417bcc3348cd5162c2751812fc0ea2f6e79e89e7be6f17e8401ed95de2ed4246

Analysis

user interaction
yes
max time kernel
901s
max time network
778s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-es
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-eslocale:es-esos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 17:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
llamafile-0.10.5.exe
Size 334.5MB
Sample260808-wasyaawsc1
SHA256 417bcc3348cd5162c2751812fc0ea2f6e79e89e7be6f17e8401ed95de2ed4246
MD5 7890a8fd49ee16d8cf2a35105b6380ae
SHA1 3260b2d1e68e9ff389c9e656d9c79dfbbc141bbb
SHA512 5bd0ec1c2a3d6c1739eb4c11fc83f4f766c3be1298ad7323fa2e5412907d3cca0df03f177a6af5514768df63327d16df9bb38a64ed2ac80ab35dd6cc893d7302
SSDEEP 3145728:O0mdOp445Cu2tl+G0qVfus3kq5YSwE0tNtBmLi3/VIGICl:AudYlFVfuEj5wTzmLiveGIU
TLSH
T105F89E25F9F28F23F82A823C86F76271B928F8FC9752D7571348F63536727205A56218
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
157	3516	chrome.exe

Executes dropped EXE 3 IoCs

pid	Process
2848	llamafile-0.10.5.exe
940	llamafile-0.10.5.exe
348	llamafile-0.10.5.exe

Loads dropped DLL 4 IoCs

pid	Process
2848	llamafile-0.10.5.exe
940	llamafile-0.10.5.exe
2848	llamafile-0.10.5.exe
348	llamafile-0.10.5.exe

Contacts third-party web service commonly abused for C2 1 TTPs 8 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
52	camo.githubusercontent.com
141	camo.githubusercontent.com
142	camo.githubusercontent.com
143	camo.githubusercontent.com
144	camo.githubusercontent.com
145	camo.githubusercontent.com
146	camo.githubusercontent.com
1	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5112	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3516	chrome.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306848569224575"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 43 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4046655672-1449839301-2197395821-1000\{1B0E1B65-1B8A-46FB-8BDC-4C5D9A231C85}	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	NOTEPAD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	NOTEPAD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	NOTEPAD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	NOTEPAD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	NOTEPAD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\	NOTEPAD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	NOTEPAD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	NOTEPAD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 03000000020000000100000000000000ffffffff	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	NOTEPAD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Downloads"	NOTEPAD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	NOTEPAD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	NOTEPAD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	NOTEPAD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Version = "1"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	NOTEPAD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\	NOTEPAD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	NOTEPAD.EXE

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1900	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
4684	chrome.exe
4684	chrome.exe
2848	llamafile-0.10.5.exe
2848	llamafile-0.10.5.exe
2848	llamafile-0.10.5.exe
2848	llamafile-0.10.5.exe
2848	llamafile-0.10.5.exe
2848	llamafile-0.10.5.exe
2848	llamafile-0.10.5.exe
2848	llamafile-0.10.5.exe
2848	llamafile-0.10.5.exe
2848	llamafile-0.10.5.exe
2848	llamafile-0.10.5.exe
2848	llamafile-0.10.5.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 45 IoCs

pid	Process
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3928	chrome.exe
Token: SeCreatePagefilePrivilege	3928	chrome.exe
Token: SeShutdownPrivilege	3928	chrome.exe
Token: SeCreatePagefilePrivilege	3928	chrome.exe
Token: SeShutdownPrivilege	3928	chrome.exe
Token: SeCreatePagefilePrivilege	3928	chrome.exe
Token: SeShutdownPrivilege	3928	chrome.exe
Token: SeCreatePagefilePrivilege	3928	chrome.exe
Token: SeShutdownPrivilege	3928	chrome.exe
Token: SeCreatePagefilePrivilege	3928	chrome.exe
Token: SeShutdownPrivilege	3928	chrome.exe
Token: SeCreatePagefilePrivilege	3928	chrome.exe
Token: SeShutdownPrivilege	3928	chrome.exe
Token: SeCreatePagefilePrivilege	3928	chrome.exe
Token: SeShutdownPrivilege	3928	chrome.exe
Token: SeCreatePagefilePrivilege	3928	chrome.exe
Token: SeShutdownPrivilege	3928	chrome.exe
Token: SeCreatePagefilePrivilege	3928	chrome.exe
Token: SeShutdownPrivilege	3928	chrome.exe
Token: SeCreatePagefilePrivilege	3928	chrome.exe
Token: SeShutdownPrivilege	3928	chrome.exe
Token: SeCreatePagefilePrivilege	3928	chrome.exe
Token: SeShutdownPrivilege	3928	chrome.exe
Token: SeCreatePagefilePrivilege	3928	chrome.exe
Token: SeShutdownPrivilege	3928	chrome.exe
Token: SeCreatePagefilePrivilege	3928	chrome.exe
Token: SeShutdownPrivilege	3928	chrome.exe
Token: SeCreatePagefilePrivilege	3928	chrome.exe
Token: SeShutdownPrivilege	3928	chrome.exe
Token: SeCreatePagefilePrivilege	3928	chrome.exe
Token: SeShutdownPrivilege	3928	chrome.exe
Token: SeCreatePagefilePrivilege	3928	chrome.exe
Token: SeShutdownPrivilege	3928	chrome.exe
Token: SeCreatePagefilePrivilege	3928	chrome.exe
Token: SeShutdownPrivilege	3928	chrome.exe
Token: SeCreatePagefilePrivilege	3928	chrome.exe
Token: SeShutdownPrivilege	3928	chrome.exe
Token: SeCreatePagefilePrivilege	3928	chrome.exe
Token: SeShutdownPrivilege	3928	chrome.exe
Token: SeCreatePagefilePrivilege	3928	chrome.exe
Token: SeShutdownPrivilege	3928	chrome.exe
Token: SeCreatePagefilePrivilege	3928	chrome.exe
Token: SeShutdownPrivilege	3928	chrome.exe
Token: SeCreatePagefilePrivilege	3928	chrome.exe
Token: SeShutdownPrivilege	3928	chrome.exe
Token: SeCreatePagefilePrivilege	3928	chrome.exe
Token: SeShutdownPrivilege	3928	chrome.exe
Token: SeCreatePagefilePrivilege	3928	chrome.exe
Token: SeShutdownPrivilege	3928	chrome.exe
Token: SeCreatePagefilePrivilege	3928	chrome.exe
Token: SeShutdownPrivilege	3928	chrome.exe
Token: SeCreatePagefilePrivilege	3928	chrome.exe
Token: SeShutdownPrivilege	3928	chrome.exe
Token: SeCreatePagefilePrivilege	3928	chrome.exe
Token: SeShutdownPrivilege	3928	chrome.exe
Token: SeCreatePagefilePrivilege	3928	chrome.exe
Token: SeShutdownPrivilege	3928	chrome.exe
Token: SeCreatePagefilePrivilege	3928	chrome.exe
Token: SeShutdownPrivilege	3928	chrome.exe
Token: SeCreatePagefilePrivilege	3928	chrome.exe
Token: SeShutdownPrivilege	3928	chrome.exe
Token: SeCreatePagefilePrivilege	3928	chrome.exe
Token: SeShutdownPrivilege	3928	chrome.exe
Token: SeCreatePagefilePrivilege	3928	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
3928	chrome.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe
5612	taskmgr.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1900	NOTEPAD.EXE
1900	NOTEPAD.EXE
1900	NOTEPAD.EXE
1900	NOTEPAD.EXE
1900	NOTEPAD.EXE
1900	NOTEPAD.EXE
1900	NOTEPAD.EXE
5612	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3928 wrote to memory of 5260	3928	chrome.exe	94
PID 3928 wrote to memory of 3516	3928	chrome.exe	95
PID 3928 wrote to memory of 1536	3928	chrome.exe	96
PID 3928 wrote to memory of 1536	3928	chrome.exe	96
PID 3928 wrote to memory of 1476	3928	chrome.exe	98
PID 3928 wrote to memory of 1476	3928	chrome.exe	98
PID 3928 wrote to memory of 4896	3928	chrome.exe	99
PID 3928 wrote to memory of 4896	3928	chrome.exe	99
PID 3928 wrote to memory of 4200	3928	chrome.exe	100
PID 3928 wrote to memory of 4200	3928	chrome.exe	100
PID 3928 wrote to memory of 5980	3928	chrome.exe	101
PID 3928 wrote to memory of 5980	3928	chrome.exe	101
PID 3928 wrote to memory of 1080	3928	chrome.exe	102
PID 3928 wrote to memory of 1080	3928	chrome.exe	102
PID 3928 wrote to memory of 3780	3928	chrome.exe	103
PID 3928 wrote to memory of 5604	3928	chrome.exe	104
PID 3928 wrote to memory of 5604	3928	chrome.exe	104
PID 3928 wrote to memory of 6072	3928	chrome.exe	105
PID 3928 wrote to memory of 6072	3928	chrome.exe	105
PID 3928 wrote to memory of 5512	3928	chrome.exe	109
PID 3928 wrote to memory of 5512	3928	chrome.exe	109
PID 3928 wrote to memory of 5372	3928	chrome.exe	110
PID 3928 wrote to memory of 5372	3928	chrome.exe	110
PID 3928 wrote to memory of 4364	3928	chrome.exe	111
PID 3928 wrote to memory of 4364	3928	chrome.exe	111
PID 3928 wrote to memory of 4964	3928	chrome.exe	112
PID 3928 wrote to memory of 5024	3928	chrome.exe	113
PID 3928 wrote to memory of 4964	3928	chrome.exe	112
PID 3928 wrote to memory of 5024	3928	chrome.exe	113
PID 3928 wrote to memory of 1700	3928	chrome.exe	114
PID 3928 wrote to memory of 1700	3928	chrome.exe	114
PID 3928 wrote to memory of 244	3928	chrome.exe	116
PID 3928 wrote to memory of 5000	3928	chrome.exe	117
PID 3928 wrote to memory of 244	3928	chrome.exe	116
PID 3928 wrote to memory of 5000	3928	chrome.exe	117
PID 3928 wrote to memory of 3932	3928	chrome.exe	115
PID 3928 wrote to memory of 3932	3928	chrome.exe	115
PID 3928 wrote to memory of 1056	3928	chrome.exe	118
PID 3928 wrote to memory of 3772	3928	chrome.exe	119
PID 3928 wrote to memory of 1056	3928	chrome.exe	118
PID 3928 wrote to memory of 3772	3928	chrome.exe	119
PID 3928 wrote to memory of 208	3928	chrome.exe	120
PID 3928 wrote to memory of 208	3928	chrome.exe	120
PID 3928 wrote to memory of 1704	3928	chrome.exe	121
PID 3928 wrote to memory of 1704	3928	chrome.exe	121
PID 3928 wrote to memory of 4776	3928	chrome.exe	122
PID 3928 wrote to memory of 4776	3928	chrome.exe	122
PID 3928 wrote to memory of 5980	3928	chrome.exe	123
PID 3928 wrote to memory of 5980	3928	chrome.exe	123
PID 3928 wrote to memory of 4152	3928	chrome.exe	124
PID 3928 wrote to memory of 4152	3928	chrome.exe	124
PID 3928 wrote to memory of 5360	3928	chrome.exe	125
PID 3928 wrote to memory of 5360	3928	chrome.exe	125
PID 3928 wrote to memory of 5908	3928	chrome.exe	127
PID 3928 wrote to memory of 2716	3928	chrome.exe	126
PID 3928 wrote to memory of 5908	3928	chrome.exe	127
PID 3928 wrote to memory of 4880	3928	chrome.exe	128
PID 3928 wrote to memory of 1300	3928	chrome.exe	129
PID 3928 wrote to memory of 3396	3928	chrome.exe	130
PID 3928 wrote to memory of 3608	3928	chrome.exe	131
PID 3928 wrote to memory of 3608	3928	chrome.exe	131
PID 3928 wrote to memory of 1544	3928	chrome.exe	132
PID 3928 wrote to memory of 1544	3928	chrome.exe	132
PID 3928 wrote to memory of 1304	3928	chrome.exe	133

