome.exe
5428	chrome.exe
5428	chrome.exe
5428	chrome.exe
5428	chrome.exe
5428	chrome.exe
5428	chrome.exe
5428	chrome.exe
5428	chrome.exe
5428	chrome.exe
5428	chrome.exe
5428	chrome.exe
5428	chrome.exe
5428	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5428	chrome.exe
5428	chrome.exe
5428	chrome.exe
5428	chrome.exe
5428	chrome.exe
5428	chrome.exe
5428	chrome.exe
5428	chrome.exe
5428	chrome.exe
5428	chrome.exe
5428	chrome.exe
5428	chrome.exe
5428	chrome.exe
5428	chrome.exe
5428	chrome.exe
5428	chrome.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1176	POWERPNT.EXE
1176	POWERPNT.EXE
1176	POWERPNT.EXE
1176	POWERPNT.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5428 wrote to memory of 5028	5428	chrome.exe	102
PID 5428 wrote to memory of 1836	5428	chrome.exe	103
PID 5428 wrote to memory of 1436	5428	chrome.exe	104
PID 5428 wrote to memory of 1436	5428	chrome.exe	104
PID 5428 wrote to memory of 3008	5428	chrome.exe	106
PID 5428 wrote to memory of 3008	5428	chrome.exe	106
PID 5428 wrote to memory of 5204	5428	chrome.exe	107
PID 5428 wrote to memory of 5204	5428	chrome.exe	107
PID 5428 wrote to memory of 844	5428	chrome.exe	108
PID 5428 wrote to memory of 844	5428	chrome.exe	108
PID 5428 wrote to memory of 4292	5428	chrome.exe	109
PID 5428 wrote to memory of 4292	5428	chrome.exe	109
PID 5428 wrote to memory of 3708	5428	chrome.exe	110
PID 5428 wrote to memory of 3708	5428	chrome.exe	110
PID 5428 wrote to memory of 4328	5428	chrome.exe	111
PID 5428 wrote to memory of 4776	5428	chrome.exe	112
PID 5428 wrote to memory of 5452	5428	chrome.exe	113
PID 5428 wrote to memory of 4776	5428	chrome.exe	112
PID 5428 wrote to memory of 5452	5428	chrome.exe	113
PID 5428 wrote to memory of 2856	5428	chrome.exe	118
PID 5428 wrote to memory of 5144	5428	chrome.exe	117
PID 5428 wrote to memory of 2856	5428	chrome.exe	118
PID 5428 wrote to memory of 5144	5428	chrome.exe	117
PID 5428 wrote to memory of 3024	5428	chrome.exe	119
PID 5428 wrote to memory of 3024	5428	chrome.exe	119
PID 5428 wrote to memory of 2080	5428	chrome.exe	120
PID 5428 wrote to memory of 2072	5428	chrome.exe	121
PID 5428 wrote to memory of 2080	5428	chrome.exe	120
PID 5428 wrote to memory of 4400	5428	chrome.exe	122
PID 5428 wrote to memory of 2072	5428	chrome.exe	121
PID 5428 wrote to memory of 4400	5428	chrome.exe	122
PID 5428 wrote to memory of 2716	5428	chrome.exe	124
PID 5428 wrote to memory of 4808	5428	chrome.exe	125
PID 5428 wrote to memory of 5616	5428	chrome.exe	123
PID 5428 wrote to memory of 2716	5428	chrome.exe	124
PID 5428 wrote to memory of 4808	5428	chrome.exe	125
PID 5428 wrote to memory of 5616	5428	chrome.exe	123
PID 5428 wrote to memory of 1328	5428	chrome.exe	126
PID 5428 wrote to memory of 1328	5428	chrome.exe	126
PID 5428 wrote to memory of 1208	5428	chrome.exe	127
PID 5428 wrote to memory of 1208	5428	chrome.exe	127
PID 5428 wrote to memory of 3340	5428	chrome.exe	128
PID 5428 wrote to memory of 3340	5428	chrome.exe	128
PID 5428 wrote to memory of 2320	5428	chrome.exe	129
PID 5428 wrote to memory of 2320	5428	chrome.exe	129
PID 5428 wrote to memory of 4280	5428	chrome.exe	130
PID 5428 wrote to memory of 4280	5428	chrome.exe	130
PID 5428 wrote to memory of 5936	5428	chrome.exe	131
PID 5428 wrote to memory of 5936	5428	chrome.exe	131
PID 5428 wrote to memory of 5676	5428	chrome.exe	132
PID 5428 wrote to memory of 5676	5428	chrome.exe	132
PID 5428 wrote to memory of 5344	5428	chrome.exe	133
PID 5428 wrote to memory of 480	5428	chrome.exe	134
PID 5428 wrote to memory of 2496	5428	chrome.exe	135
PID 5428 wrote to memory of 3996	5428	chrome.exe	136
PID 5428 wrote to memory of 3996	5428	chrome.exe	136
PID 5428 wrote to memory of 2988	5428	chrome.exe	137
PID 5428 wrote to memory of 2988	5428	chrome.exe	137
PID 5428 wrote to memory of 1688	5428	chrome.exe	138
PID 5428 wrote to memory of 3128	5428	chrome.exe	139
PID 5428 wrote to memory of 3128	5428	chrome.exe	139
PID 5428 wrote to memory of 2844	5428	chrome.exe	141
PID 5428 wrote to memory of 2844	5428	chrome.exe	141
PID 5428 wrote to memory of 2236	5428	chrome.exe	142

