3e5efbc530923793421edd42430284048e220df64ec6e7240b1a7a44a61a2f5e

Analysis

user interaction
yes
max time kernel
628s
max time network
630s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/10/2026, 22:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ava.exe
Size 2.4MB
Sample261003-17rtpsyamb
SHA256 3e5efbc530923793421edd42430284048e220df64ec6e7240b1a7a44a61a2f5e
MD5 c1f82d06ff0d0152dc0090d41cb6e564
SHA1 7c9f0ec46b9ce4395f88014a47ea84903ee92ed2
SHA512 2291f996eaf97d6bb3bd4d9447f28cb57eb9dff7a2a9cb531b5f1284cc0479f75fb750cebf0c61cf648b1074d7ef24055b7d8585f9220968ed31dbd378c1c17f
SSDEEP 49152:Tpl07tmpd9tzvZoq8M+LLNEqM9sUT4g3r/66vsF/P4JxXovKR96Ix5nK2hMw:VjZoq2ENCb2ew
TLSH
T1A6C58C3A764460B8C076D178CA9B35D3EE7A38090F798AF3EED065158E671E05A7EF40
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
170	2840	chrome.exe

Executes dropped EXE 22 IoCs

pid	Process
2292	ava.exe
5524	ava.exe
2836	ava.exe
4516	ava.exe
2292	ava.exe
1224	ava.exe
1396	ava.exe
4520	ava.exe
6112	ava.exe
4020	ava.exe
1860	ava.exe
5696	ava.exe
1916	ava.exe
2832	ava.exe
900	ava.exe
5468	ava.exe
2916	ava.exe
6232	ava.exe
6296	ava.exe
6364	ava.exe
6496	ava.exe
6408	ava.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\LogFiles\WMI\FaceTelManually.etl	svchost.exe
File opened for modification	C:\WINDOWS\SYSTEM32\WINBIODATABASE\51F39552-1075-4199-B513-0C10EA185DB0.DAT	svchost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6424	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2840	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe

Modifies registry class 7 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
208	chrome.exe
208	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 32 IoCs

pid	Process
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4476	chrome.exe
Token: SeCreatePagefilePrivilege	4476	chrome.exe
Token: SeShutdownPrivilege	4476	chrome.exe
Token: SeCreatePagefilePrivilege	4476	chrome.exe
Token: SeShutdownPrivilege	4476	chrome.exe
Token: SeCreatePagefilePrivilege	4476	chrome.exe
Token: SeShutdownPrivilege	4476	chrome.exe
Token: SeCreatePagefilePrivilege	4476	chrome.exe
Token: SeShutdownPrivilege	4476	chrome.exe
Token: SeCreatePagefilePrivilege	4476	chrome.exe
Token: SeShutdownPrivilege	4476	chrome.exe
Token: SeCreatePagefilePrivilege	4476	chrome.exe
Token: SeShutdownPrivilege	4476	chrome.exe