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\llamafile-0.10.5.exe
"C:\Users\Admin\AppData\Local\Temp\llamafile-0.10.5.exe"
1⤵
PID:6120

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:944

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffc0df9c728,0x7ffc0df9c734,0x7ffc0df9c740
  2⤵
  PID:5260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1924,i,17521716501570897416,6202136305063430660,524288 --field-trial-handle=1848,i,4521750930464933648,8020312225682238741,262144 --variations-seed-version --mojo-platform-channel-handle=2104 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1660,i,15552516663017590858,15674811451924853344,262144 --field-trial-handle=1848,i,4521750930464933648,8020312225682238741,262144 --variations-seed-version --mojo-platform-channel-handle=1828 /prefetch:2
  2⤵
  PID:1536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2316,i,9451006075729298584,3372810336535136338,524288 --field-trial-handle=1848,i,4521750930464933648,8020312225682238741,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:13
  2⤵
  PID:1476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3276,i,6562498998543942864,173715366144591632,2097152 --field-trial-handle=1848,i,4521750930464933648,8020312225682238741,262144 --variations-seed-version --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:4896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3252,i,1907948044274096892,10603067470560821601,2097152 --field-trial-handle=1848,i,4521750930464933648,8020312225682238741,262144 --variations-seed-version --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:4200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4696,i,5272876507633588126,2689756261982234742,2097152 --field-trial-handle=1848,i,4521750930464933648,8020312225682238741,262144 --variations-seed-version --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:5980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4880,i,13600862163784724423,7148229830984897136,524288 --field-trial-handle=1848,i,4521750930464933648,8020312225682238741,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:14
  2⤵
  PID:1080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5360,i,6456866410897605742,17284751586149433592,524288 --field-trial-handle=1848,i,4521750930464933648,8020312225682238741,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
  2⤵
  PID:3780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5452,i,2092134530706648163,13496877158422656895,2097152 --field-trial-handle=1848,i,4521750930464933648,8020312225682238741,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:5604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5492,i,17247324790405236731,11018046752717952056,2097152 --field-trial-handle=1848,i,4521750930464933648,8020312225682238741,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:6072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5516,i,17351769167312778267,1659844651097733605,2097152 --field-trial-handle=1848,i,4521750930464933648,8020312225682238741,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:1
  2⤵
  PID:5512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5648,i,5305175009323747734,6916802340137694010,2097152 --field-trial-handle=1848,i,4521750930464933648,8020312225682238741,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:5372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5444,i,11206355740437999394,5505840113332135588,524288 --field-trial-handle=1848,i,4521750930464933648,8020312225682238741,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:14
  2⤵
  PID:4364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5360,i,2958993239372199680,14539875611260959100,524288 --field-trial-handle=1848,i,4521750930464933648,8020312225682238741,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
  2⤵
  PID:4964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6088,i,10370857798153971406,7806300233858689298,2097152 --field-trial-handle=1848,i,4521750930464933648,8020312225682238741,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:5024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5540,i,833771417027993203,11296865650541306248,2097152 --field-trial-handle=1848,i,4521750930464933648,8020312225682238741,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:1700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6208,i,4040603977798425175,295810149432641864,2097152 --field-trial-handle=1848,i,4521750930464933648,8020312225682238741,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:3932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6256,i,18175882708083177993,10051981617609696153,524288 --field-trial-handle=1848,i,4521750930464933648,8020312225682238741,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:14
  2⤵
  PID:244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5436,i,12101245767179474860,9557318760831694316,2097152 --field-trial-handle=1848,i,4521750930464933648,8020312225682238741,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=4840,i,14859129231809478484,13698599203686799385,2097152 --field-trial-handle=1848,i,4521750930464933648,8020312225682238741,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:1
  2⤵
  PID:1056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=4696,i,17686453395153860222,4206589769311384831,2097152 --field-trial-handle=1848,i,4521750930464933648,8020312225682238741,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:9
  2⤵
  PID:3772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5636,i,6627796426262413316,18164138476225894725,2097152 --field-trial-handle=1848,i,4521750930464933648,8020312225682238741,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:1
  2⤵
  PID:208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6528,i,11748534164251555002,10962493498165647503,2097152 --field-trial-handle=1848,i,4521750930464933648,8020312225682238741,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:1
  2⤵
  PID:1704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6536,i,7836453553665838745,18343962727647282177,2097152 --field-trial-handle=1848,i,4521750930464933648,8020312225682238741,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:1
  2⤵
  PID:4776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6276,i,7238280626689021972,10942563048119215549,2097152 --field-trial-handle=1848,i,4521750930464933648,8020312225682238741,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:1
  2⤵
  PID:5980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6116,i,615303012277219052,4255596636625757441,2097152 --field-trial-handle=1848,i,4521750930464933648,8020312225682238741,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:1
  2⤵
  PID:4152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=5644,i,6319100085698005195,14494948023025392592,2097152 --field-trial-handle=1848,i,4521750930464933648,8020312225682238741,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:5360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4796,i,7489397610981787403,6855339594753659423,524288 --field-trial-handle=1848,i,4521750930464933648,8020312225682238741,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:14
  2⤵
  - Modifies registry class
  PID:2716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=es --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6192,i,9622158433084110576,15055320300799640067,524288 --field-trial-handle=1848,i,4521750930464933648,8020312225682238741,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:12
  2⤵
  PID:5908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6276,i,4435353007987886472,14314083050826280196,524288 --field-trial-handle=1848,i,4521750930464933648,8020312225682238741,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:14
  2⤵
  PID:4880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5992,i,17037076070866269891,16870013724880335120,524288 --field-trial-handle=1848,i,4521750930464933648,8020312225682238741,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:14
  2⤵
  PID:1300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6332,i,9037227327766124336,5893115672830432181,524288 --field-trial-handle=1848,i,4521750930464933648,8020312225682238741,262144 --variations-seed-version --mojo-platform-channel-handle=3896 /prefetch:14
  2⤵
  PID:3396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=6384,i,12721132252631030205,1548774784305754165,2097152 --field-trial-handle=1848,i,4521750930464933648,8020312225682238741,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:1
  2⤵
  PID:3608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=6124,i,7863298094649554526,6528631466123047971,2097152 --field-trial-handle=1848,i,4521750930464933648,8020312225682238741,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:1
  2⤵
  PID:1544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=4716,i,12086787179945571799,5844577596228208828,2097152 --field-trial-handle=1848,i,4521750930464933648,8020312225682238741,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:1
  2⤵
  PID:1304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=4728,i,8470951235258155715,13955831562790298082,2097152 --field-trial-handle=1848,i,4521750930464933648,8020312225682238741,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:1
  2⤵
  PID:1368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=6228,i,8499694136044751473,1966101265234979569,2097152 --field-trial-handle=1848,i,4521750930464933648,8020312225682238741,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:2212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=5368,i,13675612046735476913,16686838557011699690,2097152 --field-trial-handle=1848,i,4521750930464933648,8020312225682238741,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:1
  2⤵
  PID:2556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --metrics-shmem-handle=5736,i,6597457952236240205,184113207655588892,2097152 --field-trial-handle=1848,i,4521750930464933648,8020312225682238741,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:1
  2⤵
  PID:5168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=4732,i,14655629536382403925,15935073444517699892,2097152 --field-trial-handle=1848,i,4521750930464933648,8020312225682238741,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:1
  2⤵
  PID:936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=6792,i,5518075056929575929,9563259295297792976,2097152 --field-trial-handle=1848,i,4521750930464933648,8020312225682238741,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:1
  2⤵
  PID:4424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --metrics-shmem-handle=5548,i,5867157486434465991,14577153887694966412,2097152 --field-trial-handle=1848,i,4521750930464933648,8020312225682238741,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:3620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5748,i,5999227747361663406,12379604297944528131,524288 --field-trial-handle=1848,i,4521750930464933648,8020312225682238741,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:14
  2⤵
  PID:5576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6252,i,8816368447749064494,15583907750223916244,262144 --field-trial-handle=1848,i,4521750930464933648,8020312225682238741,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --metrics-shmem-handle=5692,i,9055502217393938788,7939210092082691294,2097152 --field-trial-handle=1848,i,4521750930464933648,8020312225682238741,262144 --variations-seed-version --mojo-platform-channel-handle=596 /prefetch:1
  2⤵
  PID:2212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --metrics-shmem-handle=5592,i,403901439352152040,3635407617056602913,2097152 --field-trial-handle=1848,i,4521750930464933648,8020312225682238741,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:1
  2⤵
  PID:4004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --metrics-shmem-handle=6784,i,7357818153828996685,14508907920715155856,2097152 --field-trial-handle=1848,i,4521750930464933648,8020312225682238741,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:1
  2⤵
  PID:3124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --metrics-shmem-handle=3488,i,10349757490348159771,1655752257009899117,2097152 --field-trial-handle=1848,i,4521750930464933648,8020312225682238741,262144 --variations-seed-version --mojo-platform-channel-handle=6996 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --metrics-shmem-handle=7124,i,14862073137248759155,9198572307453723587,2097152 --field-trial-handle=1848,i,4521750930464933648,8020312225682238741,262144 --variations-seed-version --mojo-platform-channel-handle=7144 /prefetch:1
  2⤵
  PID:1212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --metrics-shmem-handle=7088,i,17511435865732452114,6510507034104044786,2097152 --field-trial-handle=1848,i,4521750930464933648,8020312225682238741,262144 --variations-seed-version --mojo-platform-channel-handle=7248 /prefetch:1
  2⤵
  PID:4684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --metrics-shmem-handle=7380,i,16931579286403551760,1254120108566300223,2097152 --field-trial-handle=1848,i,4521750930464933648,8020312225682238741,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
  2⤵
  PID:3588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --metrics-shmem-handle=8024,i,18040608864224990036,2112153106996426830,2097152 --field-trial-handle=1848,i,4521750930464933648,8020312225682238741,262144 --variations-seed-version --mojo-platform-channel-handle=8020 /prefetch:1
  2⤵
  PID:3240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --metrics-shmem-handle=7364,i,16454780156730107292,7731349555887008546,2097152 --field-trial-handle=1848,i,4521750930464933648,8020312225682238741,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:1
  2⤵
  PID:6092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=es --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6024,i,5982259341838395634,8733192639650267883,524288 --field-trial-handle=1848,i,4521750930464933648,8020312225682238741,262144 --variations-seed-version --mojo-platform-channel-handle=7888 /prefetch:14
  2⤵
  PID:2212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --metrics-shmem-handle=7844,i,3459230724552971678,7601257650714721631,2097152 --field-trial-handle=1848,i,4521750930464933648,8020312225682238741,262144 --variations-seed-version --mojo-platform-channel-handle=7416 /prefetch:1
  2⤵
  PID:768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --metrics-shmem-handle=5716,i,11307865527985722189,3343035522197031730,2097152 --field-trial-handle=1848,i,4521750930464933648,8020312225682238741,262144 --variations-seed-version --mojo-platform-channel-handle=8176 /prefetch:1
  2⤵
  PID:4228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --metrics-shmem-handle=8112,i,2632644040665915734,8297551299502614472,2097152 --field-trial-handle=1848,i,4521750930464933648,8020312225682238741,262144 --variations-seed-version --mojo-platform-channel-handle=7804 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --metrics-shmem-handle=5992,i,10095107324550121128,8006445842700450056,2097152 --field-trial-handle=1848,i,4521750930464933648,8020312225682238741,262144 --variations-seed-version --mojo-platform-channel-handle=4584 /prefetch:1
  2⤵
  PID:4236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --metrics-shmem-handle=7960,i,2314060169896859055,12928145435010002782,2097152 --field-trial-handle=1848,i,4521750930464933648,8020312225682238741,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:1
  2⤵
  PID:4552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --metrics-shmem-handle=4560,i,5564559425122768202,11539346369018364020,2097152 --field-trial-handle=1848,i,4521750930464933648,8020312225682238741,262144 --variations-seed-version --mojo-platform-channel-handle=7016 /prefetch:1
  2⤵
  PID:4676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --metrics-shmem-handle=2464,i,16991844830657845427,3571814802255558572,2097152 --field-trial-handle=1848,i,4521750930464933648,8020312225682238741,262144 --variations-seed-version --mojo-platform-channel-handle=7740 /prefetch:1
  2⤵
  PID:4040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=8172,i,1952004677651925627,10549499287159101816,524288 --field-trial-handle=1848,i,4521750930464933648,8020312225682238741,262144 --variations-seed-version --mojo-platform-channel-handle=7876 /prefetch:14
  2⤵
  PID:4336