C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE
"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" "C:\Users\Admin\AppData\Local\Temp\Road_to_Revolution (1).pptx" /ou ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1176

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3124

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:2016

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff94742c728,0x7ff94742c734,0x7ff94742c740
  2⤵
  PID:5028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1480,i,2480264314624955599,15011368892720611329,524288 --field-trial-handle=2060,i,15930961109489190988,3298161020625172315,262144 --variations-seed-version --mojo-platform-channel-handle=2144 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:1836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1628,i,11532934022909420413,11467466835373565603,262144 --field-trial-handle=2060,i,15930961109489190988,3298161020625172315,262144 --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:2
  2⤵
  PID:1436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2332,i,7940661217355485406,16156899108362947644,524288 --field-trial-handle=2060,i,15930961109489190988,3298161020625172315,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:13
  2⤵
  PID:3008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3256,i,10787669143240029504,12123638944781062697,2097152 --field-trial-handle=2060,i,15930961109489190988,3298161020625172315,262144 --variations-seed-version --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:5204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3360,i,15580652482899567565,17187944145134620629,2097152 --field-trial-handle=2060,i,15930961109489190988,3298161020625172315,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4732,i,14071226407661488217,17267155607493517905,524288 --field-trial-handle=2060,i,15930961109489190988,3298161020625172315,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:14
  2⤵
  PID:4292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4880,i,757645201006015004,10049924237622453106,2097152 --field-trial-handle=2060,i,15930961109489190988,3298161020625172315,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:1
  2⤵
  PID:3708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5408,i,12593493134891021894,16338800793940672082,524288 --field-trial-handle=2060,i,15930961109489190988,3298161020625172315,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:14
  2⤵
  PID:4328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5512,i,6732590816745046458,8044292191098221638,2097152 --field-trial-handle=2060,i,15930961109489190988,3298161020625172315,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:4776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5524,i,6682337241165346678,17424229874050950494,2097152 --field-trial-handle=2060,i,15930961109489190988,3298161020625172315,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:5452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5836,i,8926604551644473489,4934909438148663434,2097152 --field-trial-handle=2060,i,15930961109489190988,3298161020625172315,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:5144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5844,i,13213335433211004923,10288253021240554414,524288 --field-trial-handle=2060,i,15930961109489190988,3298161020625172315,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:14
  2⤵
  PID:2856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6020,i,3425096976697179682,4770696740874374042,2097152 --field-trial-handle=2060,i,15930961109489190988,3298161020625172315,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:1
  2⤵
  PID:3024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6268,i,8191536983229500117,13466496456228355583,2097152 --field-trial-handle=2060,i,15930961109489190988,3298161020625172315,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:2080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5600,i,17480278617315261854,14883773787461718952,524288 --field-trial-handle=2060,i,15930961109489190988,3298161020625172315,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:14
  2⤵
  PID:2072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6112,i,16041020044467034650,16702046017020053193,2097152 --field-trial-handle=2060,i,15930961109489190988,3298161020625172315,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:1
  2⤵
  PID:4400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6104,i,12319823246350282822,5152433973882148652,2097152 --field-trial-handle=2060,i,15930961109489190988,3298161020625172315,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:1
  2⤵
  PID:5616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5740,i,13006147662159283596,552188598880896140,524288 --field-trial-handle=2060,i,15930961109489190988,3298161020625172315,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:14
  2⤵
  PID:2716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6024,i,14786991802234353821,460740671004321950,2097152 --field-trial-handle=2060,i,15930961109489190988,3298161020625172315,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:1
  2⤵
  PID:4808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6652,i,9829467953393413866,1325462626411550802,2097152 --field-trial-handle=2060,i,15930961109489190988,3298161020625172315,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:1328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6620,i,17537001849322969840,14981608586831140592,2097152 --field-trial-handle=2060,i,15930961109489190988,3298161020625172315,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:9
  2⤵
  PID:1208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5612,i,8375827983168304611,12895408878103369673,2097152 --field-trial-handle=2060,i,15930961109489190988,3298161020625172315,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:1
