3e5efbc530923793421edd42430284048e220df64ec6e7240b1a7a44a61a2f5e

Analysis

user interaction
yes
max time kernel
646s
max time network
639s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/10/2026, 22:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ava.exe
Size 2.4MB
Sample261003-17rtpsyamb
SHA256 3e5efbc530923793421edd42430284048e220df64ec6e7240b1a7a44a61a2f5e
MD5 c1f82d06ff0d0152dc0090d41cb6e564
SHA1 7c9f0ec46b9ce4395f88014a47ea84903ee92ed2
SHA512 2291f996eaf97d6bb3bd4d9447f28cb57eb9dff7a2a9cb531b5f1284cc0479f75fb750cebf0c61cf648b1074d7ef24055b7d8585f9220968ed31dbd378c1c17f
SSDEEP 49152:Tpl07tmpd9tzvZoq8M+LLNEqM9sUT4g3r/66vsF/P4JxXovKR96Ix5nK2hMw:VjZoq2ENCb2ew
TLSH
T1A6C58C3A764460B8C076D178CA9B35D3EE7A38090F798AF3EED065158E671E05A7EF40
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
280	4972	chrome.exe

Executes dropped EXE 10 IoCs

pid	Process
6088	ava.exe
3328	ava.exe
1984	ava.exe
2700	ava.exe
5304	ava.exe
4580	ava.exe
3840	ava.exe
1344	ava.exe
3288	ava.exe
4700	ava.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4972	chrome.exe
6136	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
1792	chrome.exe
1792	chrome.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
640	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 21 IoCs

pid	Process
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
1824	msedge.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe

Suspicious use of FindShellTrayWindow 57 IoCs

pid	Process
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
2368	osk.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2368	osk.exe
2368	osk.exe
2368	osk.exe
2368	osk.exe
2368	osk.exe
2368	osk.exe
2368	osk.exe
2368	osk.exe
2368	osk.exe
2368	osk.exe
2368	osk.exe
2368	osk.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4428 wrote to memory of 4460	4428	chrome.exe	102
PID 4428 wrote to memory of 3884	4428	chrome.exe	103
PID 4428 wrote to memory of 3884	4428	chrome.exe	103
PID 4428 wrote to memory of 4972	4428	chrome.exe	104
PID 4428 wrote to memory of 2744	4428	chrome.exe	105
PID 4428 wrote to memory of 2744	4428	chrome.exe	105
PID 4428 wrote to memory of 4200	4428	chrome.exe	107
PID 4428 wrote to memory of 4200	4428	chrome.exe	107
PID 4428 wrote to memory of 1604	4428	chrome.exe	108
PID 4428 wrote to memory of 1604	4428	chrome.exe	108
PID 4428 wrote to memory of 4532	4428	chrome.exe	109
PID 4428 wrote to memory of 4532	4428	chrome.exe	109
PID 4428 wrote to memory of 2604	4428	chrome.exe	110
PID 4428 wrote to memory of 2604	4428	chrome.exe	110
PID 4428 wrote to memory of 4212	4428	chrome.exe	111
PID 4428 wrote to memory of 1548	4428	chrome.exe	112
PID 4428 wrote to memory of 1548	4428	chrome.exe	112
PID 4428 wrote to memory of 4868	4428	chrome.exe	114
PID 4428 wrote to memory of 4868	4428	chrome.exe	114
PID 4428 wrote to memory of 808	4428	chrome.exe	115
PID 4428 wrote to memory of 808	4428	chrome.exe	115
PID 4428 wrote to memory of 1108	4428	chrome.exe	116
PID 4428 wrote to memory of 1872	4428	chrome.exe	117
PID 4428 wrote to memory of 1108	4428	chrome.exe	116
PID 4428 wrote to memory of 1872	4428	chrome.exe	117
PID 4428 wrote to memory of 5204	4428	chrome.exe	126
PID 4428 wrote to memory of 5212	4428	chrome.exe	127
PID 4428 wrote to memory of 5224	4428	chrome.exe	128
PID 4428 wrote to memory of 5160	4428	chrome.exe	130
PID 4428 wrote to memory of 5160	4428	chrome.exe	130
PID 4428 wrote to memory of 5900	4428	chrome.exe	132
PID 4428 wrote to memory of 5900	4428	chrome.exe	132
PID 4428 wrote to memory of 5884	4428	chrome.exe	133
PID 4428 wrote to memory of 5884	4428	chrome.exe	133
PID 4428 wrote to memory of 1792	4428	chrome.exe	142
PID 4428 wrote to memory of 5656	4428	chrome.exe	143
PID 4428 wrote to memory of 5656	4428	chrome.exe	143
PID 2576 wrote to memory of 1824	2576	msedge.exe	156
PID 1824 wrote to memory of 2036	1824	msedge.exe	157
PID 1824 wrote to memory of 6136	1824	msedge.exe	158
PID 1824 wrote to memory of 5724	1824	msedge.exe	159
PID 1824 wrote to memory of 5724	1824	msedge.exe	159
PID 1824 wrote to memory of 5724	1824	msedge.exe	159
PID 1824 wrote to memory of 5464	1824	msedge.exe	160
PID 1824 wrote to memory of 5464	1824	msedge.exe	160
PID 1824 wrote to memory of 1544	1824	msedge.exe	161
PID 1824 wrote to memory of 1544	1824	msedge.exe	161
PID 1824 wrote to memory of 1544	1824	msedge.exe	161
PID 5396 wrote to memory of 2368	5396	ATBroker.exe	171
PID 4428 wrote to memory of 5552	4428	chrome.exe	173
PID 4428 wrote to memory of 5552	4428	chrome.exe	173
PID 4428 wrote to memory of 1820	4428	chrome.exe	174
PID 4428 wrote to memory of 1820	4428	chrome.exe	174
PID 4428 wrote to memory of 1852	4428	chrome.exe	175
PID 4428 wrote to memory of 1852	4428	chrome.exe	175
PID 4428 wrote to memory of 5852	4428	chrome.exe	176
PID 4428 wrote to memory of 5852	4428	chrome.exe	176
PID 4428 wrote to memory of 4476	4428	chrome.exe	177
PID 4428 wrote to memory of 4476	4428	chrome.exe	177
PID 4428 wrote to memory of 4592	4428	chrome.exe	178
PID 4428 wrote to memory of 4592	4428	chrome.exe	178
PID 4428 wrote to memory of 1888	4428	chrome.exe	179
PID 4428 wrote to memory of 1888	4428	chrome.exe	179
PID 4428 wrote to memory of 5880	4428	chrome.exe	180

C:\Users\Admin\AppData\Local\Temp\ava.exe
"C:\Users\Admin\AppData\Local\Temp\ava.exe"
1⤵
PID:2396