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5912

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4312

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4912

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\iniciar.txt
1⤵
- Modifies registry class
- Opens file in notepad (likely ransom note)
- Suspicious use of SetWindowsHookEx
PID:1900

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:3012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\iniciar.bat" "
1⤵
- Executes a command shell one-liner
PID:5112
- C:\Users\Admin\Downloads\llamafile-0.10.5.exe
  .\llamafile-0.10.5.exe --server --model qwen3-4b-thinking-2507.Q4_K_M.gguf
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:2848
- - C:\Users\Admin\Downloads\llamafile-0.10.5.exe
    C:\Users\Admin\Downloads\llamafile-0.10.5.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:940
- - C:\Users\Admin\Downloads\llamafile-0.10.5.exe
    C:\Users\Admin\Downloads\llamafile-0.10.5.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:348

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 df66a77723e1832b82e2f011e85e5cfe72c58df335248b8b7d51f0ef4751a83d
MD5 c48f09305f576ea604255a31e4a97dd5
SHA1 e9715806f534d82642a5be62a303ef681aa0ca8b
SHA512 5a9b56bdd0b88bb6512e03e68b8b044129f587516dc1f96223b758cb45847458ba2b5826694fa03a8b5c21b816826d10c566a2145282546f4bbc136b46752745
TLSH
T145E068F5CE28EC2B49FD576E20800B85E75103572B52884F3A3EE10CCFB063B459A85C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000004
Size 71KB
SHA256 c5cfcfe10aa1686b7c43575ee31c8972ae2d0d05cb8d71f87892455e4a1eec9b
MD5 075110f361981db0c8637c9889ee8a18
SHA1 05e2bd96edb12c09b9bfae0a8ff1e19abd10bb27
SHA512 3af2fdc73bcf4078b3e0e945bd74c3ede09008a34033698ce297de51309351d34bbbe9740ef76eb6dfdf585496d6c51faa990d51a5fa9f2f60ef60a276eff8bf
SSDEEP 1536:4W7X6PCIvB5uKamkCf8G1WzU2eZcypBE4QfT5BRsxeGvjqtS:4W7qac+jGR5ZFfQjRFAjL
TLSH
T16363023B02F8D791488425E352ED13A657F783ABE4FF744DE26801D211683FC6672DA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006
Size 38KB
SHA256 7165713d3e1a610399471a5e93d5677508f62ef072c1151e72273bf4bd54f916
MD5 9436affc97843765a966b3568fa7e5ec
SHA1 7bfda74bb30589c75d718fbc997f18c6d5cc4a0b
SHA512 473ec3a843c33e18d6d194651fe11353fcd03a7959225faeabf8c77484155ea6a7bccb72dbaf2093ed53c408faa3be9f6fc907f7a5ddf8223375f9d09b504456
SSDEEP 768:eUEh2+iKBVQbBhu8vjenqz2Ez6Y/AxHLEaP72sV9qKYbDblXqhP8qwFSE3uk:eUEEoBVQDjeQaLnP2pfZTqgSEB
TLSH
T11703F112148F7FA1C244F224A4EFE416ACC3F565ABA15E6980B8B7C7010E3C657A46FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
Size 135KB
SHA256 685f6edbab08733d0db58fed875fe670bd6ed464ca58bc9c9fdc745361ed3bb3
MD5 7246946b1e5c348b027d9658cc7a2d56
SHA1 6c9b0910b5b8065a074f75eff867250634d38315
SHA512 a957d9c517df95b6aeab2ed4d80ecdd93ac50948bbe0a4c96926e0c653d87ae78b45996a7b72f350e888d842125a48811743e70b285ae9968e0444bb2bf759d6
SSDEEP 3072:0wn1iZ1xz8rZsMDErWWfwQjNTeFB/8PmjrNOFH51MWx+jQyA3uh:71iZX8ulWWIMTW18PmVO9GMeh
TLSH
T100D313BA488255402CD41D8B47881EBEF86A502DF0BB49F7606CDFDA0EC757DC50E9B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000008