  2⤵
  PID:3340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6536,i,6148414493713206459,5079381908089936473,2097152 --field-trial-handle=2060,i,15930961109489190988,3298161020625172315,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:1
  2⤵
  PID:2320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6084,i,5419639124694713614,3424752362691643358,2097152 --field-trial-handle=2060,i,15930961109489190988,3298161020625172315,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:1
  2⤵
  PID:4280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=5872,i,10690568271429754337,6492709660979719172,2097152 --field-trial-handle=2060,i,15930961109489190988,3298161020625172315,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:5936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=5536,i,8159120257190606747,9350946022398790765,2097152 --field-trial-handle=2060,i,15930961109489190988,3298161020625172315,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:1
  2⤵
  PID:5676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6820,i,13044068216125110496,16917179997662904232,524288 --field-trial-handle=2060,i,15930961109489190988,3298161020625172315,262144 --variations-seed-version --mojo-platform-channel-handle=6824 /prefetch:14
  2⤵
  PID:5344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5784,i,2190208007731743457,11140455198972091290,524288 --field-trial-handle=2060,i,15930961109489190988,3298161020625172315,262144 --variations-seed-version --mojo-platform-channel-handle=6836 /prefetch:14
  2⤵
  PID:480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5804,i,9635916863107064693,15765822897458373954,524288 --field-trial-handle=2060,i,15930961109489190988,3298161020625172315,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:14
  2⤵
  PID:2496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=5856,i,8611589105821250788,5586172828361515373,2097152 --field-trial-handle=2060,i,15930961109489190988,3298161020625172315,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:1
  2⤵
  PID:3996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=5648,i,15809389714980956740,8748271130885973286,2097152 --field-trial-handle=2060,i,15930961109489190988,3298161020625172315,262144 --variations-seed-version --mojo-platform-channel-handle=6928 /prefetch:1
  2⤵
  PID:2988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6360,i,18292603663854755347,13520077210724364611,524288 --field-trial-handle=2060,i,15930961109489190988,3298161020625172315,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:14
  2⤵
  - Modifies registry class
  PID:1688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6032,i,5032822268101435650,3858111323179571666,524288 --field-trial-handle=2060,i,15930961109489190988,3298161020625172315,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:12
  2⤵
  PID:3128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=6480,i,13357335038135384835,17540886108075957496,2097152 --field-trial-handle=2060,i,15930961109489190988,3298161020625172315,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:1
  2⤵
  PID:2844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=6816,i,5806635353460548465,1265240173803737093,2097152 --field-trial-handle=2060,i,15930961109489190988,3298161020625172315,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:2236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=5636,i,15596580512707738166,14493648724317099355,2097152 --field-trial-handle=2060,i,15930961109489190988,3298161020625172315,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:1
  2⤵
  PID:3424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=6476,i,3595105549082670919,3128390757913796607,2097152 --field-trial-handle=2060,i,15930961109489190988,3298161020625172315,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:1
  2⤵
  PID:3724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=7276,i,12669274549515117170,12705054312370428053,2097152 --field-trial-handle=2060,i,15930961109489190988,3298161020625172315,262144 --variations-seed-version --mojo-platform-channel-handle=7268 /prefetch:1
  2⤵
  PID:2980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --metrics-shmem-handle=5636,i,8208223631674957246,7350071440168550987,2097152 --field-trial-handle=2060,i,15930961109489190988,3298161020625172315,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:1
  2⤵
  PID:4896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=6296,i,16348241060213728090,6265538826819948846,2097152 --field-trial-handle=2060,i,15930961109489190988,3298161020625172315,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:1
  2⤵
  PID:2716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5724,i,9672266056457130067,11375229044555368128,262144 --field-trial-handle=2060,i,15930961109489190988,3298161020625172315,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4492,i,17866788427516459170,4667822740135076927,524288 --field-trial-handle=2060,i,15930961109489190988,3298161020625172315,262144 --variations-seed-version --mojo-platform-channel-handle=1540 /prefetch:14
  2⤵
  PID:2856

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2660

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1828

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3592

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:4468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 a18fc0fc3c5efc12ba74166f9f41dcdcf1860471feafe941937961f503e06635
MD5 a3f0562bc68f5979fe53fce769e5b8b8
SHA1 643d28a3535049b1893920c6413ca8b7afcd4f56
SHA512 afb56dec9ac16c223196f30c74541c90579d4f1d692432cff4cf783bbed9f7d9f13441d7a282230242f9b98c6590364f6af2c689354d3a45e02fc1737850badd
TLSH
T1ED217A35A4D0F615DBA40CB829EA86EA3C777F8402830F2101014EB8FEF1F69D22CE94
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