Token: SeCreatePagefilePrivilege	4476	chrome.exe
Token: SeShutdownPrivilege	4476	chrome.exe
Token: SeCreatePagefilePrivilege	4476	chrome.exe
Token: SeShutdownPrivilege	4476	chrome.exe
Token: SeCreatePagefilePrivilege	4476	chrome.exe
Token: SeShutdownPrivilege	4476	chrome.exe
Token: SeCreatePagefilePrivilege	4476	chrome.exe
Token: SeShutdownPrivilege	4476	chrome.exe
Token: SeCreatePagefilePrivilege	4476	chrome.exe
Token: SeShutdownPrivilege	4476	chrome.exe
Token: SeCreatePagefilePrivilege	4476	chrome.exe
Token: SeShutdownPrivilege	4476	chrome.exe
Token: SeCreatePagefilePrivilege	4476	chrome.exe
Token: SeShutdownPrivilege	4476	chrome.exe
Token: SeCreatePagefilePrivilege	4476	chrome.exe
Token: SeShutdownPrivilege	4476	chrome.exe
Token: SeCreatePagefilePrivilege	4476	chrome.exe
Token: SeShutdownPrivilege	4476	chrome.exe
Token: SeCreatePagefilePrivilege	4476	chrome.exe
Token: SeShutdownPrivilege	4476	chrome.exe
Token: SeCreatePagefilePrivilege	4476	chrome.exe
Token: SeShutdownPrivilege	4476	chrome.exe
Token: SeCreatePagefilePrivilege	4476	chrome.exe
Token: SeShutdownPrivilege	4476	chrome.exe
Token: SeCreatePagefilePrivilege	4476	chrome.exe
Token: SeShutdownPrivilege	4476	chrome.exe
Token: SeCreatePagefilePrivilege	4476	chrome.exe
Token: SeShutdownPrivilege	4476	chrome.exe
Token: SeCreatePagefilePrivilege	4476	chrome.exe
Token: SeShutdownPrivilege	4476	chrome.exe
Token: SeCreatePagefilePrivilege	4476	chrome.exe
Token: SeShutdownPrivilege	4476	chrome.exe
Token: SeCreatePagefilePrivilege	4476	chrome.exe
Token: SeShutdownPrivilege	4476	chrome.exe
Token: SeCreatePagefilePrivilege	4476	chrome.exe
Token: SeShutdownPrivilege	4476	chrome.exe
Token: SeCreatePagefilePrivilege	4476	chrome.exe
Token: SeShutdownPrivilege	4476	chrome.exe
Token: SeCreatePagefilePrivilege	4476	chrome.exe
Token: SeShutdownPrivilege	4476	chrome.exe
Token: SeCreatePagefilePrivilege	4476	chrome.exe
Token: SeShutdownPrivilege	4476	chrome.exe
Token: SeCreatePagefilePrivilege	4476	chrome.exe
Token: SeShutdownPrivilege	4476	chrome.exe
Token: SeCreatePagefilePrivilege	4476	chrome.exe
Token: SeShutdownPrivilege	4476	chrome.exe
Token: SeCreatePagefilePrivilege	4476	chrome.exe
Token: SeShutdownPrivilege	4476	chrome.exe
Token: SeCreatePagefilePrivilege	4476	chrome.exe
Token: SeShutdownPrivilege	4476	chrome.exe
Token: SeCreatePagefilePrivilege	4476	chrome.exe