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000008
Size 511KB
SHA256 740d8cb674580a9d5621a0e8c046d2a6aa63baa0c5ffeede43480360a0f1e3f3
MD5 d70140bf78b5d05fb005267fd3b93f87
SHA1 8b840be7b8a999a11f7401dd6ad767522cafd3c6
SHA512 5ed33514f03db761c973477e72025633a2ef0ebbab2d13a4e5a358b4eadc334c86a8cb485496bf696023f5da621f716d6b0273b65f5e5c8108295622c34c5eea
SSDEEP 12288:gehy9BxZ4rZjXvRMfnH9yPDfExGFVJ8ykWTluoJLGzb/WMDAx3KRHke:gehKBX4rkdIDMxS8ykYLGzLpDSe
TLSH
T134B4238513F0E07ADF6E3E4DE88A7F42F35FC5E26C67291BC5112833E98D8A0554863A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000009

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000009
Size 85KB
SHA256 1871a974a521e4855d5222ed08616658bc9d91cbe639a7a10a5c5178eaa442eb
MD5 f6925a19d4a88b0f8a7175959bc9f8ec
SHA1 32bee3e7ccd95dca7fc51ebf4ef303fc564efb30
SHA512 71c24aaf8545095880883bb9b706f9a7af88be26f202bd29b45505ba7335b742bba04a81b5bdcf51110330837e52ab2321274c3f013932917fce31517869f037
SSDEEP 1536:Ue+cmalJP+GyhHtSqGrV85qFEWSMGWmzLaxjNjbh70WgfCwrIv7FC:UlalJ2GywHOqGW7K2xpjeWACwrSFC
TLSH
T13F83121209CB660ABF974DD63A47B71BAB8ECC021192088CF41F514EF97A81B52B5F86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000b
Size 436KB
SHA256 0b320d2cf00e9215763a5377904e2301b2edb7a5d299bd319259714cf8bcd9a9
MD5 38e965609b7e0769e6754549cfa3c2fd
SHA1 8ef9e62fa3ae6d8b371f5a9e9344a6cdf31515fe
SHA512 18cff962b979abf3e3d06261422f35502463a0e196aa0cf801cadcff8833a83f20c9e9f22fb3133041e406fdf2304088a0a5eaa4bbb8aff07ab15a0c1b46b0e4
SSDEEP 6144:HT+7EhQjYpz+XUGr9+7Km54TxcjJJEWv6p0qOJ7kuKtAiDL6GnkES7+S8HBWzDi2:6vj0iUI9EKFEJdU0p7riDxw7L8oviJ3c
TLSH
T147942367DF08D99BDA158361EA30EBDD1158EB6EE00A3CC844BB462CE54C0F9F6913C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000010

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000010
Size 88KB
SHA256 03e73c9c0662391af8ef9826fcac4f2cc03298caaffd719a760ecab48c2cbb04
MD5 0c7f4420f9e1bffb3c10e6b13d1dc9ae
SHA1 6a096e650987fa808a678758d1b6526f84af7500
SHA512 85cd77e7a4f20328f68854ec3a8b4e9770f004dc0ca406ac81fbd7c37aa44284166ff5b1f48813f9a9e273ad29e05e2f7e111bbcf7eebb633da3353125a0e827
SSDEEP 1536:76SL5HnrvNuXk1bwLSprhZzcnXWxyKNiAa6KKpVzTd4ncBjEOrzDd5C3:7rFnr8XkqLSpsnXWxyP7KpD4c9EmDc
TLSH
T1B79312357233C988650BE7828B3464356CDFE66D5A3EC66CA8CE89E7441743F8D8DD88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000011

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000011
Size 17KB
SHA256 e287a5fe4eb3f81f22caf9ccfaa0c31d0a71957934b7326074234f7688f11c5a
MD5 ca74649703e28bc19fc1c4dbe4ef621b
SHA1 59156f20b15b5b2ce5a67b5c7130e230431a5dd2
SHA512 d8dc0a3ba7a63fc067ec831a84038a945ed31d7983ea919b9e381141a63637d3ad1e4ff4e01bee0346563a540bf32900dce04445192b2aa955e6dbda2e482729
SSDEEP 384:QvKkZsnK3kyDTvYSsMnur69FuzjkoE5EjtHbQ6o02M:GKHnUf/vzXur2Wko8MbT
TLSH
T16372E1AEB005BFFF28F4BDDFAA066193C92581704A74326DEB47DED0A45DB451A804D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000023

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000023
Size 21KB
SHA256 cd5c3999d7d153b7b8e1a2effd1dd354ddebbf9c3974b8063e6429ef479c6972
MD5 484fcc38f9b75715d8be172de22421be
SHA1 08855b74ef006dc76b4163c833f40451e11a36de
SHA512 806be7ca2beb27ec54d30a2142f3b89abda341e703c335f3c0096c0b8e4160388d5841e71e6f9f0eab53a70a1fc0f6fe6933ba3fa0970a20d5a835259b252e31
SSDEEP 384:SNscoqwsdhvFdy7BDe9pk88eVL7MFEQpwsioMQuSmPTHefTSoNpLg:bTelvABDe9pk8zVLgEQyHvvbHerZNhg
TLSH
T164A2D122B93C414615F2C3E4334F82CBAD84D826EECE767F49EA93901D8C6AB535D457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000026

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000026
Size 61KB
SHA256 df574c7eced419d7b760eb5e5efce7588c331a8a37ba4f3d323c2192d20eca4e
MD5 792f61eb6ce8a87cfeac8fbce2783922
SHA1 a2601ac5035f99183a8bdc2581bf5d405bc6d853
SHA512 b6812e802e4a777236bb1870dd29dd05cd9836429479e44425975892082923dc59e67bca8d1e74bcd06ce2c92a74936cf589155ab8ec2f7b47c1a0e5ae0d9929
SSDEEP 1536:GRnoXPn+9fNodltHpMhKZn4m3NMiRWkfG1H8Urh74KeqJ:KfNwDJMAkkeRLqKeqJ
TLSH
T18653028DE80745BACAE46339F57C964EF80E1509324540F576FC9B4FEC268E5740AE8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000027

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000027
Size 51KB
SHA256 13d1805bb61c3b7451135f54d05c42e5fd0a9b34a44e2d650885e86789b31136
MD5 3cb25907f9e90a061d204b1327a3240e
SHA1 bac7497e76713f6bd85827bcc463ee588aca33d9
SHA512 fbe9ed40e7da5a0da75d9f291fde097ef88257f3f9e2239fed65d905fcbb6d36b352a9031c25279b06ee26521269ad7e8586f8eed3dbd897b24d18e5e6c5aaff
SSDEEP 1536:t1GyfgwcpSFuyiJiX94Kq91hVwHXl3uZ92bux+v:ey4N+uK4KIWHXl+Z92kI
TLSH
T18533022B9298E7063FF22964D74A9C1B0D21D1EF02540BCBFD5AD4327677F211805ADB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000028

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000028
Size 58KB
SHA256 e0d703d8b153ad399188673eff02bdce8e998375c104afe610a10a2dde59875e
MD5 96e5e1cdc95c4436bf11542f0365b25b
SHA1 4b9486e9b024e05e34e391975c34c47296822153
SHA512 b620d7845f7c8500ff4febdbf92c837e47fdeb87afb70baf811e4c1e6fe18e29752a7b1b451de21bee203a41ab914b198adf433a926503dab23e4a216d009f1b
SSDEEP 1536:v6l1x1ajbYvtlWOVKsFZxKZmKLatxPZx0f47E:v6jxkjbYvjLNFZxKZDLatxrI47E
TLSH
T13D43F23F4D186D14A3571D81CCD11931ED43B87EDA05C66F08E2785E2ECA24DA49E9FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