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffad334c728,0x7ffad334c734,0x7ffad334c740
  2⤵
  PID:4460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1692,i,12665257388672886243,17182080490921541710,262144 --field-trial-handle=1972,i,17463960008878087434,13515030626031080849,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1936 /prefetch:2
  2⤵
  PID:3884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,767991092298817758,10793743587325289260,524288 --field-trial-handle=1972,i,17463960008878087434,13515030626031080849,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2416,i,4682094478801053668,17983479023621724582,524288 --field-trial-handle=1972,i,17463960008878087434,13515030626031080849,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2584 /prefetch:8
  2⤵
  PID:2744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3248,i,18132502000486170040,14080539596474299817,2097152 --field-trial-handle=1972,i,17463960008878087434,13515030626031080849,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:4200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3264,i,17257864871921421053,7431079149392970556,2097152 --field-trial-handle=1972,i,17463960008878087434,13515030626031080849,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:1604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4572,i,866736898326243911,9177388067301343471,524288 --field-trial-handle=1972,i,17463960008878087434,13515030626031080849,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4452 /prefetch:8
  2⤵
  PID:4532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4708,i,16622799417358075158,7429603757508499044,2097152 --field-trial-handle=1972,i,17463960008878087434,13515030626031080849,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:2604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5344,i,6521436879989142724,1960766548039595349,524288 --field-trial-handle=1972,i,17463960008878087434,13515030626031080849,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  PID:4212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5436,i,15723508929940384153,1957074922531548591,524288 --field-trial-handle=1972,i,17463960008878087434,13515030626031080849,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5444 /prefetch:8
  2⤵
  PID:1548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5352,i,11696809037499179918,2733600978963045851,524288 --field-trial-handle=1972,i,17463960008878087434,13515030626031080849,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5400 /prefetch:8
  2⤵
  PID:4868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5752,i,12834755099976237036,6336443386101916802,524288 --field-trial-handle=1972,i,17463960008878087434,13515030626031080849,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5564 /prefetch:8
  2⤵
  PID:808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5492,i,10329338978896529039,11406715409962788950,2097152 --field-trial-handle=1972,i,17463960008878087434,13515030626031080849,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:1108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5792,i,18030151860396292974,2958677651687158159,2097152 --field-trial-handle=1972,i,17463960008878087434,13515030626031080849,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5812 /prefetch:2
  2⤵
  PID:1872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=240,i,12054838418048279260,7820898708207697829,524288 --field-trial-handle=1972,i,17463960008878087434,13515030626031080849,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5456 /prefetch:8
  2⤵
  PID:5204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4812,i,6598241315094876365,17874479264598034238,524288 --field-trial-handle=1972,i,17463960008878087434,13515030626031080849,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5576 /prefetch:8
  2⤵
  PID:5212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5536,i,763036800986028719,7379389547064078990,524288 --field-trial-handle=1972,i,17463960008878087434,13515030626031080849,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  PID:5224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=4700,i,14837006317923448831,1041036782997447891,2097152 --field-trial-handle=1972,i,17463960008878087434,13515030626031080849,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:5160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=3240,i,3473166772699417491,16504390671175962089,2097152 --field-trial-handle=1972,i,17463960008878087434,13515030626031080849,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6092 /prefetch:1
  2⤵
  PID:5900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=3468,i,2507170033024460170,15717101650301535567,2097152 --field-trial-handle=1972,i,17463960008878087434,13515030626031080849,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6044 /prefetch:1
  2⤵
  PID:5884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5704,i,1192456894236734599,3009309616229866372,262144 --field-trial-handle=1972,i,17463960008878087434,13515030626031080849,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5692 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4128,i,3817864734998471469,12995731364107892240,524288 --field-trial-handle=1972,i,17463960008878087434,13515030626031080849,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  PID:5656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6120,i,395128097229160482,14739301687719987675,2097152 --field-trial-handle=1972,i,17463960008878087434,13515030626031080849,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6160 /prefetch:1
  2⤵
  PID:5552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=3296,i,10636690977511634087,96214529683586694,2097152 --field-trial-handle=1972,i,17463960008878087434,13515030626031080849,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5980 /prefetch:1
  2⤵
  PID:1820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6328,i,8285306151443645192,16220989206024643406,2097152 --field-trial-handle=1972,i,17463960008878087434,13515030626031080849,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6080 /prefetch:1
  2⤵
  PID:1852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=5940,i,10056817580560495430,15330227288506012129,2097152 --field-trial-handle=1972,i,17463960008878087434,13515030626031080849,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6372 /prefetch:1
  2⤵
  PID:5852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=3088,i,18403202411399856188,2742419582488306233,2097152 --field-trial-handle=1972,i,17463960008878087434,13515030626031080849,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6304 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=3480,i,2854628488397550073,9756853813998826295,2097152 --field-trial-handle=1972,i,17463960008878087434,13515030626031080849,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6564 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=3296,i,11894405922178384469,13946554187419791673,2097152 --field-trial-handle=1972,i,17463960008878087434,13515030626031080849,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6700 /prefetch:1
  2⤵
  PID:1888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=6708,i,791333319818256974,10025489148242650956,2097152 --field-trial-handle=1972,i,17463960008878087434,13515030626031080849,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5980 /prefetch:1
  2⤵
  PID:5880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=6992,i,4888325152643250373,806884419942829041,2097152 --field-trial-handle=1972,i,17463960008878087434,13515030626031080849,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6984 /prefetch:1
  2⤵
  PID:1048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=7120,i,13906593863396986243,1692533342192692914,2097152 --field-trial-handle=1972,i,17463960008878087434,13515030626031080849,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7116 /prefetch:1
  2⤵
  PID:5588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=5756,i,5633214880468037060,6153238588383406431,2097152 --field-trial-handle=1972,i,17463960008878087434,13515030626031080849,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7296 /prefetch:1
  2⤵
  PID:3220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=6920,i,1071663426393465001,9562927862076251792,2097152 --field-trial-handle=1972,i,17463960008878087434,13515030626031080849,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6928 /prefetch:1
  2⤵
  PID:1684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7124,i,10735514150046533484,17806234030756674576,524288 --field-trial-handle=1972,i,17463960008878087434,13515030626031080849,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7112 /prefetch:8
  2⤵
  PID:5652
- C:\Users\Admin\Downloads\ava.exe
  "C:\Users\Admin\Downloads\ava.exe"
  2⤵
  - Executes dropped EXE
  PID:6088

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3928

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault612eb1fdh0997h470chb7f4hb518fb23ec09
1⤵
- Suspicious use of WriteProcessMemory
PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault612eb1fdh0997h470chb7f4hb518fb23ec09 --edge-skip-compat-layer-relaunch
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:1824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x25c,0x7fface13c188,0x7fface13c194,0x7fface13c1a0
    3⤵
    PID:2036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1924,i,4303430682475925500,2893663125973998584,524288 --field-trial-handle=1780,i,18185842735875235916,8333875299836695341,262144 --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:3
    3⤵
    - System Time Discovery
    PID:6136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,16995984064428004588,7123663111082766074,262144 --field-trial-handle=1780,i,18185842735875235916,8333875299836695341,262144 --variations-seed-version --mojo-platform-channel-handle=1776 /prefetch:2
    3⤵
    PID:5724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2556,i,4572197660338153940,22828339594761329,524288 --field-trial-handle=1780,i,18185842735875235916,8333875299836695341,262144 --variations-seed-version --mojo-platform-channel-handle=2692 /prefetch:8
    3⤵
    PID:5464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --no-pre-read-main-dll --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3108,i,13388042001436629517,14507851901305243783,2097152 --field-trial-handle=1780,i,18185842735875235916,8333875299836695341,262144 --variations-seed-version --mojo-platform-channel-handle=2968 /prefetch:2
    3⤵
    PID:1544

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4944

C:\Windows\System32\SystemSettingsBroker.exe
C:\Windows\System32\SystemSettingsBroker.exe -Embedding
1⤵
PID:4028

C:\Windows\System32\ATBroker.exe
C:\Windows\System32\ATBroker.exe /start osk
1⤵
- Suspicious use of WriteProcessMemory
PID:5396
- C:\Windows\System32\osk.exe
  "C:\Windows\System32\osk.exe"
  2⤵
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:2368