0851813b-4cd5-417a-8ad5-544722917f64.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\0851813b-4cd5-417a-8ad5-544722917f64.tmp
Size 10KB
SHA256 f322626ac0f26b30a5b513f37dd10c14ef05e28eba3b56c6ff759db63aa47a24
MD5 ec931ef8910371ea6a1905f7337f3adf
SHA1 d0055951bfc4302aeabbc624ed8221fd1264eca2
SHA512 7f9f2ae71fabd661332a4248771fe1091b729e231bc6029b7fedc31f1aadc5a5d242d324d499b3e127b51614f3ebb88beecb0b15c45d189182a8e89f93bd00bc
SSDEEP 192:DTOhumMsXn+dDwd3TI7ZI1NaNEd7cMf8NV2KySraKscrmpGvS06shwqjhnzHFyR1:DTOhumMsXn+dDwd3TI7ZI1NaNEd7cMfp
TLSH
T106228DF7C3E48A2ED81156F49B187D1BCD691924532C3D76CAE4EE4B63E2472E24074E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 479b256ca4f70393db0c0403ec75cad0487da769a0e694c955d4b73060ca0e4f
MD5 306d099cc05e86ed9adda36dd4b6637e
SHA1 50565bee548278b14c4f21ec3f91a99a3499306c
SHA512 655eecca1c00bc4e7cde8ef47125ffa46c5083b1e64ea9f3d4b3e19e16b7f15f41195e666684fa7afb4b6c332274de47dcd41429d0993b0bbbb4583586fa22ad
SSDEEP 384:DlEj3Mej2VGVZPp4iA91NfiMh07czf8NtTRlmWrOKsFijJjRH1GvFc6shPRyl:mi
TLSH
T19B42ADF7C3E4C62ED81156F49B187E1ACE5D1D28932C3D26C9E5EE4B63E2471E240A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 b6ee98bce5f910ad84bdb42b03f557d4cdcb50e050c04384684ec500bb91b2db
MD5 23aa9ef704f4514f1bbc5bb3ed042df1
SHA1 06ab49e0d5d9421f4b0b5dbd5d881bf756006160
SHA512 ed0885783463cd73ebe65e6d578bd7cea4c16bec64a3c40ada7d567f2c3bcc00340be41e416978152141ae0e6919abeb0cbdf1b250f496e1ddecc01b4e6ba695
SSDEEP 384:DlEm3Mej2VGVZPp4iAeQ1NfiMh07czf8Nt2KWrOKsJjJjRH1GvFc6shwqm/ZNiBT:91
TLSH
T1AC42ADF7C3E4C62ED81156F49B287E1ACE5D1D28932C3D26C9E5EE4B63E1471E240A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 6e6537bd8aa5b4809869845be5d3084e720446fbdd9467f9642fa620c16d1929
MD5 37bc70299f3423fe161063b9347b4fd4
SHA1 04b0e4ccf408111e4dbc2765c46bd66eb0cf404d
SHA512 baa1d8c6fd7d9b87a3f8fd41a0efa345f4608d7e36905fba687ea5af14f6c8c739bfa727ef12147a517387c0763630dbdaaab2d3b8ee835239a82eed706a5dce
SSDEEP 384:DlEj3Mej2VGVZPp4iAe7a1NfiMh07czf8Nt2KWrOKsJjJjRH1GvFc6shwqmzHDAT:c1
TLSH
T10652ADF7C3E4C62ED81156F49B287E1ACE5D1D2893283D26C9E5EF4B63E1471E240A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 695be62e1e01d726b2864fa8efaa4b59fc337037a5aead62f42bd9de74104b3c
MD5 253e10a0edd6c74d4e8d717e403bb115
SHA1 e95bf85c16378b48693bb570f782242d622ff22f
SHA512 251068f48d50e65c79cafe7b4e4e210666bbf8698d7a989279bdafe973f41396e4835c4d3e16abf75c0b1bce228f98aa662356668467ad1c7eb36215d0728d61
SSDEEP 192:DTOhumMsXn+dDwd3TI+Zn11NaNEd7cMf8NV2KySraKscrmpGvS06shwqjhnRHvaT:DTOhumMsXn+dDwd3TI+Z11NaNEd7cMfR
TLSH
T1CF228DF7C3E4862ED81156F4DB186D1BCD691924532C3D76CAE4EE4B63E2472E240B4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 0ea3eeb57b74e79303b0fd3ab3e28b8b4f2a615480fb5d2abab3a68c84f1b97f
MD5 14c20643370296bb0e9fd893f178d710
SHA1 4c58bf44d1f5128fa7a724f08b256773f0400543
SHA512 7fff332cfa69a380b26a8a205f4938eb54530119bca1c3a7142757c8b4f5894d0d22bc8970191b6c0ffd35102ebef197aa1711d97326fb0bcecc4bc5ceec0bc4
TLSH
T1D7418AB7837EB837283A4CAB1E4D78451DFBB434A1D524F4DA97812E70C15F75B2242A
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 d300b2af91bdac770f3ff08926588b23dc141a3f030e2cf5fb06f42f25176eda
MD5 e06bd8c2b6888d94024c930b4e492d5e
SHA1 48dc044fd352e6c5fedf91f1d762febe666d23cf
SHA512 f62cd091d38f6129bdf9f74eff7cbca8e767ee434f029d99b66428b3650f0abf3857ab778db67fb30377cb1b8fa868d7b4ea974bccd5a46522bbf420335b2231
SSDEEP 192:TRI0XcMCv7H1APRp2b9OHsb+WNnPrduy28eMH5GVyIsnAUge:TRI0XFObAXokwDd12Kge
TLSH
T17C32932DAE64B57F5CCAC319FA66BB57EAF5002530842E84EAFC893C15E79CC2217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 c7c5700733cd254763bc73ea4ce673bd5464040325acb8d07ee2a1faca750e01
MD5 68b17f499c4fd4a280cc331b4ac85da2
SHA1 d0abbe6b75ab44e1a1ac9b7f7bddf286a210d049
SHA512 c3ec23946ada89a8f796332aba6eb770854a06870e04999236b19b641bad7efaf64e93e4155d03dcbdc97fce24af451269f09e88dde8a34b48c7ad13ee7222bf
SSDEEP 192:TRIQXcDtCv7gxWAPRp21hyf/2Vre9OHsb+WNv+SbPrncc2Gy28eMH5VVyIsnAUgE:TRIQXQO8xXXPkwBz292KlE