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe

Suspicious use of SetWindowsHookEx 38 IoCs

pid	Process
264	osk.exe
264	osk.exe
264	osk.exe
264	osk.exe
264	osk.exe
264	osk.exe
264	osk.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
4476	chrome.exe
1316	SecHealthUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4476 wrote to memory of 5924	4476	chrome.exe	94
PID 4476 wrote to memory of 3180	4476	chrome.exe	95
PID 4476 wrote to memory of 3180	4476	chrome.exe	95
PID 4476 wrote to memory of 2840	4476	chrome.exe	96
PID 4476 wrote to memory of 1784	4476	chrome.exe	98
PID 4476 wrote to memory of 1784	4476	chrome.exe	98
PID 4476 wrote to memory of 1952	4476	chrome.exe	99
PID 4476 wrote to memory of 1952	4476	chrome.exe	99
PID 4476 wrote to memory of 1044	4476	chrome.exe	100
PID 4476 wrote to memory of 1044	4476	chrome.exe	100
PID 4476 wrote to memory of 4632	4476	chrome.exe	101
PID 4476 wrote to memory of 4632	4476	chrome.exe	101
PID 4476 wrote to memory of 4168	4476	chrome.exe	102
PID 4476 wrote to memory of 4168	4476	chrome.exe	102
PID 4476 wrote to memory of 4904	4476	chrome.exe	103
PID 4476 wrote to memory of 5896	4476	chrome.exe	104
PID 4476 wrote to memory of 5896	4476	chrome.exe	104
PID 4476 wrote to memory of 5036	4476	chrome.exe	105
PID 4476 wrote to memory of 5036	4476	chrome.exe	105
PID 4476 wrote to memory of 3676	4476	chrome.exe	109
PID 4476 wrote to memory of 464	4476	chrome.exe	110
PID 4476 wrote to memory of 3676	4476	chrome.exe	109
PID 4476 wrote to memory of 464	4476	chrome.exe	110
PID 4476 wrote to memory of 1792	4476	chrome.exe	111
PID 4476 wrote to memory of 1792	4476	chrome.exe	111
PID 4476 wrote to memory of 6136	4476	chrome.exe	112
PID 4476 wrote to memory of 6136	4476	chrome.exe	112
PID 4476 wrote to memory of 2788	4476	chrome.exe	113
PID 4476 wrote to memory of 2788	4476	chrome.exe	113
PID 4476 wrote to memory of 628	4476	chrome.exe	114
PID 4476 wrote to memory of 628	4476	chrome.exe	114
PID 4476 wrote to memory of 1284	4476	chrome.exe	115
PID 4476 wrote to memory of 1284	4476	chrome.exe	115
PID 4476 wrote to memory of 5056	4476	chrome.exe	116
PID 4476 wrote to memory of 5056	4476	chrome.exe	116
PID 4476 wrote to memory of 5308	4476	chrome.exe	117
PID 4476 wrote to memory of 5308	4476	chrome.exe	117
PID 4476 wrote to memory of 5616	4476	chrome.exe	118
PID 4476 wrote to memory of 5616	4476	chrome.exe	118
PID 4476 wrote to memory of 3472	4476	chrome.exe	119
PID 4476 wrote to memory of 3472	4476	chrome.exe	119
PID 4476 wrote to memory of 2632	4476	chrome.exe	120
PID 4476 wrote to memory of 2632	4476	chrome.exe	120
PID 4476 wrote to memory of 4712	4476	chrome.exe	121
PID 4476 wrote to memory of 4712	4476	chrome.exe	121
PID 4476 wrote to memory of 4252	4476	chrome.exe	122
PID 4476 wrote to memory of 4080	4476	chrome.exe	123
PID 4476 wrote to memory of 4640	4476	chrome.exe	124
PID 4476 wrote to memory of 5928	4476	chrome.exe	125
PID 4476 wrote to memory of 5928	4476	chrome.exe	125
PID 4476 wrote to memory of 3784	4476	chrome.exe	126
PID 4476 wrote to memory of 3784	4476	chrome.exe	126
PID 4476 wrote to memory of 2152	4476	chrome.exe	127
PID 4476 wrote to memory of 2152	4476	chrome.exe	127
PID 4476 wrote to memory of 6088	4476	chrome.exe	128
PID 4476 wrote to memory of 6088	4476	chrome.exe	128
PID 4476 wrote to memory of 4360	4476	chrome.exe	131
PID 4476 wrote to memory of 4360	4476	chrome.exe	131
PID 4476 wrote to memory of 2812	4476	chrome.exe	132
PID 4476 wrote to memory of 2812	4476	chrome.exe	132
PID 4476 wrote to memory of 208	4476	chrome.exe	134
PID 4476 wrote to memory of 4576	4476	chrome.exe	135
PID 4476 wrote to memory of 4576	4476	chrome.exe	135
PID 4476 wrote to memory of 5980	4476	chrome.exe	136

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\ava.exe
"C:\Users\Admin\AppData\Local\Temp\ava.exe"
1⤵
PID:3048