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4a8 0x470
1⤵
PID:4760

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5876

C:\Users\Admin\Desktop\ava.exe
"C:\Users\Admin\Desktop\ava.exe"
1⤵
- Executes dropped EXE
PID:3328

C:\Users\Admin\Desktop\ava.exe
"C:\Users\Admin\Desktop\ava.exe"
1⤵
- Executes dropped EXE
PID:1984

C:\Users\Admin\Desktop\ava.exe
"C:\Users\Admin\Desktop\ava.exe"
1⤵
- Executes dropped EXE
PID:2700

C:\Users\Admin\Desktop\ava.exe
"C:\Users\Admin\Desktop\ava.exe"
1⤵
- Executes dropped EXE
PID:5304

C:\Users\Admin\Desktop\ava.exe
"C:\Users\Admin\Desktop\ava.exe"
1⤵
- Executes dropped EXE
PID:4580

C:\Users\Admin\Desktop\ava.exe
"C:\Users\Admin\Desktop\ava.exe"
1⤵
- Executes dropped EXE
PID:3840

C:\Users\Admin\Desktop\ava.exe
"C:\Users\Admin\Desktop\ava.exe"
1⤵
- Executes dropped EXE
PID:1344

C:\Users\Admin\Desktop\ava.exe
"C:\Users\Admin\Desktop\ava.exe"
1⤵
- Executes dropped EXE
PID:3288

C:\Users\Admin\Desktop\ava.exe
"C:\Users\Admin\Desktop\ava.exe"
1⤵
- Executes dropped EXE
PID:4700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

59d88b90-8657-4436-a60e-308793fc42cf.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\59d88b90-8657-4436-a60e-308793fc42cf.tmp
Size 265KB
SHA256 c6f85e2ef7f4ccd4acb49d4f820e46734a78b36025ec38a2908b0ac0a6b462bd
MD5 73eca23946e69f16a7c23b1a1cd42a92
SHA1 225bfb0a8617722841e8279d595be61e62b02651
SHA512 624a3eb0656f81af21d8188b922b87595b8d36df9f9e8c53f6c3c8f99f72e9d56cf1041c43544452c099b756a561e36a02ecc26c07306ad1e0a997d2ddfacacb
SSDEEP 6144:EVtQxlKwIKw3Kl8niyhpMWdJKAQ71xlq+fWLWv+hFD+7t56OD9ZfSApprV:EVteKwLPlUFWWdJrQRbqZ8yFSXD9ZfSI
TLSH
T1BA4412B2BAE2CD778DBD2141B1527320DCB2ECDD459D6806889A5BCBD19F18C07E3C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

62d37c0d-d3bf-4c07-880d-2bc0faa16284.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\62d37c0d-d3bf-4c07-880d-2bc0faa16284.tmp
Size 265KB
SHA256 3b02e84c28cee48e27f1e4f9b76f63f9e25867547a49bace74284ac6e7610c46
MD5 f06a9356629e49479b6e827eebec3915
SHA1 1194ebb7ad66290bcd86bc7da6766f1a34ad57bc
SHA512 46eabc665114c39c74d72ac2a32c05dfa5943cb3ff4cc1e2b4c575bf81ba5a521c70ef9e654b854f429fcf3da9260bbab703ac7c8510c0faa14084146d8a8ed1
SSDEEP 6144:EVoQxlKwIKw3Kl8niyhpMWdJKAQ71xlq+fWLWv+hFD+7t56OD9ZfSApprV:EVoeKwLPlUFWWdJrQRbqZ8yFSXD9ZfSI
TLSH
T1874412B2B9E2CD778DBD2141B1527320DCB2ECDD459D6906889A5BCBD19F18C07E3C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

74164143-7c9c-41e1-bb37-5fd3843094d2.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\74164143-7c9c-41e1-bb37-5fd3843094d2.tmp
Size 264KB
SHA256 ff463bc6cb0048ec1a0f53cc8626af776e88e867ad0fe253108764d81d7200e7
MD5 70a8ba7fbf09fa15024b1030b5d1267b
SHA1 6b026b27a1e6854dbcc5bec9371f309b1a4616a2
SHA512 0534dd10eeb6dadc639769e97706e3e041ba2071d5759917644b35ad9399befa404adc0b0edce9594fa7f68bf931fec00a7b0427fcd4e65766e8eec3e958401b
SSDEEP 6144:8VqHlKwIKw3Kl8niyhpMWdJKAQ71xlq+fWLWv+hFD+7t56OD9ZfSApprV:8VqFKwLPlUFWWdJrQRbqZ8yFSXD9ZfSI
TLSH
T1184412B3BAE2CD778EBD2141A1567320DC72ECDC41DD2806449A5BCBD19F59907E2C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8c1511a5-3ed1-4675-8c72-5df8c93d0700.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\8c1511a5-3ed1-4675-8c72-5df8c93d0700.tmp
Size 265KB
SHA256 d0e01f90f2a47ab2349796e59e86594105ba58bc73ff4d33cc60ed19ea9cb8dc
MD5 893c9370889c9d3b9ed918f7deeb0afb
SHA1 23d8039ac4d4712b15b2e4fa494eb17a95e5ced0
SHA512 a310887727fb774f60c31c7b1f2c60e530eddc697e149c7e2e143b18164266a9a788bf619a7e0dc10a551f081a5409e1b2830b4144fb75e00e65de0e54b6832d
SSDEEP 6144:8VtQxlKwIKw3Kl8niyhpMWdJKAQ71xlq+fWLWv+hFD+7t56OD9ZfSApprV:8VteKwLPlUFWWdJrQRbqZ8yFSXD9ZfSI
TLSH
T16D4412B2BAE2CD778DBD2141B1527320DCB2ECDD519D6906889A5BCBD19F18C07E3C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 a6249f26f37b42a8aab1c42bcd8d2d1ed0465e9642dfcd70d03e3935cdfab2ce
MD5 6ac2bdb5618eb33217283a8c2a2bbea7
SHA1 929bbd0ea4faacadcd10729d56f75f85718fe818
SHA512 210db67eaa7e247fa4c61bc2e2b4275f8573062e567be16ef70acddac71222e128e021da8a6e8867a5b5f1507c9fa736ffd85aef609528eb4c496e58ccdf5830
MD5 SHA1 SHA512

Submit Download

4762d5b0-2da9-4028-86dc-2ea2c9a4933c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\4762d5b0-2da9-4028-86dc-2ea2c9a4933c.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

6a302be0-6723-4771-a2bb-313aca057583.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\6a302be0-6723-4771-a2bb-313aca057583.tmp
Size 12KB
SHA256 961e7ba070c633b7239396106efdfa73b649c538e3d0d8dfc6c1b4ee052cae5a
MD5 0c6398acac475058d094fc4c719d2e9f
SHA1 b746b60e76e585c1e8a222a3ec4015f4b5bcdcc5
SHA512 ab3dee7f0a142302efb4423fa8c35e046a3a31a88ea92415f602ce7fbdef094b1d7e09f741acac978ad1d90950a5082d688f0166664ce4d62b5c0fedcb90a2f1
SSDEEP 192:7R3wcTDhpv71EAPRp2Z9IHsb+WNn5BlQZSiEkwAWEVyIsnAUgE:7R3wcT9p5VX62wflQZggnE
TLSH
T15542C46DAD10353B5CDBD62AF921BB93D7F5102621983E84E6FC893C24EB9CD2227443
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