TLSH
T12752D66AA964697F5CDAC319F961F767E7F4103560C01E84EAFC893C15EBACC2217843
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 af7a396857e9389439b7e478ca60b1c3cfb905a8cdda4dc594a28cc3193d6909
MD5 042ed1afee2cd052161b1a8f2fa972da
SHA1 90b8121967a2df572e0930edcd6734df83e9d139
SHA512 5dcec52dcda2a6385c883fb9e710b3330052988c15c30b10f85a648826fcf958328e6e5b9542f920f686d0b476b0a47d89a670ca75363285fa0ad8182306b9e0
SSDEEP 192:TRI0XcDtCv7H1APRp2S29OHsb+WNnPrncc2Xy28eMH5GVyIsnAUge:TRI0XQObAXYkwDz2i2Kge
TLSH
T14C42A429AE64B57F5CDBC319FA66B767EAF5002530842E84EAFC893C15E79CC2217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 083a1cc8dd6191c14aa0cf0bc460a0d73bc440bfcd3029513d9b916a816fa847
MD5 06df4dfbc4bd2e7d97af23a13d18b14e
SHA1 7761f0b01a2d0d6740fcb7064f82e613f9d8937b
SHA512 fb595cbef72db8e52466253a25588aca5647186eb6d77c0ea43ddbd1ccd9279c59cd9b74d6791c6a6a13d375577d9bb6789ae689f0f11276d392b23056e39392
SSDEEP 192:TRIQXcD4sv7gxWAPRp21h4lf/2Vee9OHsb+WNv+pu4Prncc2Gy28eMH5VVyIsnAI:TRIQXp48xXXWkwyz292KlE
TLSH
T14952D76AA964697F5CDAC319F961F76BE7F5102560C01E84EAFC893C14EBACC2207843
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 2f51263b74ce15d802050f5eef418214dae84bb1acaf9571e98ae30cd10ecd90
MD5 f990c671fb9f60abe52cf67350a878e8
SHA1 abfd9ef2d1481945e5a1aebc7d4718f5f9d92bb6
SHA512 e0854f1a371d0d7f549eedcfd220e3ff2978c1f00d108a8bec2d9d3354602bf669a4ad6c38801ddb8ab41f86ddf312ad1cf78393eda7c961dafa443a1f772606
SSDEEP 384:QGjDC7KxkXqKf/pUZNCgVLH2HfgslDLXODgj+ErU3QYHGQYG3VGjgV:QmDC7KxkXqKf/pUZNCgVLH2Hfgs1TOEc
TLSH
T10352F927648D953F0FD8CA8CDC17AF8FACB501566668492456FA9C0903A9BCF114A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\2498025f-5ba6-407c-84ad-5cf6ca19b2d3\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 214B
SHA256 840caa1830ffff0e30b338b2bb8697d512e306cfb2abc07b1f1451d19be59d54
MD5 49ac63dc7951cd71290338c923806a23
SHA1 d2a174e031eaad5d8644c9048837339b9d3bb7bf
SHA512 515ce8a1dd8c81b4e91d5f194ef7965a9564dc79105ea90f4bad112d0aae0c4abfde59087c422edb14db4c0b3451259e98ca037a14580f41c3d37e0d5f8e52a3
TLSH
T17BD023D5A031594E0970DBC81034414E55075D86D481CCD5FC94704128FC903C601D39
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 130B
SHA256 13ed5a8638053ea757826fb5e94b17b938a9c20d6a773c17e0cf86bf0a1a9be5
MD5 5dbb8b342b1b2e15342a64335dd3659c
SHA1 a70ef9594cd4e28ff6a7fd94f59e04fb94b4e892
SHA512 18f313c2b35c7c14e3ac981557a587133eb8fd742e27fa3b2730dc27a4073ae7a90815e7ab1ff0e2908220970e3aeca3a04b71fa732c722801a1c791debf2d60
TLSH
T175C09BE61411564E0974DEC82074565F9A0F8689C4D4CCE97014644124BC913CB01565
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe67cbaf.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe67cbaf.TMP
Size 137B
SHA256 1f06348b48261fdd928cf8697bf741ea5805987bc9be7034b759423765a9ec12
MD5 4c30427f684742fbc69ac0121e330bed
SHA1 bcdfa80f3528a089f650c848d7e8c6d8a134c935
SHA512 6051db96bde723ad28b47e7ff804e478428f59e3b96894f76ebf5859a9c8074d7ad80694e9645c72372cc32093791a028ca91b49ec01738e2116f14eae14d0aa
TLSH
T10CC09BD61411574A0B709AC56074564F9E1F8D9988C4CCE97055704130BC913CB05565
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 b25c30cf80f3f404badb4a868209902b272f6eee4aefe50e9f667191f62e402c
MD5 aaa91495b002fb483c9ff896fc6fb89a
SHA1 939f1aba6bf233a24d7ff8642a9a33eb7df7178a
SHA512 66cef199710d74ec105806a651fab9ccef11254af0ca967ba34a153257680b4ff691f46d8883c26883d69c2ce25a4732617aae5298ec5a162ae16ed83a22a13a
TLSH
T167A00221CBC02572DD1142B164A115823257D92595574307989108D5BEAF1D14523694
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe6796f3.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe6796f3.TMP
Size 48B
SHA256 1d3e60bb7ecbdd043b5da482396f2d678c84ff1686683271d6b08772a81fccc2
MD5 785a8b825ec73b6f2005fc407bb946b9
SHA1 f7072587739ee521e06020263adb7613ad79e286
SHA512 bc317ded964fcee0cda5d824d7859cc556f49c348a2a935e642a9d4c4e8006d50a61298f321cbacbd78ebe11e8b05c8cf93d81be556fe553d6b5d1142ed383c1
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