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0xa8,0x134,0x7ffee8c4c728,0x7ffee8c4c734,0x7ffee8c4c740
  2⤵
  PID:5924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1624,i,18374435170374227074,13739996373260914810,262144 --field-trial-handle=1864,i,13540251943527642580,15853939483227262467,262144 --variations-seed-version --mojo-platform-channel-handle=1856 /prefetch:2
  2⤵
  PID:3180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2176,i,16920412389087100396,9755323112375046889,524288 --field-trial-handle=1864,i,13540251943527642580,15853939483227262467,262144 --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:2840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2316,i,16351904985253098268,7053974474632157171,524288 --field-trial-handle=1864,i,13540251943527642580,15853939483227262467,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:13
  2⤵
  PID:1784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3240,i,2507321411474339291,93298230683095426,2097152 --field-trial-handle=1864,i,13540251943527642580,15853939483227262467,262144 --variations-seed-version --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:1952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3244,i,16695127949094378546,14828106056019984853,2097152 --field-trial-handle=1864,i,13540251943527642580,15853939483227262467,262144 --variations-seed-version --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:1044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4556,i,13127069945120594627,9931346392791597820,524288 --field-trial-handle=1864,i,13540251943527642580,15853939483227262467,262144 --variations-seed-version --mojo-platform-channel-handle=4708 /prefetch:14
  2⤵
  PID:4632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4840,i,16792936580140437901,14261767737525432957,2097152 --field-trial-handle=1864,i,13540251943527642580,15853939483227262467,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:1
  2⤵
  PID:4168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5392,i,9586805049963035179,9564349799123511019,524288 --field-trial-handle=1864,i,13540251943527642580,15853939483227262467,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:14
  2⤵
  PID:4904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5432,i,15302242258222562820,14019431380958720986,2097152 --field-trial-handle=1864,i,13540251943527642580,15853939483227262467,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:5896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5440,i,11225787258367628790,2221921246416326926,2097152 --field-trial-handle=1864,i,13540251943527642580,15853939483227262467,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5832,i,7304658032762551385,6524540388655985169,524288 --field-trial-handle=1864,i,13540251943527642580,15853939483227262467,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:14
  2⤵
  PID:3676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5760,i,3864905189798982505,3491624106139396121,2097152 --field-trial-handle=1864,i,13540251943527642580,15853939483227262467,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5972,i,7204512964141449724,14048640588240726258,2097152 --field-trial-handle=1864,i,13540251943527642580,15853939483227262467,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:1792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5560,i,14792403325298113542,10303213063071669557,2097152 --field-trial-handle=1864,i,13540251943527642580,15853939483227262467,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:6136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5704,i,1307736102861925438,7667659604038929632,2097152 --field-trial-handle=1864,i,13540251943527642580,15853939483227262467,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:2788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5508,i,11087074098525626937,4223256543864403544,2097152 --field-trial-handle=1864,i,13540251943527642580,15853939483227262467,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5440,i,4027289112464076811,6990197462146729731,524288 --field-trial-handle=1864,i,13540251943527642580,15853939483227262467,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:14
  2⤵
  PID:1284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5748,i,13906615968391213060,43815385250402424,2097152 --field-trial-handle=1864,i,13540251943527642580,15853939483227262467,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6208,i,868691260540194413,5057310219743775573,524288 --field-trial-handle=1864,i,13540251943527642580,15853939483227262467,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:14
  2⤵
  PID:5308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=4856,i,17217815532029835555,6596010492251900780,2097152 --field-trial-handle=1864,i,13540251943527642580,15853939483227262467,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:5616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5472,i,7477597682977252496,11734979845506759744,2097152 --field-trial-handle=1864,i,13540251943527642580,15853939483227262467,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:9
  2⤵
  PID:3472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5980,i,13339439061696953410,7025489703775863834,2097152 --field-trial-handle=1864,i,13540251943527642580,15853939483227262467,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:2632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3708,i,6908352750024655614,4015757840052972160,524288 --field-trial-handle=1864,i,13540251943527642580,15853939483227262467,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:12
  2⤵
  PID:4712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5512,i,6715615957098494814,2881893252070783638,524288 --field-trial-handle=1864,i,13540251943527642580,15853939483227262467,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:14
  2⤵