72d2dc06-b830-4d81-9d6b-0ea8c73fabc1.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\72d2dc06-b830-4d81-9d6b-0ea8c73fabc1.tmp
Size 11KB
SHA256 59a6eddde065c3ec39796a853ffc1bb3889f602f1569e15a24240f2685fd5c45
MD5 b20098d54990a1c2b8b25ebfbad69dde
SHA1 6a1cb6198ac00764fbfd17d9fe037db99d7ae27b
SHA512 d47c53dd1a4a5760c74e858a397d099093679179134cd06d0e8146d9ecea81a8bec286d786cb3e065e84c85764730581474a6d1caed1e0c6d500519abf7b7450
SSDEEP 192:7R3wcTDhkv71vAPRp2Z9IHsb+WNnKudzSiEkwAWyVyIsnAUge:7R3wcT9A56X62wbdzggBe
TLSH
T11232932DAD20793B5CDBD62AF921B753D7F5102261983E84EAF8893C14EB9CC2227447
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

90a3caaa-7bfc-406d-9882-60d26b0d137f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\90a3caaa-7bfc-406d-9882-60d26b0d137f.tmp
Size 13KB
SHA256 f3cab849e8f5390aa1694297f1c5d621c2920acf0e3e80d069d6dbd2c06dd6ce
MD5 158db226add150b39d0e850988b7bb2f
SHA1 bc7781ff588ec482c8e1e06f2548dd5877e3787b
SHA512 37b7d31d227b31ccf1908532ed8a025ed519d4b4d4e3e6304d5f8b610d8ee39d89666619ce92c6ebfeb6e4f7094dcbc1682c05023bd3d55be24ca0b05f875565
SSDEEP 192:IR3+cTDyhv71IQQPRpCI99IHsb+WNPlEBY1lLDxe82FISiEkwAWaVyIsnAUgE:IR3+cT2x5IZX/2wXj92FIgg7E
TLSH
T1FC52B65EAC107A7B5CDBD62AF921B753D3F5102661982E88E6FCC93C24EB5CD2217443
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9b0afc6f-9ab8-4d72-a65f-1ea7b922a9c3.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\9b0afc6f-9ab8-4d72-a65f-1ea7b922a9c3.tmp
Size 12KB
SHA256 e12ce117b091745e4d400c72916e54987b16fa980980e0167bfcfafcd7ec204d
MD5 37136fe195ecb28bd3b472c96a316dc2
SHA1 a6291109d2bbd415f248cf8927167de22a74a784
SHA512 d40859407caf0cbacf5d60145ab9336770ca45aa56c6785932fb944095be7e8b3b0f75f3dbd719000819724ef9dd653d5b9c8a4b720954a7f348f4b0bdd1045c
SSDEEP 192:7R3/cTDhpv71EAPRp2Z9IHsb+WNn5BlQZSiEkwAWEVyIsnAUgE:7R3/cT9p5VX62wflQZggnE
TLSH
T18E42C46DAD10353B5CDBD62AF921BB93D7F5102621983E84E6FC893C24EB9CD2227443
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000005

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005
Size 73KB
SHA256 f3da3acb05ffefdc9ae669d4d171476ad2d7f4aefefa8fa9e0245a7a3b5ac2dd
MD5 9a896a1d99d04ee0f3fd1b7983fdf1b7
SHA1 a8e793d6fcdf858eceb9f42a9f75665d6a92abc0
SHA512 227c7027b7c944a7472f41c28056bad40b0d3116a3ea88fd350cd9f3c1a44f36d475ae8fee82b558619be48bf78982da14e87617a7a4e7a2241b94ab8272ef8a
SSDEEP 1536:O77BHwf0DFsAQtr1cHixbkJJqPrfkqrFDMllDv4nhz7y4vj:O779wTAwr1wGYJJkfDMXAnhny4b
TLSH
T1887302F82C92C0851875371B2FCEEC37990BBCE11295CE64368DF065D6B7A1B8E16D68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 1KB
SHA256 183097a672db2abc1b50232085842b3f884ee15d4cf65dd9171b386a5667e0f8
MD5 ac8892cfe00200d21b3bd17806be3835
SHA1 4a36919c7812572859d0e242118379f0cee1e79b
SHA512 e473e7b8902b8bbe015dd62a6ea484b4e9d6b5ad934c00ba99ae8cf4617a42c0bd1a84a0412193c6cfa81d486898ebef3112a3a349aa5814f2488bebda5bcdfd
TLSH
T147318639A0903D91DF1E3A360D8B2C042370B29FC03B0F3A84D49260BEAFAD96200E5D
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

12d2cb65-e162-46d3-8c6f-5217fbcafa5b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\12d2cb65-e162-46d3-8c6f-5217fbcafa5b.tmp
Size 3KB
SHA256 07710314c7fba75852d8dec33a604480e2b534ef14343b2bbb93217fe762d254
MD5 845830a42aef3155160c17c190a43e3c
SHA1 bd8db0cf1701f4ca224134eae66c4be4ac9e7fad
SHA512 795917f4769cedb1640f2fcd442b736d30d474f14fde7c32f22bf3d0fb299207a18ec6cf5a2ce71e8abd31e78764223f0c520974f74a3261f5809ae0c73181f7
TLSH
T197517CB7D3D8866DC85156E49A216A1FCD3E0A28521C3C26CCD9AE5B53E28B2D35138E
MD5 SHA1 SHA512 TLSH

Submit Download

298b69a5-1ad3-4ddc-8366-9cd07cf71e26.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\298b69a5-1ad3-4ddc-8366-9cd07cf71e26.tmp
Size 3KB
SHA256 c9569c18a057c121348b48322a2c88289736043b63a11d73fcb8d6bf5497fe94
MD5 24cff85b8cde2ba6a9c40949f350d529
SHA1 0936d9d279dba7d3c23317b1a6ae6d655221f238
SHA512 63ed2acb7d152b78dd26cc2c0ee0691ed8cce3ac8836b17d8735b705480c1ec9983263691628839b4dc1b3445bdb6deac3b08415609f9a76bb306f2cbea2dbce
TLSH
T149619BB7D3D8866EC81156E49B216E1FDD3D0A28522C3C26CDD8AE4B53E2872D35038E
MD5 SHA1 SHA512 TLSH

Submit Download

8812c537-c0ba-4d75-9b89-b2a5adbe8324.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\8812c537-c0ba-4d75-9b89-b2a5adbe8324.tmp
Size 3KB
SHA256 447094986a242b6e012e009ce8879961f4188d567f6874aa735b3ef5483c24c0
MD5 31433b8ecbaaa2e041ef56d96d14270f
SHA1 79fc9995390f0b0297f763dab8c4c2bdedab4f89
SHA512 fa2535132239299fcc8168d570d41daf881d8a81754f0aaf4e7c29fd006dc54a81775f3db8f3060df39281181758f3d1024a1ee84468b8988c67c70e888a7592
TLSH
T15A718B93E57EB837203D4DAB1D15B8095DBBB831614694F4EF5B822C70C89F32B93616
MD5 SHA1 SHA512 TLSH