becf9ff8-c6e1-4aac-a37d-b1328011fc71.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\becf9ff8-c6e1-4aac-a37d-b1328011fc71.tmp
Size 14KB
SHA256 bac999ce423052212533585709f607ef4e0288b65dd51e68573a18a8e8a2f26e
MD5 17810a7c0642cd12d3ea0567ea0b9025
SHA1 d46ce316c0a77cba4ede3dadaf829f65587923f4
SHA512 2cbd5656098d16f1e3e0f8ee205d3fc39a42ee3bb6f57a9a86a4f22cbb1858114d78e07fb8f1941a44d4d95ebd1bc0c238f115c9b7a6c1cd136a603b5dc11aab
SSDEEP 192:TRIQXbD4Mv7gxWDPRpr1h4lf/7Vee9OHsb+WNv+pu4PrnqueVy28eMH5jVyIsnAI:TRIQXQY8xiXqkwyXeg2KHE
TLSH
T18B62D96AB964697F5CDAC319F965F76BE7F4102560C01E84EAFC893C14EBACC2207943
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 139KB
SHA256 2e529e50008335d093dd59148ea2db9f29cd6b765e6421983120213501f2acf4
MD5 a954f4beb095be249deb1c338e7e380b
SHA1 14211f1acfda51eb36de32077e22f352740b90ff
SHA512 98a341f54ca53f7535362b500a50924c8a78f61fb0366d206a0303dc45bae324b2adee46ed92b7692e76c4d4f658d00b926e87ad3bd5b64137cb26b84e511928
SSDEEP 1536:66pjVnMsX/ykMCxDp/RSztp/VZIIusdBUpk7/Y6aRZFswCL/Y1z4ovF3dvQogFlL:JRBy6AztpvzHUpwjaRPIGzZvF3d5ZDT4
TLSH
T1CFD3133938961C775099D070E87FB47A992CC24F43B6EF0698526B5AC7ABC8B1346C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 140KB
SHA256 720fc51c17e488b63cdf05889ce5ddf91cb94afa5fe9aa6a204c65f843a517d2
MD5 c5718954f66b4f18124d92746c638fcc
SHA1 a72116d589793719496b4180ac650040af07e074
SHA512 397d4dfd823c4288795cea4b15e3991017135d5a3974bf1f75e787003109057c8858172d12cf4504d60c5b60acecd12f2da32c81798b564ec6ee77d34d864059
SSDEEP 3072:YhRBy6AztpvzHUpwjaRPIGzZvF3d5ZDT4:Yn+Dvz0p3IGzzZDT4
TLSH
T169E3133D3C961C675096D064E42F743A8D7CC34F87AAEF09E8567A49C7AF84A074B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 139KB
SHA256 b791d31b840aa74a1285ec866ca064e259fae31073bc6f50abaa5bc13a74a01d
MD5 85a20aa91e8c207701e65d5c3d9a852c
SHA1 fd40e72e5c6c163d0943f38361df2748d63025cc
SHA512 df07ddcdd260195689ce87c67280a5f138551f3700ea435f738bd7d81e008f3190d5a343fededbea8e1c65b894a1552e77cd9ef86e7984c0dc90a3e4a698b939
SSDEEP 1536:NrpjVnMsX/ykMCxDp/RSztp/VZIIusdBUpk7/Y6aRZFswCL/Y1z4ovF3dvQogFlL:PRBy6AztpvzHUpwjaRPIGzZvF3d5ZDT4
TLSH
T136D3133938961C775099D070E87FB47A893CC24F47B6EF4698526B5AC7ABC8B0346C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 c36859fa1727ae20282c2c124273e13d9d86be825da17b9a5de27c8d7a9cb73a
MD5 33514c5c405627929724fb26b83f8b72
SHA1 cd96a33d1c99b7d387fcb614aba89ba849104423
SHA512 cb492f4ed80c2ba181b1c127a626264fb2fb6c13b0d1e9f3a21f1b3d29c63ec1e30de72b0e4943fd671526a00b760d4469ec082598f8462509fb56c8562f5dee
SSDEEP 96:E3C0d+OBIsu/Fl3fIUKsI8EnZIJRDotok5uiD0B6m8dGyvELkzAyrbuj1v4a:kC0pB+fTbnvDUDV44w/gAyrbu1
TLSH
T1B4A12B70B4B88CBB54B5C584B5863E43CFB462EBA8109E80D9DE1F0D11AB1F82381E67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 139KB
SHA256 3b61c9be5226eea098a6a40fba1c62ed673e9eb37e1bed39856033caf692afb5
MD5 e32658942e51b2f94668c17aa10fc770
SHA1 8f82e5291654fe7fda24203a39393536098c208e
SHA512 a1d730edcbbdf6414da3269a18d4775307fa5ee5c1a8caa547abf9c03dc185d39f66c530e1de24f1ec270d275ed0eebe5e5b6b8f44169ede636d1c352f209429
SSDEEP 1536:6QpjVnMsX/ykMCxDp/RSztp/VZIIusdBUpk7/Y6aRZFswCL/Y1z4ovF3dvQogFlL:jRBy6AztpvzHUpwjaRPIGzZvF3d5ZDT4
TLSH
T178D3133938961C775099D070E87FB47A992CC24F43B6EF0698526B5AC7ABC8B1346C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 140KB
SHA256 7d783313a7c60f623ad5cd0c5cc2d059419fc1ce43193c0d341284e98969deb2
MD5 a7f44e713945e5ed5b65dd3afe00b751
SHA1 28b903aee193337890e6980515d5f3a9f02517cc
SHA512 6e8fae17e2275088f88b4f353e442409db50aaeb20aaf8b8b6502d631cd17adfe5c744d4cdae75527645cb0eec13bed6458036071db8d17d0d2ff5d9256d2245
SSDEEP 3072:whRBy6AztpvzHUpwjaRPIGzZvF3d5ZDT4:wn+Dvz0p3IGzzZDT4
TLSH
T18FE3133D3C961C675095D064E42F743A8D7CC34F86AAEF09E8567A49C7AF84A074B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5428_928592782\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