  PID:4252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4948,i,13424793341197602333,1312224287656612223,524288 --field-trial-handle=1864,i,13540251943527642580,15853939483227262467,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:14
  2⤵
  PID:4080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4936,i,10028582591708629483,17462551915956629485,524288 --field-trial-handle=1864,i,13540251943527642580,15853939483227262467,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:14
  2⤵
  PID:4640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6168,i,16732100000178941471,15378063191538387246,2097152 --field-trial-handle=1864,i,13540251943527642580,15853939483227262467,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:1
  2⤵
  PID:5928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=6064,i,8584512084283946838,5162612501594312419,2097152 --field-trial-handle=1864,i,13540251943527642580,15853939483227262467,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:3784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=1224,i,17561482419025464577,18311764227245150521,2097152 --field-trial-handle=1864,i,13540251943527642580,15853939483227262467,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:1
  2⤵
  PID:2152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=6092,i,6926702792326306821,566563775305934164,2097152 --field-trial-handle=1864,i,13540251943527642580,15853939483227262467,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:6088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=6252,i,12372533691920455820,15342843631069518793,2097152 --field-trial-handle=1864,i,13540251943527642580,15853939483227262467,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:1
  2⤵
  PID:4360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=4548,i,18385688594671461168,2943630941009535866,2097152 --field-trial-handle=1864,i,13540251943527642580,15853939483227262467,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:1
  2⤵
  PID:2812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6408,i,16808063469530323997,18014479287193288018,262144 --field-trial-handle=1864,i,13540251943527642580,15853939483227262467,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=4572,i,16325363721091282785,3409131046611263545,2097152 --field-trial-handle=1864,i,13540251943527642580,15853939483227262467,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:1
  2⤵
  PID:4576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=6464,i,2056655355867394151,10746549709103630,2097152 --field-trial-handle=1864,i,13540251943527642580,15853939483227262467,262144 --variations-seed-version --mojo-platform-channel-handle=4576 /prefetch:1
  2⤵
  PID:5980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=4836,i,5768142959472234340,5225599595655942689,2097152 --field-trial-handle=1864,i,13540251943527642580,15853939483227262467,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=3924,i,3889158168822071330,6226072693601962812,2097152 --field-trial-handle=1864,i,13540251943527642580,15853939483227262467,262144 --variations-seed-version --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:3260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=6732,i,7872723100928207474,3132958633829192274,2097152 --field-trial-handle=1864,i,13540251943527642580,15853939483227262467,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:1
  2⤵
  PID:5280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=7096,i,12919527372492461592,7144160416781452548,2097152 --field-trial-handle=1864,i,13540251943527642580,15853939483227262467,262144 --variations-seed-version --mojo-platform-channel-handle=7060 /prefetch:1
  2⤵
  PID:5876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --metrics-shmem-handle=3304,i,12476623462981797327,7141049520173319981,2097152 --field-trial-handle=1864,i,13540251943527642580,15853939483227262467,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:1
  2⤵
  PID:2676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=7012,i,15125329650039039623,3785210104653877367,2097152 --field-trial-handle=1864,i,13540251943527642580,15853939483227262467,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:1
  2⤵
  PID:3988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=6836,i,8666023606825835710,5945348250200903665,2097152 --field-trial-handle=1864,i,13540251943527642580,15853939483227262467,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:1
  2⤵
  PID:3268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --metrics-shmem-handle=5828,i,319370254323524527,7381148575241133296,2097152 --field-trial-handle=1864,i,13540251943527642580,15853939483227262467,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:1
  2⤵
  PID:2984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --metrics-shmem-handle=5960,i,8563435947295876773,14101987287079509041,2097152 --field-trial-handle=1864,i,13540251943527642580,15853939483227262467,262144 --variations-seed-version --mojo-platform-channel-handle=7176 /prefetch:1
  2⤵
  PID:5632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --metrics-shmem-handle=7780,i,3426877780844204479,16728257641343960784,2097152 --field-trial-handle=1864,i,13540251943527642580,15853939483227262467,262144 --variations-seed-version --mojo-platform-channel-handle=7796 /prefetch:1
  2⤵
  PID:2904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6168,i,18396023044220583335,831628532344975674,524288 --field-trial-handle=1864,i,13540251943527642580,15853939483227262467,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:14
  2⤵
  PID:2796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7664,i,10355511558010851977,8311605450862902286,524288 --field-trial-handle=1864,i,13540251943527642580,15853939483227262467,262144 --variations-seed-version --mojo-platform-channel-handle=7040 /prefetch:14
  2⤵
  PID:2532
- C:\Users\Admin\Downloads\ava.exe
  "C:\Users\Admin\Downloads\ava.exe"
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Users\Admin\Downloads\ava.exe
  "C:\Users\Admin\Downloads\ava.exe"
  2⤵
  - Executes dropped EXE
  PID:5524