Submit Download

b4a1abcf-43df-4707-b1f6-e28da97710a9.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\b4a1abcf-43df-4707-b1f6-e28da97710a9.tmp
Size 25KB
SHA256 0a4505a3a679b7f2eb2ab5a95733a4da0d414fcb097c346acd43296d395f9845
MD5 1b0a59fbc28bdbebfdb4cbf0c4a095e9
SHA1 0fa35242531f4cf0a0729d0ee206b51c2232e190
SHA512 4936017d494517a4126355e489c5134ccae9de1c76fe77413820eb6ef2b2fd7ee3ff5f27d4dc4225b0db78e749e7c7d0a9f82089639141a1d27096b9e72bc249
SSDEEP 384:DOkh1wldTWSCGPBMeecejb4N6vEKe35VFMJ7Jf8QceaNEd7mdfSY4NJ4VYmS/RYY:BRxTs+CtIQzJ8bC6DW3Wzx
TLSH
T172C2BCF793D5D62E880157F896146E1BCF1D0A19432C3C2688D5EE4BE3E2472E29A74F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b5f5a7a6-0b69-4c7c-9c5a-350b42d8eac7.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\b5f5a7a6-0b69-4c7c-9c5a-350b42d8eac7.tmp
Size 3KB
SHA256 d37704f7c823dd5c57b1f6d88a6efd6c77bbb5deb11ab7a1a8703a083b1f6733
MD5 92aa327865644c5b043360f898b614ba
SHA1 6a95234eb4b830ab44b9f600dca1b568bfc93f77
SHA512 651fd68850c9bfe25f771bec34cc246f11c98d1ef83500717abb982f2c13e99f44996a42e524130d0d4a6c3f88541390d4429642baa5bf6dbc132fd4bf6f0c1b
TLSH
T144719BB7D3D88A6DC81156F49A256E1ECD3D0A28522C3C26CDD9AE4B53E2872D35138E
MD5 SHA1 SHA512 TLSH

Submit Download

c84a429b-e2f9-4abd-9c71-355b306029a4.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\c84a429b-e2f9-4abd-9c71-355b306029a4.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

d7a44907-3f94-4b74-88a6-a3cf512136ab.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\d7a44907-3f94-4b74-88a6-a3cf512136ab.tmp
Size 2KB
SHA256 2fa149a53f1388195cc2a85fe6310fbd04935cb8131afb168687d0c502a152f1
MD5 ec1cb2a1d51f9c8da7146ec86d8324ba
SHA1 b6adf86ed2aa85cb01cdb2f53abacf64a20dab35
SHA512 6c7b55ed90e8b96286ac672ac2607d984827c75bd83ca633e22d166d5e3aa4ba757a979021ab9bc307d0f6f56567cfc016ece63e67e89c88c96d402fc7918ff7
TLSH
T1FE519CB793D4CA6DC81166E4DA21AE1FDD3D0A24122C3C62CDD4AE5B43E25B3D21138E
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\temp-index
Size 72B
SHA256 b3f5ae76b353fa01b22fd6f4e57aa89fce68e3fe3e860ed903dacee93cb69a21
MD5 02e95af6ac9df253e00312e6c3f3250c
SHA1 e1623685337b271027e2172952f75e87787fc59e
SHA512 93fcd29d7f248538a546fabd058abb996f38a92d2c4421176b2b45a31380ca7b72f7f07c16d3c5bd12d0f5c00cd7e1ff3fceee27e620a4f2927143e1ec1ddbf0
TLSH
T185A00224219C5486D10002795DC5858232607D205B01160271D40B46FC785489502501
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\temp-index
Size 72B
SHA256 c1521061b42c5b2f17ba90f3bc6be5020a8a88a42b415f22d137e2b54a8ecad1
MD5 817c54592419d4fa5537fbdd573aaac1
SHA1 0fd46f426cae9b9aa125804b30c78ebc4370dfe7
SHA512 f0f27a3cccdc9ca24bc83ddd0e3c7ce010195cc5c964419a6a71ecedb11228e18f1f8ab4991f6234c6cfdbaf92d4c535ee01e16970c127c58e32a157dde793f1
TLSH
T141A0023492C00465CDD446746861099163616919ED9187D359D28848BCAB1C94A02E58
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm\index-dir\temp-index
Size 48B
SHA256 da05e36af8fb4b93be0c58c908b28491ad8b097ee9ec10a506c94d31b0e1a454
MD5 60745fa66135a0130a60d98f5ff20561
SHA1 b82a827cd4677abacdf9203deb2e03e8018e9845
SHA512 f30a94c82caf8ebaa267a5b4461586775ae5375c69b429b62de020b505cbb04ed35c0e4eec95944852bd96bae63afb834b4f9c380d1ad22096893abf0c8ef94e
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnWebGPUCache\index
Size 256KB
SHA256 3138be1517f8b353d926219ebf68887898a29dbdac042db0f47170a12ba8db6d
MD5 269d131e01ab055b97920ecf08eb090e
SHA1 7f8b9233e8c97fa0fa641fc78d9488aa4f87ba3c
SHA512 86c94a56c20834b21e8a83f4bc280baa58fada3e0c008222fe133bd99944af411937740ba2f42f8e7db5c6df664aaf909a66e5a93984ecbc1826d44d9a2e0588
SSDEEP 3:LstlNllkll/lUm9:LsX3lEtUm
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

e511b1e1-ce2e-45dd-895a-17fac53ddfe9.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\e511b1e1-ce2e-45dd-895a-17fac53ddfe9.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

a73fad7d-2756-4623-a44d-281c9355688d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\a73fad7d-2756-4623-a44d-281c9355688d.tmp
Size 649B
SHA256 358da3e0d6938db73d2e5c51a5d94bfbba8ad17757f73cccf26f365c3f564604
MD5 fd1a2665a1bf8b18536a46daa7b751cf
SHA1 b3b9825e1a2196d40b0fff058b5bd1cb4ff0e480
SHA512 76fe5d047ba2672f5e7940836d87b7a848c3db783b1764e42c62d67c791a07d162d9cde9da6ab60197441a97a1a6fce6aac1eb5dc320b5d915587205da5e404b
TLSH
T19FF044B5CC20EC2B28FC4B1920A49747FB80135B2781894F3A3C810D8FB567B8A9685C
MD5 SHA1 SHA512 TLSH