5d696d521de238c3.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms
Size 10KB
SHA256 196ee2326452d059b820f5645c321e5732ea58fe8e89429080a4f732b86384e1
MD5 bfcb2d40300bce9c969c30a24ac54bee
SHA1 9eaf3845b48f3556b276cf992e8afeb37308deab
SHA512 c9d35dada7c7f78f6e4502085be938e5216e846c12164f541afa67374c5ab00154c40a19025c8b781940abb1fe72476d4ed4a258a7fb6b6cb7cf8fd9e3f1306c
SSDEEP 96:/svHiFFDU5gEsvPIGsv2E/vm+lWkd+du1Hpv04lsvQCsvgaw:/8HqDUz8PN82NQld+du1Jc4878o
TLSH
T1A322A9193BF6161AF1F38A769EF13B519F7BB9229618894E61C043150C62F109ED4B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5d696d521de238c3.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms
Size 11KB
SHA256 6a41a0d8758cb09f0492254de64a9d55aca2ffb579e8bb34c10cd2d84d850dfd
MD5 fb26d25dae5ead4dc4c9c9fcb1b4539e
SHA1 7d0017352023a7828241c8d63e9db9d99f5721ba
SHA512 6f6292ab55046002a646798289678d1289218689a80e29e2c6be308294a8bfd771685123893cd0a62a844f2b936ab4429b7af05746d222bb383bc897c67fda42
SSDEEP 192:2a8HqDUQa8Pha87a82NQld+du1Jcja8Hl8o:n8KDI84828C4cuH8F8o
TLSH
T16D32CB193BF6161AF1F38A769EF13B529F7BF8229618894E61C043150C62F109ED4B7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5d696d521de238c3.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms
Size 14KB
SHA256 624bedf745596d50a00efacb68eec379bedf7686ae3bc3dbc081aa85213e9200
MD5 332aecc2d3ec0ebebbca96ec791c84d8
SHA1 cdcb6712dab64ee12c2113af7bc6bbbba5604b55
SHA512 5dbdaf98b5e5a1512cb7e507c99d6ccab7f467bbf02b6359d9618cec857c127404b1e43658e1da5020317376cd31d79d205a55938e1c3de515e6932954ae7234
SSDEEP 192:p8HqDUz8Pn8pkpqqjYiiU8M82NQld+du1JcE8P8o:p8KD68f8GA+Y5U8M8C4cuJ8P8o
TLSH
T17462EB183BF7061AF1B3DA769EE53B629F6BF9228518595F20C043160D22E10ADD5B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5d696d521de238c3.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms
Size 14KB
SHA256 f3d7b9a8a91c52fcf487699caff64381ad1db04aa1a098c1bce62d6265260f36
MD5 86e523eae971aacbbe1a924c3e9a7186
SHA1 8bb5e933fa0496c229014412a7f0cc8bb64d5c0b
SHA512 df3d70688e284ad588d5c800d0367e508efe11dc7a1904068b82aff754c939986955d59ffd471c678036736bd124240341617d3749163351e072d7f3d29b83ba
SSDEEP 192:18HqDUv8Pr8t5nVOIGJISB+vVWoXvs8pkpqqjYiiA8f8L8o:18KDW8z8t5jrq8GA+Y5A8f8L8o
TLSH
T13962BE082BF7051AF1B3DA729FE57B62DF7AF8229518596F20C043160A62E105ED6B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1176-8-0x00007FF966E20000-0x00007FF967083000-memory.dmp