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5804

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2196

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:6000

C:\Windows\system32\osk.exe
"C:\Windows\system32\osk.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:264

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004A4 0x00000000000004B0
1⤵
PID:5204

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5740

C:\Users\Admin\Downloads\ava.exe
"C:\Users\Admin\Downloads\ava.exe"
1⤵
- Executes dropped EXE
PID:2836

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4180

C:\Users\Admin\Downloads\ava.exe
"C:\Users\Admin\Downloads\ava.exe"
1⤵
- Executes dropped EXE
PID:4516

C:\Users\Admin\Downloads\ava.exe
"C:\Users\Admin\Downloads\ava.exe"
1⤵
- Executes dropped EXE
PID:2292

C:\Windows\System32\DataExchangeHost.exe
C:\Windows\System32\DataExchangeHost.exe -Embedding
1⤵
PID:2676

C:\Users\Admin\Desktop\ava.exe
"C:\Users\Admin\Desktop\ava.exe"
1⤵
- Executes dropped EXE
PID:1224

C:\Users\Admin\Desktop\ava.exe
"C:\Users\Admin\Desktop\ava.exe"
1⤵
- Executes dropped EXE
PID:1396

C:\Users\Admin\Desktop\ava.exe
"C:\Users\Admin\Desktop\ava.exe"
1⤵
- Executes dropped EXE
PID:4520

C:\Users\Admin\Desktop\ava.exe
"C:\Users\Admin\Desktop\ava.exe"
1⤵
- Executes dropped EXE
PID:6112

C:\Users\Admin\Desktop\ava.exe
"C:\Users\Admin\Desktop\ava.exe"
1⤵
- Executes dropped EXE
PID:4020

C:\Users\Admin\Desktop\ava.exe
"C:\Users\Admin\Desktop\ava.exe"
1⤵
- Executes dropped EXE
PID:1860

C:\Users\Admin\Desktop\ava.exe
"C:\Users\Admin\Desktop\ava.exe"
1⤵
- Executes dropped EXE
PID:5696

C:\Users\Admin\Desktop\ava.exe
"C:\Users\Admin\Desktop\ava.exe"
1⤵
- Executes dropped EXE
PID:1916

C:\Users\Admin\Desktop\ava.exe
"C:\Users\Admin\Desktop\ava.exe"
1⤵
- Executes dropped EXE
PID:2832

C:\Users\Admin\Desktop\ava.exe
"C:\Users\Admin\Desktop\ava.exe"
1⤵
- Executes dropped EXE
PID:900

C:\Users\Admin\Desktop\ava.exe
"C:\Users\Admin\Desktop\ava.exe"
1⤵
- Executes dropped EXE
PID:5468

C:\Users\Admin\Desktop\ava.exe
"C:\Users\Admin\Desktop\ava.exe"
1⤵
- Executes dropped EXE
PID:2916

C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe
"C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe" -ServerName:SecHealthUI.AppX8tam42xc7v2czs3s1nt0nkxvfjtepzp9.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:1316

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:2832

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding
1⤵
PID:4788

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WbioSvcGroup -s WbioSrvc
1⤵
- Drops file in System32 directory
- Checks processor information in registry
PID:2000

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6152

C:\Users\Admin\Desktop\ava.exe
"C:\Users\Admin\Desktop\ava.exe"
1⤵
- Executes dropped EXE
PID:6232

C:\Users\Admin\Desktop\ava.exe
"C:\Users\Admin\Desktop\ava.exe"
1⤵
- Executes dropped EXE
PID:6296

C:\Users\Admin\Desktop\ava.exe
"C:\Users\Admin\Desktop\ava.exe"
1⤵
- Executes dropped EXE
PID:6364

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\AddRemove.cmd" "
1⤵
- Executes a command shell one-liner
PID:6424

C:\Users\Admin\Desktop\ava.exe
"C:\Users\Admin\Desktop\ava.exe"
1⤵
- Executes dropped EXE
PID:6496

C:\Users\Admin\Desktop\ava.exe
"C:\Users\Admin\Desktop\ava.exe"
1⤵
- Executes dropped EXE
PID:6408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

08ba4bb0-88cd-400d-8b3a-64073f272047.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\08ba4bb0-88cd-400d-8b3a-64073f272047.tmp
Size 139KB
SHA256 19d7b0b00384a9dc00fe7c8ff328fbc507b2a925a778c6ed0039b55a9d80b3ea
MD5 5b4546d1fe14946fec33864869bca147
SHA1 39ab5a2f7917193eb012cc36026ae1985751cbab
SHA512 50b6f012507549feea2db83695e2f4c0a2146cb72c4dea778b4045bb92398066119c8bc2ffed315dfd032577b5b333c3477151f225b1022e3451865e85d226b6
SSDEEP 3072:5QlxY2KwIK+h3Kl83X3d8yhp8p9AdJQiyqjQDrj1xuuq+fobLcvf2v:5yxlKwIKw3Kl8niyhpMWdJKAQ71xlq+Q
TLSH
T1D5D312F2B9E7CD724E7A214A75513271DCB2E8CE544CAC129DEE538B42DB1D807C6C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4ab3232e-80ac-4e6c-8912-5a27f1b662bb.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\4ab3232e-80ac-4e6c-8912-5a27f1b662bb.tmp
Size 4KB
SHA256 a1201a41d45a4ac2f5816ad5bed7b5fc9ec09250390dea86b762149e3d797cb3
MD5 6e21921132b2713c5dadfb7035f8b250
SHA1 21f987d58c8185d70fe2ec112109ac1b74eca2fa
SHA512 b8efd8e231dee7dbeaf2ab05126a0e9a6b1801bf672be14178a0c57ad4c8eb648e6b87a0e3635d6eff2a55a8bd35cdb02d4fea4a1ab7577e4cfc0ba6b09779b8
SSDEEP 96:mC0d+ePqUvKD1H31Luf6NQi4DpniRDotok56CDIB6bdGyvC74Mejb2Hv4a:mC0VPHKDFQvSDUDD8Uwl4Mejb2D
TLSH
T1E7A11931A87858B759B6D9C6B4423A43CFB4A277E961AF44C9DC5F0C11FB0EC1381623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