Submit Download

a77e4a82-de55-434a-ad24-e2f676807159.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\a77e4a82-de55-434a-ad24-e2f676807159.tmp
Size 14KB
SHA256 8c35605bf51f59b825ce941de8dea0ff6da41d4dcb3044af80b9b5f61e62e6d4
MD5 fe8866e59b6b67dffdba05e1fd4ad96b
SHA1 d356f844da8b119ac1ce723d5d4db47281af55a4
SHA512 3706fcde2fe7577400c1713392f0132bcf6fc82a419d1d4517bc315776b1e6b4192e372618a4959d3df01e5ee02fdc55d2601b86a7412cad67b2a030b4df11f4
SSDEEP 192:IR3Wc9wysv71IQQPRpC51Y+yd9IHsb+WNmjfJlEBY1lLDxe82FISiEkwAWaVyIsv:IR3Wc9P45IZX12wuj92FIgg7E
TLSH
T18F62D85AAC103A7B5CDBD62AF921B757D3F5102661992E88E6FCC83C24E76CE3217443
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ac30f416-0b65-4b21-8328-0af4b61319eb.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\ac30f416-0b65-4b21-8328-0af4b61319eb.tmp
Size 12KB
SHA256 8f6e7b1b4f9a9ebf365d77e08f3f92a2e2e19b59055f68a3bdcc4f70edf35d2a
MD5 68c6c8ed8879d359a3ee1bc00667253c
SHA1 b6018588831ff1dcb30d1799733661da05afe6ee
SHA512 82f51c42bbbaf0a5018c09efbce0688739893094ceb52becab5bc31dfa186a888b37eb7419d458583db0c35fe8e73f22c10e58429fd32465fafde1aab8b1a400
SSDEEP 192:IR3wcTDhpv71IQQPRpCZ9IHsb+WNPlEBY1J9ytISiEkwAWaVyIsnAUgE:IR3wcT9p5IZXW2wXNytIgg7E
TLSH
T1F742B51DAD10397B5CDBC62AF921BB93D7F5102261982E88E6FCC93C24EB5CD2617043
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b2d404b9-0c57-43ec-bb57-8bc695dd6a27.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\b2d404b9-0c57-43ec-bb57-8bc695dd6a27.tmp
Size 12KB
SHA256 07e0ce6c7c043e4c16cf5ffec8883b296b29a1ee2d6bb9f30609979f25cafe53
MD5 a84ceb8561ba8427f09638409e170cc7
SHA1 bcd25f619bf802d1a66fcfd3867e1a3338fd3614
SHA512 f3c2d6fba51641701a17001ec76565c26252a839577697f0ac9b06904441f6d896d57f57ba831869b7ffce725cebe750de25908446c45bccc072d32990615921
SSDEEP 192:7R3wcTDh+v71HAPRp2Z9IHsb+WNnKud/NSiEkwAWyVyIsnAUge:7R3wcT965CX62wbd/NggBe
TLSH
T12042A42DAD10353B5CDBD62AF921BA93D7F5102671983E88E6FC893C14EB9CD2227447
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b95c85a4-a25b-4f81-ad03-86902d3335c6.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\b95c85a4-a25b-4f81-ad03-86902d3335c6.tmp
Size 13KB
SHA256 97a5607d0bc52d3bb7ae0716b16333c4d6e98b9e2254e675ebff85b1b0418434
MD5 46e28f5ac563ab1aa31a79cdf100916b
SHA1 aabcce11b3a9304a7420a0a2d2727ed1f115126b
SHA512 355cfd603314ab6c90f05c6db89ed7de66c1d459cbccdd281b7128e1bfd49a3e6ce9689c9fd6f53255c038098d9d7601a5ef095278b6dd5d91b70580fa2450f8
SSDEEP 192:IR3+cTDFhv71IQQPRpC99IHsb+WNPlEBY1ty8whISiEkwAWaVyIsnAUgE:IR3+cTpx5IZXu2wX3whIgg7E
TLSH
T1AA52C61DAD107A7B5CDBD62AF921BB53D7F5102661982E88E6FC893C24EB5CD3217043
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d1096a1c-b1cc-40da-b8ed-f915551262ef.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\d1096a1c-b1cc-40da-b8ed-f915551262ef.tmp
Size 12KB
SHA256 c4519c3f6459eb48a9bfcc14bbb5cd4f7123af38efc62e9533191b34362e11b6
MD5 b45f6b2554e72de0fcf26a5a9910aa3e
SHA1 98eff563229fd50a76ceecfe112dda90be85f6d2
SHA512 7a0b3eb697f48190704c19c591c57b34b786a8566b5cfd07cfbe730d42c4763736d8c6601f4f901e5d925c6415c8e17b10bd37eaac7f820059f553a9e771e3ae
SSDEEP 192:IR3+cTDh/v71IQQPRpCZ9IHsb+WNPlEBY17TybISiEkwAWaVyIsnAUgE:IR3+cT9X5IZXW2wXJybIgg7E
TLSH
T16242B51DAD107A7B5CDBD62AF921BB93D7F5102261983E88E6FC893C24EB5CD2217047
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d50537bd-5bd5-42f3-ad80-7b04a588b937.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\d50537bd-5bd5-42f3-ad80-7b04a588b937.tmp
Size 13KB
SHA256 405fa7eeb080a2a9488a45fb88043c4bd1759aff8d4ace8f6e81973b659db357
MD5 28891b8f9318937922a74b3c0b849c72
SHA1 1376a47e5a87611f2cfe2db1632f10dfa4a24503
SHA512 2ac51450d88f6ae3868a310312a52782fc9425519d8b365b08b86567e8e1ac1dbe17c860868ebc7ebcff423fa4a656e6aebc0970db42864dda11a0c2f032e373
SSDEEP 384:c6jY/7KxkXqKf/pUZNCgVLH2HfgslcLXODYj+ErU331HGoVt7ShXB:cqY/7KxkXqKf/pUZNCgVLH2HfgsqTOEN
TLSH
T11052F927A84C9A3F0FD8CA4DDC16AF4FADF501566668492453FB9C18039A7CB114E2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f42e4425-cea3-420f-aa7f-e7aea49db699.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\f42e4425-cea3-420f-aa7f-e7aea49db699.tmp
Size 12KB
SHA256 e62e3ffc63a97f1f6e7097e00470a20fc1482c1f0628b82043538458266aa814
MD5 a64f9fdfde11619418c1f1679d77a5b1
SHA1 3ca811570a4b3aac203318f86386bd8b862b2696
SHA512 49099a9b58dcd0c91a85a6cd9ad42281d78eead35c1e1aabde83377714ca4fb25b5ea39435b271170d434f3ed25ffb9fe38c1f96dcd4b3805646e8f623b5bbf6
SSDEEP 192:IR3+cTDRkv71IQQPRpC99IHsb+WNPlEBY1Na8ZBISiEkwAWaVyIsnAUgE:IR3+cTNA5IZXu2wXLZBIgg7E
TLSH
T13852C65DAC103A7B5CDBC62AF921BB93D7F5102261983E88E6FC893C24EB5CD2217043
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f827bdcb-40c8-4bc2-8270-7b6fb1b75273.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\f827bdcb-40c8-4bc2-8270-7b6fb1b75273.tmp
Size 12KB
SHA256 68c2e534d146f3031aa2d3a180acd62e50db7a010ee3c1016341ba3f9c954f9a
MD5 5de55f5125f05bdf671f1bb89074bac5
SHA1 99238d61f521501e5c40d45f076a3b7429f120d4
SHA512 545ca3c2b59e7e75aa6dc9b6022d7ba5a5cf3868dcdf8a080e78a745a68967dcddd39d30cde8907bbcb58e0481d470cb41865f095eb7ac7431ab74fdf178ae6c
SSDEEP 192:IR3+cTDhpv71IQQPRpCZ9IHsb+WNPlEBY17TybISiEkwAWaVyIsnAUgE:IR3+cT9p5IZXW2wXJybIgg7E
TLSH
T15242B51DAD107A7B5CDBD62AF921BB93D7F5102261983E88E6FC893C24EB5CD2217047
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa5a8123-c64f-4361-a6f2-d7fec4f66d1e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\fa5a8123-c64f-4361-a6f2-d7fec4f66d1e.tmp
Size 12KB
SHA256 98d7d13068f3505c2ccae2780b8b2ac734c45cb1b46c9e5e6f9b570581fe1979
MD5 434494843e510cbc783c42f7bc13b691
SHA1 2c9c9b37c88c4427c8451fbe9b19002de1fffb4a
SHA512 7b8fedb8b5332e0b2aadb45f67bbfc653a79903b670cf07bdfa917060df7cd839f7a5442380ec0a6340647a4a69c06a11f6a4245113c4b799fcbbde8a76b9f73
SSDEEP 192:IR3+cTDhkv71IQQPRpCZ9IHsb+WNPlEBY17TybISiEkwAWaVyIsnAUgE:IR3+cT9A5IZXW2wXJybIgg7E
TLSH
T1CD42B51DAD107A7B5CDBC62AF921BB93D7F5102661983E88E6FC893C24EB5CD2217047
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdf503ee-8815-4ffc-b5c1-c170d5f11f41.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\fdf503ee-8815-4ffc-b5c1-c170d5f11f41.tmp
Size 14KB
SHA256 663f7f26140fc81acaea90a80bbe21632b42f94577511e75bb7953e4476e50b0
MD5 34777346b93e98752980072a2febb604
SHA1 3499bdcc1d1dc7c52eddaa066ddacddc3ed3a4dc
SHA512 d7204596d3b889a752a518dc84ae0e57d3b46a0c47267a6559de4256389c0845075bea18c2cb4bcc0512fffdeb8c2cd4ac2880161c4bebab17e2b6b58626faa4
SSDEEP 192:IR3Wc9Dysv71IQQPRpC51Y+yd9IHsb+WNmjfJlEBY1lLDxe82FISiEkwAWaVyIsv:IR3Wc9245IZX12wuj92FIgg7E
TLSH
T19B62C85AAC103A7B5CDBD62AF921B757D3F5102661992E88E6FCC83C24E76CE3217443
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bbf30eab-aebd-48b5-8309-b40842e819f5.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\bbf30eab-aebd-48b5-8309-b40842e819f5.tmp
Size 130KB
SHA256 5f4c3e59984f370e7ab989d82e4402254b2c6e1b47782adb56a6d0849aa96eac
MD5 139f44890a1a6d1f5783db576dce19ec
SHA1 9236abfe78426d466cb0a3f838b7120842260c5e
SHA512 7d042976402111fd861543eb31e8ee0868f10f7313bf22c9ffa4ec8826ffa04ed68e5a09baa387d57c15d85d4e517833f6c7a8bcc6f64ba02bf3b1d5559a57a1
SSDEEP 3072:d4L+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gr:d4L+hFD+7t56OD9ZfSApprr
TLSH
T117D31232AA91D8BBC9FC6541B157A304DE66ACED41DE7A09444A5F8EE09FC4C0773A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e30ac55d-38c0-4b27-973a-8638aa7a5afe.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\e30ac55d-38c0-4b27-973a-8638aa7a5afe.tmp
Size 264KB
SHA256 ecc063458e65dca7a154dd3ec3e0d4454fe77e2e8045730ac71f51ba15377fbb
MD5 47ec73c4e750a2e2f8f93b56fbdda026
SHA1 8501b530ab87595d43ed19d431b161ea329f5b1c
SHA512 24c6562b8d8aa71a462308732668e81c2e77c7043f8705966eee131f4aa7874dd9de509e6f1520d3fdae8fc256b2cb6041d573e1874e6ea9325c7b7bde69a630
SSDEEP 6144:3VqHlKwIKw3Kl8niyhpMWdJKAQ71xlq+fWLWv+hFD+7t56OD9ZfSApprV:3VqFKwLPlUFWWdJrQRbqZ8yFSXD9ZfSI
TLSH
T1124412B3BAE2CD778EBD2141A1567320DCB2ECDC41DD2806449A5BCBD19F19907E2C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e86e861c-7369-45bd-9e37-3192d251b914.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\e86e861c-7369-45bd-9e37-3192d251b914.tmp
Size 265KB
SHA256 bf947e6eed491bf6d9619162c0251cba7cd114de137ed29dbdf8af1d82689028
MD5 9f4c267457ca93455d8ec713a60a557a
SHA1 bef63178797421a235d2507e0286eb88608dd607
SHA512 e7b0b15edc6861030b491b352d6bcc1dfb8c0e20bbee6a60cc8c99fc519d975e63cf297ba66f82de0fad39ff0f21492ece8c34990c2dca4e2a73385abf23e436
SSDEEP 6144:EVKZQlKwIKw3Kl8niyhpMWdJKAQ71xlq+fWLWv+hFD+7t56OD9ZfSApprV:EVKUKwLPlUFWWdJrQRbqZ8yFSXD9ZfSI
TLSH
T1AD4412B2BAE2CD778DBD2141B1527320DCB2ECDD459D6906889A5BCBD19F18C07E3C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1488df91-d7b4-4e4f-b4a7-9e87e59cbf2a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1488df91-d7b4-4e4f-b4a7-9e87e59cbf2a.tmp
Size 9KB
SHA256 f4e9c8f858cbdd16ab6709594c2185484e9839372d10048cea5923b70db631b6
MD5 06e3ed72754b29246381cecb11837688
SHA1 8e6d6047daef6d1ff837f0960ea6df52924db575
SHA512 1137b85d79d8d20016fac45bbc57fe4d408d928bfee2f4cb939ec85ef8c61ef0f01876752330dc77410c113677df27d6b66c85b9628a398167c84e3064f84b11
SSDEEP 192:asNNC6IE1DQmiUy3CVTGzIGmz7EmxYBeUi27iOSrqkLUO:asNNC6D11kkGzIGmz73YpiO8UO
TLSH
T1F6120975D87CBC6B9EE3A908F4873A636E651177D9886F84E5D85B0C00D738C270B917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1be54b3b-31a6-40ae-9aac-9a67accaf616.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1be54b3b-31a6-40ae-9aac-9a67accaf616.tmp
Size 9KB
SHA256 0d5860ce0adf4f9a0ef996ea3914bf1cae0df6bb48c7475d8c325b5cceb03d55
MD5 e9788ee0b4a3ee8f2d15d5307c5e61fa
SHA1 482a43d697fa569b0f6dda7e85e24bcdbcc8a029
SHA512 752c009c510d81f57b99a8988fdcc637eb7cae28b21811fb2c5605161675498d39f88176c29893df14ee9ae9d2c6f078f13f75790d501f186fe15932e3a216c0
SSDEEP 192:asNNC6IE1DQmiUyaCVTGzIGmz7EmxYBeUi27iOSrqkLUO:asNNC6D11dkGzIGmz73YpiO8UO
TLSH
T160121975D8BCBC6B9EE3A908F4873A636E651177D9886F84E9D85B0C00D738C270B917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