Download

memory/1176-10-0x00007FF966E20000-0x00007FF967083000-memory.dmp

Download

memory/1176-7-0x00007FF926F60000-0x00007FF926F70000-memory.dmp

Download

memory/1176-4-0x00007FF926F60000-0x00007FF926F70000-memory.dmp

Download

memory/1176-14-0x00007FF966E20000-0x00007FF967083000-memory.dmp

Download

memory/1176-12-0x00007FF966E20000-0x00007FF967083000-memory.dmp

Download

memory/1176-16-0x00007FF924A20000-0x00007FF924A30000-memory.dmp

Download

memory/1176-13-0x00007FF966E20000-0x00007FF967083000-memory.dmp

Download

memory/1176-11-0x00007FF966E20000-0x00007FF967083000-memory.dmp

Download

memory/1176-0-0x00007FF926F60000-0x00007FF926F70000-memory.dmp

Download

memory/1176-9-0x00007FF966E20000-0x00007FF967083000-memory.dmp

Download

memory/1176-25-0x00007FF966E20000-0x00007FF967083000-memory.dmp

Download

memory/1176-5-0x00007FF966E20000-0x00007FF967083000-memory.dmp

Download

memory/1176-15-0x00007FF924A20000-0x00007FF924A30000-memory.dmp

Download

memory/1176-6-0x00007FF966E20000-0x00007FF967083000-memory.dmp

Download

memory/1176-2-0x00007FF926F60000-0x00007FF926F70000-memory.dmp

Download

memory/1176-1-0x00007FF926F60000-0x00007FF926F70000-memory.dmp

Download

memory/1176-3-0x00007FF966F7F000-0x00007FF966F80000-memory.dmp

Download