45cc725caf6a444d_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\45cc725caf6a444d_0
Size 8KB
SHA256 e61c0fc7170275b78a33b6eec9f5a9d098be832c0809093a49573207c61b6c59
MD5 64f80b97c279ba405381558ef0647376
SHA1 7549797f3442d31332e379a20cfe0fe40c7ab611
SHA512 eb3f896efd6761226ea2d6623fc4dbc4b6964f3fd5b99c7eaf4ae93ffc2eccc06443c2d559536a605d0681793828cb20cd5225c8b1a01da37f279e18cc0c4d40
SSDEEP 96:mqpEt6OA0lNTfv/qpEt6GQp7j/TXlQn36scd8QZaJNAw6ofnjEhKsiSII7Ne1PeZ:pkUn7dQ3oJaokLEjXTg1GC2zK6
TLSH
T10002C633137A39FBCA7746FD8163521A3F34419B3F8BC243995213B658102F6AEB8596
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 9KB
SHA256 6bd58cf3bcd0c22779458bdce83cff86a7c77fe632171b847fdcf7a49a78144b
MD5 35908b383ebcb4851f52a97d803ec5c0
SHA1 b90182796aa80d415f2a1474ad61fcb6edfd36e9
SHA512 e01049679c5ccb1f2b9d890fd813d04649fbb13322ea86f9995e3e5a1b542611a2f3484f1e332cdeddf17ea20b4896fb02662bcdd3b688a46604ba3af5a07f30
SSDEEP 192:fqLjxAVA26K7vJqcPYFGdt/743pM+0hVve0GmU:fqLjxAVA2F7vNYFGfMCNbU
TLSH
T1BB22942624C5CD22DB543B3D96DAC824F2B41B8A4A839F2E07457C78EB8F7B35DA3514
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 10KB
SHA256 bad839024fbf73a60421bc43ca6620764eb09b11690a60032d132305ab74fa12
MD5 0eb0665a2112748f5b5d213fdaae0cd0
SHA1 9ba5f5ab9deb41e10e1eb7e86b23065d8e3652a4
SHA512 a297adca69a6e9d76f842f75ef26a5f72407d9e2dd0a2c42c004291bcf3e02822e523b8ffc251dea45ad41f30593595f6bb66236019e9539144da177eeac110a
SSDEEP 192:JSLjdeo5Vtt6/S/QcPW3O8Dcs4M3pMi0hPveIAm2H:JSLjdeCVttgS/NW3t84WThY
TLSH
T12622B62624C58D76DB553B3D96DAC824F2741B8A4A838F2E07817C78DB8F7B31DA3614
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 10KB
SHA256 d8465984c9a27495c21d71973160c89224cfd3425412618b5f2d2b56888f6205
MD5 45e4608ab3b5c916c16415f74b4b6b6f
SHA1 aa3b7475a66e8a132deb123380e4fd35cd389fed
SHA512 edb8f85720cce5b5a7f02fab20c4a8058525ffa1408313d60d5625bdf31f68918b961dcc5e9d2792e7eb46d6ffce532f43dfc3ce9cc3f40eab0d9a5d8abfb3ec
SSDEEP 192:BgSLjd2AVpt67S/JIPYFO82dg743pMi0hAveIMm9:BgSLjd2AVptwS/CYFtVMWO99
TLSH
T1E022A42624C58E66DF553B3D96DAC824F2741B8A4B938F2A06847C78DB8F7B35CA3414
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 98840036617439b42537e350f7d0d56192774f45c1663998abe79a812ca80536
MD5 a08925335c55f067acbf2d46cd87b463
SHA1 3372de76bb6471793429387191f6f5637839aa35
SHA512 4d6634db5fb41c4ff191200c272050e48cc5eb359cac422a599c1cf162af5ac729859ea70681eabfe946fd590a90126108ae3d4dfe98da62550677513e8ec330
SSDEEP 96:/LeeMOsUgHrd1ow+44CaarXhFjPuXR26M/Yr4lgT/bheFeXSQB:jeenaKnaznPuQ6MuigTbh8eXPB
TLSH
T13BE14F3069858E70CB453ABD5ADAC824B1315F9A4A53CF7A0B44BC7CE78F7A74C87458
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 10fb4ebb0c585001c0373befc46dac522af8bb4b47c8f2130fb0f1644cd0c406
MD5 42fab9c09b370bad89b3899ffac97eaa
SHA1 77598c5de1462f8802f78bd0613587282f14cb41
SHA512 ce6ed74acfea0a98a6a71fa16a3c96ee44b83d11fa15c7e64dcbe981c161c694cad5fe82cbb2ab6e0d31ff28da68a238cf607561ff9566c2b858613ee9197c20
SSDEEP 96:/aXZvFHrd/pw9pP4KPWZH2Bylgr4r/peG5Q0:/aX/4plPWQB9apb60
TLSH
T1AEA194102A86DE75EF443ABD9AD6C825B132139A49438F4B0B117C7C6B8FBB744D7984
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en_GB\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 15KB
SHA256 96c15507598bf960548ad56f4ed10b7ac9887ae32153514c7a5cae6cdf0b4b37
MD5 f12850adbbbcc1012d13f090408c3fb1
SHA1 7f0f64fbb93b34c1cc9983a56cf05c76e6dd985b
SHA512 cfb0b99d8e795a4134c24c9875e64d5a892013ac26df2ba6891d6302629c7b982d679421de2624a8a9d003ed7ad109adbb3e20c5d470b584a9bd95d7d745106c
SSDEEP 384:D0multbNJJyJ+Zmkd7emqmjExT8jW9yotIIGnU95fm9mrmmmDmt0RmT/mgnDDGDC:+Akb+qMqXidC1pLKXOoncM
TLSH
T19062BCF783E8C66D890156F4AB15AF1FCE290528432C3876C9E4AE4BD3E2872E15175E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 13KB
SHA256 ab8142fae6b25202952589e9b2da6093fa1b28f7e4a9ffb10388a4dfebadb3e7
MD5 d48dc5e5ce5320b68ec22d5ababc7efe
SHA1 1816d68d5e46df3da5894d1ba7f5a6f66a5c6203
SHA512 c2f4918aba6453b6a4e54ad3466b67c8ea9dd4d9eca45dd379182a1b21c261238730462df5ad0a602fce8061bb5093834eb4738a9a10c1713d1c75e39ba0287e
SSDEEP 384:D0mulVtbNxJJyJ+Zmkd7emqmjExT8jTAFIIGnU95hIMm9mrmmmDmt0RmT/dmVE7x:WAkbd4mlMqXidA5kp+hSL
TLSH
T1E452BBF783E4C66D8A1195F4AB15AF1FCE290528432C3876C9E4BE07D3E2872E15275E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 14KB
SHA256 ef5ece4ae6a601113ad1cef4408d9a961ac2efc2dc22612b7aa54650be5c83b1
MD5 3868db4b94a9a1117fa49eac068d98bc
SHA1 f60ea32debfe6b85321d98c5040bb24616765653
SHA512 5705dcdea683df4eb8fdb79628761d5b4e0ec3a883ea74e9b3cc7ae8c79a7c11ae96fb9d017cb9d1143e3686ef7e7b76faf121b24383ae1edee37e3f7612296c
SSDEEP 384:D9iNr6Ei9qTJtJ0qIFIvemWmPCIIGn495hIaI/m9m+mamDmtOYgbRmTWdmVOi+0s:UfzHQuF+MvLizXEQkPv61q
TLSH
T19062AEF7C3E8C66D891155F4AB156F1FCE1A1928432C3C26C9E4AE4BD3E2872E25174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 16KB
SHA256 7b65c38d2e7934a662e0c3dd8140b8ebe1f0a0c0ad448b05382993b4f96ffba4
MD5 e2b5d4dc30faa3dd4b77d022b01a00ef
SHA1 82815023097c9fdf21c149d63c85b010d532d056
SHA512 06b2faa44716345593691ead0eedf10f9ea6b4fd325c46cfc6a0b812096bb8712f3169ec717e68ec5bcebc32ec8315eb8f976535c141f1a776bbff2f5af53edb
SSDEEP 384:D9iNr6Ei9qTJtJ0qIFIvemWmPa0N2nT8IIGn495hIaI/m9m+mamDmt0RmTWdmVOR:UfzHGuuF+MvLidXyQkPvO6J
TLSH
T1A672ADF7C3E9C66DC91155F4AB156F1FCE2A0A18432C3C26C9E4AE4BD3E2472E25164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 bb861182009f5a6c07ee4b260d0fc5a1265d8d73f0a8cc9b899ff16b4ebaecb5
MD5 88532fd15fca15bac8919f31d685064e
SHA1 ee6f4ed79efc5180b8d33bf6fb35c7ac0565c0de
SHA512 5160efa0cb64f5aa47debb2a460310ff84f0cb5229c49ba1dc738a3037771e4a1a6d9e4520a197cdecda7c2af5887cd8d108df76761c432a521dbe785e8400bc
SSDEEP 192:D9iNr6Ei9qTJtJ0qIFIvemeIIGfksdK495hIhxc58uIIiNP7aPHv3pGfP6GDr11I:D9iNr6Ei9qTJtJ0qIFIvemeIIGfksdKS
TLSH
T1D432ACFBC3D9862D891155F4AB15AF1FCE2E0A28431C3C26C9D8AE4BD3E2472D25175E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 2KB
SHA256 faffa99d98adf435ecc1ad40b035c7c96cfbf3ef856380e065fc2650eab02f03
MD5 755562be5ef2655a4935fe934e81128d
SHA1 07f89ba83bead2e9a568105514d6da9491086597
SHA512 f2b06573308dd9314714fc2af436c0c6528be911b15889d1e3251724e5a8d0b65d124149dc2880f099850975dca955a91a7428bf1b2efc154dd4e46a650da4c6
TLSH
T1C4518DD7C6FEF46B102989AF1E08BC0E2975A83601B164F9DF5691ACF0C25F71722066
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 012775fe026ef3076deb47480c0fa25d252df666e03614b089a4ed51dafead5f
MD5 fd0bf24cddb13588fbce882442f9c7c5
SHA1 34ff45a60e4d41f57dcd92f3541478c78a5736db
SHA512 a22ee9233616968881408d1ca948440a6858ef7da0d6a81189a930e8db3b82a0e041fa2ef85182c7676e844616ddba1b0e6efd155012e4c29370a3cc9981dec2
SSDEEP 192:ARkcBzmqghXFv7hHgPRpPtrxi4/j9SHsb+WN1hRDGovGy+bRWrSfaZFXVyIsnAUl:ARkmzm9X1ViXbEwV1f4Waadvq
TLSH
T10762E95EA820297B5DFBC629F9117767E7F6202164E02E94F7FC992C28E76CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 352179814dc701e5bb310fd9766196613813ce159dec94a4a2c7a65a2d67b519
MD5 64bfac0be49ba2beb09a6e9ee4c48a77
SHA1 f12aaa2fd6069711026aadff95a9017f6d7343bb
SHA512 3a727a4e7c0851e2f7d47da36ee07ab47eb26f67e0fdae88411d88ac09c9358a02624f77381bfbd866489ad8e2929959175a3d1257db6c95fbff557a81c565ac
SSDEEP 192:ARUmqghTOv7YHAPRp2HG9SHsb+WNnDGo0PsSfaZFkVyIsnAUge:ARUm9Tq0CXxEwD10P9ase
TLSH
T12542C71EAD10793B6CDBC629FE267753D6F6202125A43E94E7FC992C24E76CC221B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 f7f99cb5336622c54d664c6331732c260d2268f138c148a0d78e3d255984fe45
MD5 e8556baecacd35a138ec73cabb16d824
SHA1 e3ad33b806e39a90a33c4554186678039f72a4fd
SHA512 3aaafcdd500fc49b41d360c45d665a568fcdee799b602e95fe2d6eb4a59a1bfc136d64e7224815b3d13ac7532f1e511e2c78d5e69c93e2f3636dfa5f6ebeea61
SSDEEP 192:WRkcBzmqghwFv7hEgPRpPtrxi4/j9SHsb+WN1hRz/+Gy+bRWmSfaZFXVyIsnAUgy:WRkmzm9w1VlXbEwJq4Wfadvq
TLSH