65902826-912d-4c39-98ea-7dc0d92586d8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\65902826-912d-4c39-98ea-7dc0d92586d8.tmp
Size 8KB
SHA256 14aa0ee83bb64bb0be35ffab53ee6a56dc35702e4350bdc514640d8029182143
MD5 3b742db720379768fcb30bacad93d43b
SHA1 47046765fb4993049b5ea7a5cccf90c83a0004bd
SHA512 1f5c28ebc9ecd063f6ee451d51d616309d184d1690d9ad90241e48023456b55d1039b6f66a478237e8239a652c3c5baf9cdc9734a2954bb13a0ba28355b21ea4
SSDEEP 192:aON+6IE7QmiUy4VTPuIGmz7EmuC7sMWuU6:aON+6DtbPuIGmz7ZsQU6
TLSH
T1DA02F739AC7C7C6B9FF3AE49F4872A236EA5112BE5852FC4D9E41A0D00D725C1307922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e6cd13b34cf3f758c2f4e7c55e8801132cc91647c947cbafe475ce8928ff2c2f
MD5 b36cb034fe7df72fefb0bfa9340c6a6f
SHA1 8471623779cc15452b8cb60924e40c193607fe42
SHA512 6f72e14e09c254a1a7d581eaf85757baf7b4cd74f1e1978ecd80b20d91bc8f87462f9d782c3b0604a3b7c22e084b46d1afb4dd162a82905a3464ca87d8223542
TLSH
T1C6D024F477D14010F4713531007CC3C300045704105443303C33100C0C440C5D117D4C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a82246f88da27a43b1718bd24e8cdfa3c17ae97a8d238e7befd5fac9a384a0a9
MD5 89669bdc21a8230bc30fb1b7dd97b74a
SHA1 2a5e6b394e76cb0c70b0bba2c18c74bbdd1a4cf6
SHA512 0c8eb5310ea11fffab4f6974f3ba27683ef8dd0cc87e73007e67d163fd017b83b6c0025e8e6b07401acc6ea67dcf75918453237e2f7dcf47044e2050973484b7
TLSH
T1C3D022F8FBE28020F0B23A3200BCC3C30008AB0820A803303C33200C2C880CAE22BE8C
MD5 SHA1 SHA512 TLSH