518bf2ca-e447-48b9-ae69-fd1ae45f02db.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\518bf2ca-e447-48b9-ae69-fd1ae45f02db.tmp
Size 139KB
SHA256 e176feecd5584623ca538ae020c4883f7047629be0d162c4b7fa19dc85e6f98f
MD5 d235b98f11aa041c7b993daa6b5ba7ab
SHA1 ac1231b78f52545fe4f564344fd95fc2851c4ecd
SHA512 65d2e79fc625c3858402b5d0c5bc250c56c637ecab55cbc86c2d05e29d877eb3a54233eacf53289f374c1a8055e017c5933411050bee88aeb276250d826041af
SSDEEP 3072:hQlxY2KwIK+h3Kl83X3d8yhp8p9AdJQiyqjQDrj1xuuq+fobLcvf2v:hyxlKwIKw3Kl8niyhpMWdJKAQ71xlq+Q
TLSH
T11CD312F2B8E7CD724E7A214A75513271DCB2E8CE5448AC129DEE53CB42DB1D807D6C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

964fcdfe-6ab2-4156-99ca-974f18f15a7c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\964fcdfe-6ab2-4156-99ca-974f18f15a7c.tmp
Size 138KB
SHA256 942f486993fa96f66e31f56ce12ad9bd459a35bc2c8007b21dc09545dd7ff167
MD5 b751f33c4d2c3e5b0cd23cba0ede54c4
SHA1 199d49dc3c28501a0a4aabc01b6b7adae7dece14
SHA512 560312a4f44745b6299c8cf761df55ad731e1937e6ed445a86bee9df32d9100b2801bb3722507ceda022a975dbfb2846034f04353df8f8c6a6f61bac202d7f59
SSDEEP 3072:hQp8Y2KwIK+h3Kl83X3d8yhp8p9AdJQiyqjQDrj1xuuq+fobLcvf2v:hQ8lKwIKw3Kl8niyhpMWdJKAQ71xlq+Q
TLSH
T1C9D312F3B9F7CE724A6A714A74513171D8B2D8CC544858139DEE93CB46EB1E513C2C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 0ef28a2de03f16442ed52d857be909c9eeec7e6ad9d8a19a142e3cb4d756d245
MD5 413c3c68bb45fdb6bb026b7ff9f8c5fe
SHA1 a28925d9244ee1b8aa34005bc3ab4a18283b6fa9
SHA512 44de959773df164333844ac71ca31db1be15db8f54b5f762c11bf38f5e2964a2b58b382676737c181b1ef07e0530dbba2f2c8ce84de890e8ac2b2e81de63b4bd
MD5 SHA1 SHA512

Submit Download

0b2ce4cc-693b-4f7f-87fd-e57f8a463959.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\0b2ce4cc-693b-4f7f-87fd-e57f8a463959.tmp
Size 12KB
SHA256 2bfe1348bdf9e1979f05dfdd8861583ad1df65ead3e41dd6ef8dbb3199c837f4
MD5 51bde85b9ec8a8243fccbb37614ae4fb
SHA1 c12705f5fd25d4c0f478cff1977de5ed7dc4bc3c
SHA512 2b4002fa64cec0e3af836ef9adc9baa713e5b558dc6aebcafcd95f64c56cdf98b313efaf6fcdb81bd242bd55d7b6d16131e7b11d16b9fa38b4dee52a328a6d25
SSDEEP 192:JR7EcBhMDRnJv7zXTUPRpiTvmmlz9KHsb+WNngnBViJdYfaAeOzVyIsnAUgE:JRQmhM1nJ3CXi/owsnudYfLE
TLSH
T1FF42B46AA914397B5CDBD65AF9367B92E3F1102220942F84EAFCCA2C15E76CD3217007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