T17E62EA5EA820297B5DFBC629F9117767E7F5202164E02E94FBFC992C28E76CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 455b2eb8ab44fe00b7338aeaf0639201ef15b01808b3778072beacf4fb71c311
MD5 16c952f3e6e8d31d9b475a42877e2ddf
SHA1 f04c38f32cb6bbb53b97685e53c7a687b041cac1
SHA512 073571ff3ddc1dd00969c52093a269c8304f21a5d187181bc1282e608153ba5b592d9257d932512be652e1e99c27a4bf699e8c3eddbf7d09c243220cbf909716
SSDEEP 192:WRkcBzWqghr9Cv7hEgPRpPtrNiTElVj9SHsb+WN1nIz/+Gyr9Dc/C5YUSfaZFX8Z:WRkmzW9ROVlXVEwuqt/YVa4vF
TLSH
T1D162F95BA820297B9DFBC629F9117767E7F5202264D02E94F7FC892C24E76CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 b93bf55aa574ef2c48cfaaf3772aa456cab02d25d1127eca3f59323a498682aa
MD5 c482886bcdaf9200db6737f2c4281fbf
SHA1 3cb2bfd00794083111e50beef38ec5bce1ef3e4e
SHA512 e19824dbbcd6a09c096c81e995467d713f29f010231d4fd6cb9c28c9870c5ae964599a32f6d80923893833f8af0d408059039d8d9b654ef5248de79fef81c63b
SSDEEP 192:iRkcBzWqghMCv7hEgPRpPtrniTElVj9SHsb+WN1nIvfvGyr9Dc/C5YiSfaZFX8yA:iRkmzW9MOVlXPEwaft/Yja4v5
TLSH
T1EE62E95AA820297B9DEBC629F9117767E7F6202264D02E94F7FC892C24E76CC3217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 96e0f1e48619ffc4f4d317fe1d2b02d5a4de0933e916f0040679e596b0e0d8ca
MD5 c09874a6180399162aab5609b3223754
SHA1 0960c849c8831aa3277d31e425b1ae1939763ef9
SHA512 d64ab7a205bae41b17442494e68d116a931b970c1fbf528b851e61a4a09c325aad772a098493aae456f6780ec6b413575430f0fb21213d1d08c168640b7e7192
SSDEEP 192:iRkcBnWCghMPv7hEgPRpPtrnisElVj9SHsb+WN1nIvfvGyr9Dc/2+YDSfaZFX8yA:iRkmnW1MHVlXSEwaftgYCa4v5
TLSH
T16162E85AAC20297B9DFBC229F9117767D7F6202164D02E94E7FC992C24E76CC3217413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 51607e0872bcbda0d826ea0a2ac602d39dec298027a938cb9d663d8db5b388e0
MD5 30d6c345935ed4aefc860ea56e01524c
SHA1 198313b90902d2fdf0ac0439b69a4aded39cbfa6
SHA512 22c128a008f85ad07f1f02cf680424fe1bb3793e7133722f2d0610ea8962c9920049547e6a2675f513655bbd7d07719d1aaf98070530fe9e974e7825c4b6ef0c
SSDEEP 192:ARkcBzmqghTOv7YHAPRp2HIdj9SHsb+WN14LDGo4YW2eSfaZFkVyIsnAUg5U:ARkmzm9Tq0CXFEw61K2Has5U
TLSH
T17442D85EA910293BACEBC629F9217757D7F6202124E43E94E7FC992C24E76CC621B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 5cd14fc700acf3becbfc32d159f22e012c370c598c8179ca5849f5c825cc133b
MD5 8ec2fbc3fa071e0c2057fc5a28266181
SHA1 2b609cbfc958c58c24b0f096c36e7e6dc93fd962
SHA512 05c431fe67d015e67d81a126dc9e185a10621293f22152a5e9ecc805704468723ba974c8bce8510ee849f92b9e70a6338735d67c800bd7a503ad19b56a93bfb2
SSDEEP 192:ARkcBzmqghUFv7hHAPRp2HR4/j9SHsb+WN14LDGo4bRWsSfaZFzVyIsnAUgvf:ARkmzm9U1VCX7Ew61KW9aBvf
TLSH
T14752D85EA910397BACEBC629FA117757D7F6202124E42E94F7FC992C24E76CC221B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 1f1b2a9cf2dc7b274a5dda3d9acf32b55987b8ac66e1743daf38bdd69444c257
MD5 9dee1858cb019a456db35522f8d06ed2
SHA1 adfa5dddc82b26c6a349d2183dce452e83561289
SHA512 52ab6ac70b0186d9c92c66134036b893d243265cd682b68666ee31aff6c1bb544ba1577a7782282c2bc2ab5c5a5fe5ee8af2bd880cb92bf075795a5ce2c4fa6e
SSDEEP 192:WRkcBzWqghr9Fv7hEgPRpPtrNiT/j9SHsb+WN1hRz/+Gy+C5Y/SfaZFXVyIsnAUl:WRkmzW9R1VlXiEwJqdYGadvq
TLSH
T17362E85EA820297B5DF7C629F9117767E7F6202124D02E94FBFC892C28E76CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 db389f2308aa74734a074e7d3dc96c6c790139139653c4e0e081a7042bf555fc
MD5 b5f02e024ec1180e871aa9fa2e36abe5
SHA1 5d0d106075d8226c1b29fe5647a08897dcd791f6
SHA512 38491cb8c2e5ff7f4a58ae15e01e002c019746e75a9c970ce4c37ba9343c760e20966522f4099e7647a2f0edacc3e91287df7a4e4c2ef12b96016f8e6eea1f91
SSDEEP 192:WRkcBzmqghXFv7hEgPRpPtrxi4/j9SHsb+WN1hRz/+Gy+bRWmSfaZFXVyIsnAUgy:WRkmzm9X1VlXbEwJq4Wfadvq
TLSH
T1B162D95EA820297B5DFBC629F911B767E7F5202164E02E94F7FC992C28E76CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 6a2c5848386b6201551f5c1129b827c172633da6c7ad76d46b4970e3a4fd024b
MD5 5ac9ae42145b4985a6fca7318315fb3e
SHA1 34ae35de4ab8e474e1014c390f3099dc64bb470f
SHA512 244e29072921b75c47991d05a1e157a77ece15c682c26a87c7c9fd0ccafdbf355621b6f83aa5383c43a49e0de5b9a29dacb74c9494731e5281e5f64b15fb0aae
SSDEEP 192:WRkcBzWqghr9sv7hEgPRpPtrNiTElYj9SHsb+WN1nIz/+GyrD4MC5YOSfaZFX8y4:WRkmzW9R4VlX6Ewuq4zYXa4vF
TLSH
T17262E95BA820297B9DF7C629F9157767E7F5202224D02E94F7FC892C28E76CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 21b2d14738759a8a0419fa46015ad7476bbd93cb57f9f00c64319116e7cc286b
MD5 62b0c03ce7a8dd52ff71bfaf8db363d8
SHA1 99fb639ad0d21598a1809d8f9384c3449e79ff02
SHA512 2e70e6422f680fe7a64ee6aed627da1d3d7671414ab773178b152a1e10f41902a97b8f6e1b518df6e3a10757d9317571f82e66e054bfd7eb14f492011b46c4fa
SSDEEP 192:WRkcBzWqghr9Iv7hEgPRpPtrNiTEluPj9SHsb+WN1nIz/+Gyrs7+C5YFSfaZFX8Z:WRkmzW9RUVlXWEwuqYdY8a4vF
TLSH
T1F862E95AA820297B5DFBC629F915B767E7F5202124D02E94F7FCC92C24E76CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 460192a24100f86fe9849f548545139834f73f194615db3c8e3033dac6f485df
MD5 a125390e318daa77a9df2c74905f43c3
SHA1 1820dccf47d5ea3b9f44dcc2475dfcd742e2b796
SHA512 49419cbdfadda7d816a30e14cc378ad0a630bcbc578e4ff958253b3f6c45601817f681ef59fc1f49e5ce3c882965a2e787fc90111a3ddd9bd9a0f94786c9c7f5
SSDEEP 192:ARkcBhmqghTOv7hHAPRp2HY/j9SHsb+WN14LDGo4YW23SfaZFzVyIsnAUgvf:ARkmhm9TqVCXfEw61K2OaBvf
TLSH
T17C52D85EA910393BACEBC229F9117753D7F6202124E42E94E7FC992C24E76CC6217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 6157c5324d3f116f0e883949a46f4a547c7de91b91b4f0dc7981e5a33cc07680
MD5 6515bd3ba4967873fb364d1cecdf0bea
SHA1 64038723271354ef77eda2457629d914a3aa0437
SHA512 18d2db1da3268175abe9566b89c7b03e281ff860364df9b1dcd764d90d72b49a214c8a02085cd63eb2fa592cfad06b853d2cdabcfd5df2eec9fd0b46e671177b
SSDEEP 192:WRkcBzWqghr92v7hEgPRpPtrNiTEluPj9SHsb+WN1nIz/+GyrD4MC5YOSfaZFX8Z:WRkmzW9RCVlXWEwuq4zYXa4vF
TLSH
T15062D85AA820297B9DF7C629F9157767E7F5202164D02E94F7FC892C24E76CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 107fa981589f8c474a0ca49c5f0f2807623ded6d35b820951abd8f47d17e94d7
MD5 9b9b496f170d5df754292c435c8297dc
SHA1 79db2e0e3d2f90b7b560062309c865c85f4dc77c
SHA512 c493ee41f275ff951d679d0920f894e6b4471f408550bb18508acdf8afee48cae76b63f0d8ed1dc686b1b8b240eed772eeb2bd16dabfa26e52754718f95c5638
SSDEEP 192:ARkcBzmqghXFv7hHAPRp2trxi4/j9SHsb+WN1hRDGo4bRWsSfaZFzVyIsnAUgvq:ARkmzm9X1VCXcEwV1KW9aBvq
TLSH
T18652F95EA920397BACEBC629FA117757D7F6202124E42E94F7FC992C24E76CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 4438aed531938756c5a3ec20b5b046c3b4bd2def96ae7fe5d13c5326fc4e790e
MD5 72960e12686ddfa23bae0c07f6bb77a0
SHA1 47fcf243aba07fb0341eba3055b798d3b36f927b
SHA512 9b32402dd0e9dea6f39238147c8ab4853b75e998628735972fa7593ef916ba1c80e2d9208588a0fb97c825f2d653d6a5b353dcc1acb7bac4a587991a255ecd44
SSDEEP 192:iRkcBnvCghMUv7hEgPRpPtrnisElVj9SHsb+WN1dnvfvGyr9Dc/2+YDSfaZFX8yA:iRkmnv1MQVlXSEw/ftgYCa4v5
TLSH
T17762E85AAC20293B9DEBC229F9217767D7F6202164D02E94F7FC992C28E76CC7217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 f1f136a954543364531770ff2d255df7ff170fac6d0b81d2953588d3a0d843ee
MD5 417bf2bbec561b927111aa59f3e5a76a
SHA1 0f9319934b36753a85f7c90fb0a8e08ee35e6893
SHA512 15d48c9d7ae100dcdbab232897acc77d0c802feb11867bf7a10ba705c47b5ad43aba4b43b4c5ec328489b1619f35cfb6c24dc1c447af021f83d3e0be1380c986
SSDEEP 384:D1jts7KxkXqKf/pUZNCgVLH2HfgsluOXODt0+ErU344H1x1hBe:Dlts7KxkXqKf/pUZNCgVLH2Hfgs4UOpw
TLSH
T1DB52E967688D9A3F0FD8C94CD8137F4FADB6025666784D2457FA9C0803A57CB121A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5934feec05176525_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\5934feec05176525_0
Size 1023KB
SHA256 0275a89129a3a111339ab5510d027659979f8915fc168d7dbfadc073a6dd55a9
MD5 2d1777a2ecb982fb40a2466db2f6fef9
SHA1 972ae7096185faa8de3219e4205b703713ece9aa
SHA512 1a37f16d279b83d10e9db8f9efb075878469f5ac268c481a46cc5d15b0167209a396d60bc28cc8cce7b7bf239d022f7fae8b16af668b0ea382e5226f1a90e30b
SSDEEP 24576:5Zf5bDY1+2dPObPSa4wlDRcCxekVGMKIz:5ZFDY1+/PSa4wlDRcCxekVGMKIz
TLSH