Submit Download

eeb28a74-407e-4a05-9740-add3eda17a21.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\eeb28a74-407e-4a05-9740-add3eda17a21.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

1b21ce9f-316a-490e-a968-d26e20f14492.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\1b21ce9f-316a-490e-a968-d26e20f14492.tmp
Size 61B
SHA256 e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377
MD5 4df4574bfbb7e0b0bc56c2c9b12b6c47
SHA1 81efcbd3e3da8221444a21f45305af6fa4b71907
SHA512 78b14f60f2d80400fe50360cf303a961685396b7697775d078825a29b717081442d357c2039ad0984d4b622976b0314ede8f478cde320daec118da546cb0682a
TLSH
T139A00254944498FF4655836A05654463C7AA504780285E565B24115E42A25AD0450947
MD5 SHA1 SHA512 TLSH

Submit Download

eac7abad-c034-4ef6-ae44-f78381843392.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\eac7abad-c034-4ef6-ae44-f78381843392.tmp
Size 26KB
SHA256 0ab4de573e168429120d1f9dac8f256be52452c9af56716e0e7f30d0e43f2517
MD5 a09aca2699d070b3500b9047556b98b7
SHA1 e1daf389a949c76e85db4b00ec528821c0ac13ca
SHA512 54690fa12f4a3436a6619da52aff12c0c38597b8bd4e82e8159ef39961898364eea7311a54a3a08c62d67a5284382db9b7bd99aa8e333522bf581ce0f1cbc62d
SSDEEP 768:uyWPcLKWvKeEe8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjlLlACyNpro4+feVmRu:uyWPcLKWvKeEeu1jaClLiFNC4+WVmRu
TLSH
T12BC2EB2B644CCB7E4FC01A5DDC5A6FA77E9802C79A588D4047FE984C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ef16dc70-0c0c-4f05-95d5-1bc89dbe6e86.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ef16dc70-0c0c-4f05-95d5-1bc89dbe6e86.tmp
Size 7KB
SHA256 fa480d76af7d422b8ed62dc0f11ca3ac66136f22089a8d5723b6967498be2eb6
MD5 9a482d06dcb911e7ef583bd72e23ee7f
SHA1 3b556e1bb6b46cf913ca8dc1c208024a3c2f8022
SHA512 5dcc9b2aa35eef0693d08ae94edeffc753b70093eebe6cb664c19fa3215e18edefba9e870e1bcecf5b4c28eb28d0f8785b16d0a4e21db875b1335036c10be798
SSDEEP 96:sa2viEDWRLscSnb9s0jJdHWU6W6hfuH9EOx+WVoMfm+uecpYQj8W667bDwUhgNV1:sxvu5sowz5HW6+WNGYGxDxhgF
TLSH
T14CE1E852AE38697F4CC7E11DBA267B53D2F5503225D41A4CEAFCC66C089B6CD230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f1cf547e-f452-4b55-adb7-6f0d11610cf9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f1cf547e-f452-4b55-adb7-6f0d11610cf9.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c695b281-dc12-4e4e-b4de-ca5f5b8909d1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c695b281-dc12-4e4e-b4de-ca5f5b8909d1.tmp
Size 8KB
SHA256 0bacbc69576a19a2dd98bae54c08bd89b37627fe65fa59dc0cd024f0c758dfd7
MD5 dc8dd12c9dd8eaae46c6c9ae6c44eac8
SHA1 9e279e88c0407a9d115ee8d20d72fb0be92f9d1f
SHA512 20429200aca90ee946dca598165b9a69fb841cd6ba98da1114dad1c0a9d5b2e435088ef412b6dba288a891f53bac03aaabff93b7ad8a9836f7c10a00686fe82b
SSDEEP 192:aON76IEzQmiUyrCVTGuIGmz7EmxYBeUi27HKrqkLU6:aON76DlAkGuIGmz73YpHUU6
TLSH
T154121974A87CBC2B9EE3E904F4833A636E652277D9896F84E5E85B1C00DB34C170B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3c4cbd35-7035-4fc8-b353-96e3916ba1e3.tmp

Path C:\Users\Admin\AppData\Local\Temp\3c4cbd35-7035-4fc8-b353-96e3916ba1e3.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4428_961080408\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

7bee0f3d-de13-43cb-8acc-13295946b5cb.tmp

Path C:\Users\Admin\Downloads\7bee0f3d-de13-43cb-8acc-13295946b5cb.tmp
Size 3KB
SHA256 1d1a6fb760be9898be02c7e135b35e87e4fdd8da5b67af7e754244d2b0cb5c8e
MD5 8a4b0a9b867dd970128695404461b567
SHA1 b0f8ed8ed589bf1017062ff7904bf4f0147d52b6
SHA512 c5b2538f4fae851bcbb1053e52d88d324eda81c16c8dbc65bd2ff4cdf8064f7803aeda258fe047add378e4a17a30308c36f1f23e12cd6b6734720d703a0052d5
TLSH
T15271B61A94916471D07A527CC78F805E609B90385B037CE7C13F0A6B3E376DC26762B0
MD5 SHA1 SHA512 TLSH

Submit Download

Unconfirmed 66879.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 66879.crdownload
Size 256KB
SHA256 d7857b50d191ecb8377cee6cef27d68bbcdb948573bb4d485792109e1b7c2c95
MD5 4ceabe36b18e18762e668be759a1eecc
SHA1 8af8ef5c1ccde28921acf58c3c763d16f18e1e54
SHA512 4097a4a62081b2a952766e09897a9925b236e9938c118899cff22d2b550029fc6258645be3390b076bc295dfd05be3de5ba308c0bd1036d33ee6631c720c7869
SSDEEP 6144:HCEEggviW4dhdLlseHTtqBX8LgPIS8/5qXLkgRl71J8p8DIBDJTzJ5t:Hzqvqlah8LgQQLxmpd9tzvt
TLSH
T11944182DB6A81179C1A2D1B8CE0B5463CB7B740E0336AAF705E5D9629F225E0593FF70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ava.exe

Path C:\Users\Admin\Downloads\ava.exe
Size 2.4MB
SHA256 3e5efbc530923793421edd42430284048e220df64ec6e7240b1a7a44a61a2f5e
MD5 c1f82d06ff0d0152dc0090d41cb6e564
SHA1 7c9f0ec46b9ce4395f88014a47ea84903ee92ed2
SHA512 2291f996eaf97d6bb3bd4d9447f28cb57eb9dff7a2a9cb531b5f1284cc0479f75fb750cebf0c61cf648b1074d7ef24055b7d8585f9220968ed31dbd378c1c17f
SSDEEP 49152:Tpl07tmpd9tzvZoq8M+LLNEqM9sUT4g3r/66vsF/P4JxXovKR96Ix5nK2hMw:VjZoq2ENCb2ew
TLSH
T1A6C58C3A764460B8C076D178CA9B35D3EE7A38090F798AF3EED065158E671E05A7EF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download