T10D253CD873A2B463A375F1A4426F42C7F2AEE892B449886CB598DCD12E74C5540F7F38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6aaa4f4a2372af7d_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\6aaa4f4a2372af7d_0
Size 255KB
SHA256 e5128fc9a8431821af224ea83c82580426bdc81a3632780faf96e2538b5af4d5
MD5 8f2a3c57f6f2be44d601a49ed5f8387f
SHA1 b56684a6e0e4766c56436e8caeb3697449818fde
SHA512 a073bf314692115840525c002ac32f2aec413a2c94537cdb65203ce814fc5494fac6ff911e5a1337da9eef1b05fc64c4c48a4e0fe072157fd48ba0c6c83a0290
SSDEEP 6144:nOfvnFSg9vbMu0aE/61An3G38/ZEnX2H5c5X5w5fnQkIC7wKIIqRG8:nOfvnF3toRaaZEieJ6fnQkIQwKII8G8
TLSH
T15F447D723300A53FB8278EA1E67E7F4D3825E217DD2706B8D6E4E9358BD2DFA1412548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 7c0ed429255d554fec810767914c3594c15503343311f97f4120e8420e7b6a2d
MD5 a8e21d252e7ade9496f6b241b8b78651
SHA1 74002cb2819c28fa807244558a2aa2d5871dc766
SHA512 9b03d4e07041aa8a9bd9242712edd7afbf016c232599d558d5462fd51003df9e2c114ee01fbd51d99903094fd877e0001fec6aaae42cdd0ddc49c39f76f33fad
TLSH
T166B011802000CC02CA00A3B088C08A8028202830A28B0022A0BC802EA002228220A8A2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 8855a8941c8982a47daa27352c2512ffe3e443deb07bfb4b0c6a96705d531d59
MD5 c3cd168d1ba249bb1a1e54d5fe31d32f
SHA1 5160d95bd452ea7415b2ca3b479ca1bf3c34309e
SHA512 23559c0485ad8d262f7913ae3780d97d0917ec679da28b952b7aeacef7dd80bf5946fb856bd8e3ca56ac6c4f2288e1a7155f7f0d64679dd432a16ee8dbc48bf3
TLSH
T12EA0021441C09CA2DD20627CA07109452BA9481915D5870354A5884CCD5F3C58102951
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 424d5c54b39f8251241ef9db9aa2484dc154ac03ad430ada04f50df75fca5c07
MD5 cd1ca06ad9d41e571271fdcc126c606c
SHA1 b926607ae542f3242a39c2a9bfa1d4aa2233a08a
SHA512 165e36c59161c964f50d1c3c03de18d211d4b6a99c15af096a688ac694f9088bff61f6fddfb58bf9621ff8f9976c0910a6e6b89ac62109ecc8453009f323cb7d
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe624272.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State~RFe624272.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 150B
SHA256 ca62a8b368c86419a0e8b6bd005447a81851642fb6c8fe02d3311349d0e1df5c
MD5 920e53300148be38f12f9291e30116aa
SHA1 81e8b116139cc03e5d15c5b2af49c0d7d1b73ec7
SHA512 f999e425204d59c6288cecfbc8b8d6bef9be7bacafa64d556fd6e6f0ad39a59f050d15518c3366a88bf9e53842c91ad81112e6cf13a33a40c298559685511273
TLSH
T1D3C08CE708208A5F4B70E9D9102971ADE50781888CC8DCE8980401132074E234402868
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5c993a.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\2\CacheStorage\index.txt~RFe5c993a.TMP
Size 157B
SHA256 7c79478e09fa0377fcb466a9d20210b20dd02233fa8e70b6052c78d9a2a353f4
MD5 f2c999b3a512ac4d094b84c1fa42b9e1
SHA1 386364ca7d96c3dd9d75a475557ae7255d294bda
SHA512 9d61d38a3119d8d18d42d69288b90ff3d6b78c6ac92fa7f7da00eb1c5a4fd341f636262faedaaa45ff9de43681ba07b54003f6ee1e4b93bd7c15a9d162128006
TLSH
T1A8C08CE71420465B4B31E8DA102831ADE5178C888CC8DCE8980432132074E2B8401868
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\2\IndexedDB\indexeddb.leveldb\000003.log
Size 30KB
SHA256 e3f8296143c7e8e202583b91fd1996a0f6c62de3d9efb9afa98b1530de47e8ff
MD5 01d04506d2ba0c472800bc7cdfbd747a
SHA1 f7224d594f9a12b602ededc24f2152146a5e173a
SHA512 ecd1b8af732b8479f7d1681ac366a12779e563922d8ec9be4ed7806f40a77e17afe20ce00bfb1b6f71b94ed2ae14486ab3be53da38d46602e6e950afa1d7a8c6
SSDEEP 384:7Ew5dwmw7wqwR7S4rmJ9M9C7s4N9K7VR58O1KvsIX6Rv7X7NR58P7vH:7P64yod4LG38U6w938DvH
TLSH
T157D2C62971236C65E43703374BA25F87C332CBE4AB046526B972761C6EBB3846D9363D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\2\IndexedDB\indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 9b106ce656cb6e5587aaaa8073025d06eea9c82cadf7e82bd7ace026e4b5f9d1
MD5 8cbe0064f77bd46bd9c9a7b5d63643f4
SHA1 ea7882a69e00ec9f64d4740c1c065fb3c3aef671
SHA512 7bca8ae9b16f68bc46df5ada13698f9ae08474d97ff804368238726a6e4b9c3d39b786987845208e877c085e750078803de5e657607e604fdaec1ca480e36ced
SSDEEP 3072:OXQSg/TxNP9n3RM2usEnhdFaeqag2Y5ZUVncNBzIp:ZhxNPRW2PYddqmY7U52Fw
TLSH
T1A2C312317CF95ABC4C5AEC4C324B3C2E6EE6E9DE64D87FC8E8646F0E041B814A163954
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 78bc61f239bd531fc3fb8105c0781e36817fe40c895a847ef83f96aed296fdaa
MD5 4cb9f67c86ddd65565fa38c4e405afb6
SHA1 482decdcafd3212a6c2b1d62bea1505aae3dc69a
SHA512 8668bd5daf1c2ab4464b1bd3c704d6ffb8b0870f2978ea050c3ce72212fd3f475eef59b01cc469aef81fc8eb79d24b3c3ef4102dbb3b9910f25a5963b974178d
SSDEEP 3072:3XQSg/TxNP9n3RM2usEnhdFaeqag2Y5ZUVncNBzIp:whxNPRW2PYddqmY7U52Fw
TLSH
T1BBC312317CF95ABC0C5AEC4C324B3C2E6EEAE9DE64E87EC4E8546F0E041B854A163954
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 9d67f60204f93300310ad5e48ce4c779fc959f466ae08a1da1374a8e642fe86e
MD5 54c109b16eab0cb21c7044ebc63d00d4
SHA1 36c28a3dc75b3172ab90f74abb4a0c20ee9bb2b4
SHA512 f39b41a54164765306786ea73da3c48f3cc5129f8b750679c230a52e45b771595b02b598dc9943e24a408069ed74e3c0445b4c6503916a9de1ad08b621f316e6
SSDEEP 96:nMC0d+VUJ7oKfVHrSJEYvJVHQRDotok5F9DOB6EGyvP/e+0QZPEOLv4a:MC08UR5rYv3eDUDHugae+0QZsOP
TLSH
T143A10973A86A8D7BA976C58571062B43CEB5B17BE531BE90E9EC1F0C11EB0EC2301523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 cef036be656505e61ff7e09c2fc1a7d22420c660957c95a7caad6fcab6800ab2
MD5 8b11ade6f135836e0f0e0a66a532bc5a
SHA1 e788ea86f74ec0159d719e9ce911d64bee743993
SHA512 d9216fa141c0a403fffe8fb045e9db9dd64e137faf6f3c1f2954381e791b3fbacf44f20908f7deddf41fb963da9f4acaa1941ef0646094c52ae89c697210eeb9
SSDEEP 3072:9XQSg/TxNP9n3RM2usEnhdFaeqag2Y5ZUVncNBzIp:uhxNPRW2PYddqmY7U52Fw
TLSH
T138C3125078F96A784C4EEC5C324B3C2EAFE69DEC70E83EC5E9649F0E155BC10A163954
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 2551f59635727818351a34110ef4772f8fe67a8b0a543f4b7f1972a7ebbc1554
MD5 447f26097f6bb8e26e231bd43f94de77
SHA1 6486676eb40d5366d9e01365e3b87e8d12854f7d
SHA512 a0ad416f1f3224f32b4e5fe9b33ea1b821d7f774901cfd0b357d406d96bfb54ca513096a7c426e64949a7d1e4ac06b158eee5aac34c96d30db33ea34fbcaeeee
SSDEEP 3072:3XQSg/TxNP9n3RM2usEnhdFaeqag2Y5ZUVncNBzIp:whxNPRW2PYddqmY7U52Fw
TLSH
T19CC312317CF96ABC4C5AEC4C324B3C2E6EDAD9DE64D87EC8E8646F0E041B814A163954
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 99e422b485a7a91ba4d9c53716ca31d593c239d9f7d1523a3984378d644600ce
MD5 f3d84be72f45636c19ff624ad7cf8968
SHA1 23b1c321dec2d2e35c1dacbee37bd388fe00b992
SHA512 2334d83ea089e804b858f27b1d897347047d1b69d41afdcf0dc48b2e21c2fb9b2989f73fab34bf2aa17cc1db0fa0268effb488d9778dacc0e867e404135a6ade
SSDEEP 3072:oXQSg/TxNP9n3RM2usEnhdFaeqag2Y5ZUVncNBzIp:rhxNPRW2PYddqmY7U52Fw
TLSH
T17BC312317CF95ABC4C5AEC4C324B3C2E6EEAE9DE64E87FC4E8546F0E041B854A163954
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 84762cddecacf70bc13a92e49812f4d1c6e114e08f118117afca6c802be2bbd7
MD5 fa0bb4fae29ca712c2b3259c5fb501ac
SHA1 b5e1102b54c113daf7507372b2574ebb8ff647b6
SHA512 5e53e5190d203903c1f77ac0245795cd7142b60d553d75d43d1c953bfada6c34b79bbba3ec372d478271e63f29964fb671886f8eabd7f4078cfd814b14f0d99e
SSDEEP 3072:YXQSg/TxNP9n3RM2usEnhdFaeqag2Y5ZUVncNBzIp:bhxNPRW2PYddqmY7U52Fw
TLSH
T187C3125078F96A784C4EEC5C324B3C2EAFE6D9EC70E83EC5E9649F0E155BC10A163954
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 d2394463b5ed683b9c86810bb3dd4ce7f2782a32e025f405e861988bf6a52761
MD5 ff98581609477d91f4010eb0625a8ff3
SHA1 bcf2e0c77482d1af816d3f9d2a479b6a85fd1d0d
SHA512 643da5f5916b5a784f3270f365c4d00467724ba5ca65200b56e9d8b7c2f288cf4712bcda2796fb0532262153462e1f6ba01e08265ad6cf4e667b25ffd313737c
SSDEEP 3072:vXQSg/TxNP9n3RM2usEnhdFaeqag2Y5ZUVncNBzIp:YhxNPRW2PYddqmY7U52Fw
TLSH
T1E9C312317CF95ABC4C5AEC4C324B3C2E6EE6E9DE64D87FC8E8646F0E041B854A163954
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3928_253459745\CRX_INSTALL\_locales\en_GB\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

iniciar.bat

Path C:\Users\Admin\Downloads\iniciar.bat
Size 74B
SHA256 4e2f451fd9b4723dc70b19b7bf584bc310776a60233352d5c3b81bb4957b051a
MD5 915caa2d7eda288bdde6bebdb43c2835
SHA1 657f3f99a04c568e9283b36525f91b0ca0ed817d
SHA512 252cb78bef1b6b9ca9a778d2a94c0f9169153ce3c49d12fb46a3cc57a67abbca0f4654c9b4c197686ea1d1cb5e7c7ccf247cbec9d81578b9b184a23c0600191c
TLSH
T115A0228080F0822F02E88080BB833000E30F00F00FC02F00BA02A00B3C3C80002E8A00
MD5 SHA1 SHA512 TLSH

Submit Download

memory/348-2395-0x00000000003F0000-0x000000000199F000-memory.dmp

Download

memory/348-2394-0x00000000003F0000-0x000000000199F000-memory.dmp

Download

memory/940-2386-0x00000000003F0000-0x000000000199F000-memory.dmp

Download

memory/940-2387-0x00000000003F0000-0x000000000199F000-memory.dmp

Download

memory/2848-2408-0x00000000003F0000-0x000000000199F000-memory.dmp

Download

memory/2848-2411-0x00000000003F0000-0x000000000199F000-memory.dmp

Download

memory/2848-2379-0x00000000003F0000-0x000000000199F000-memory.dmp

Download

memory/2848-2413-0x00000000003F0000-0x000000000199F000-memory.dmp

Download

memory/2848-2407-0x00000000003F0000-0x000000000199F000-memory.dmp

Download

memory/2848-2412-0x00000000003F0000-0x000000000199F000-memory.dmp

Download

memory/2848-2410-0x00000000003F0000-0x000000000199F000-memory.dmp

Download

memory/5612-2431-0x000001AE21F00000-0x000001AE21F01000-memory.dmp

Download

memory/5612-2424-0x000001AE21F00000-0x000001AE21F01000-memory.dmp

Download

memory/5612-2422-0x000001AE21F00000-0x000001AE21F01000-memory.dmp

Download

memory/5612-2432-0x000001AE21F00000-0x000001AE21F01000-memory.dmp

Download

memory/5612-2430-0x000001AE21F00000-0x000001AE21F01000-memory.dmp

Download

memory/5612-2429-0x000001AE21F00000-0x000001AE21F01000-memory.dmp

Download

memory/5612-2428-0x000001AE21F00000-0x000001AE21F01000-memory.dmp

Download

memory/5612-2433-0x000001AE21F00000-0x000001AE21F01000-memory.dmp

Download

memory/6120-0-0x00000000003F0000-0x000000000199F000-memory.dmp

Download

memory/6120-3-0x00000000003F0000-0x000000000199F000-memory.dmp

Download

memory/6120-2-0x00000000003F0000-0x000000000199F000-memory.dmp

Download