59415a1a-0c18-4fc4-9e63-530f342d48c1.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\59415a1a-0c18-4fc4-9e63-530f342d48c1.tmp
Size 13KB
SHA256 41cd6c865aaa10f5c5051ef96940a2790987b660e4f9593bbb8e5fde879202e5
MD5 7faa5bd76f1ade348ccce357360e1712
SHA1 769228a97d073247f9683471e60161b054f509ea
SHA512 f382f30901ae6e6b3f26e063e8bb66687e691451b14418f6136b94231ad162c62f4ed24f5f035432b0ee26fc375427c420c5b15b552a0c05ea861ade7e624c13
SSDEEP 192:JR7McBh8DRMJv7zXTUPRpiTvhRmTZkFyt9KHsb+WNLVgnBViJdA0Qu2fyAeOzVyN:JRgmh81MJ3CXiQow2nudA62fDE
TLSH
T1AD52C56AA924297B5CD7C65AF922BB96E3F1103160D41F88EAFCC92C14E76CD3217447
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

665246ea-2456-42f1-b346-e368ce432f9c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\665246ea-2456-42f1-b346-e368ce432f9c.tmp
Size 12KB
SHA256 7f74e14c36a2d66c3cdef42948a2f749c7446822734e7e2298d7198220113d39
MD5 6e1c2492224e770673a3ec42374d9c03
SHA1 212d7af8d9daa642d292d6159eafdcc92f03dc04
SHA512 265395476ae9f24ef9596d0b860c8532ce3095d3bbd35e72e25d2ea78b536b6d71f6c26df6fadfb1c48c8e3893b9783bed3fca5221a4cc7ce5e0ae2f92376843
SSDEEP 192:FR7EcBhMDRnJv7gXTUPRpiTvmmlz9KHsb+WNn+d4ViJdYfu5AeOzVyIsnAUgE:FRQmhM1nJ0CXi/owwsudYfu6E
TLSH
T11F42C56AA924397B5CDBC659F9767B92E3F1102220942F84EAFCCA2C15E76CD3317007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

69e5239d-315d-4eea-baf5-8b45fe556cf7.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\69e5239d-315d-4eea-baf5-8b45fe556cf7.tmp
Size 13KB
SHA256 5a72b0a7d2b5805ed7ab88e28667e11cdefe1b9ef86eb576ff8baf178a79faed
MD5 ff092da9bde0c1dd5ab32cf222f8e30c
SHA1 8c4c8f4caf3939ecb6008489c5631cb7f9f529af
SHA512 0ddb5ed828b724097c27394258bbc157cd9f6078d61cdc09c126879ab2da8912a4edb66835c193dde278af1c6037873b6c1ed27b853970a302626da4f55367cd
SSDEEP 384:IyjE37KxkXqKf/pUZNCgVLH2HfgslWzXODE7+ErU3TKHGEkw7vQ2Xh:ISE37KxkXqKf/pUZNCgVLH2HfgsYbOQx
TLSH
T1D352FA67684C9A3F0FD8DA8DDC277F4FACF5025662680D2852FA9C1503A57CB124A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6a45b1d1-4331-4eab-8f78-d2795259fb3f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\6a45b1d1-4331-4eab-8f78-d2795259fb3f.tmp
Size 13KB
SHA256 3ccc63cd4fa2c63be170c4f056d33aafc0ff683747706e41d1aff51b37bca816
MD5 76e41ea4dd35c53389ae9281dbc73d4c
SHA1 866055983512cbc613a196840fcd8af847ecea91
SHA512 e736ded6ee31f2ae722bc8597f14484ff53c8ef7e4d91fd9ef6c3fedb420fb616bf222b8ba7fd71d354eae69895ff63e923ed18c7f2b22f7cf0364a9e4dc1e12
SSDEEP 192:JR7McBh8DRMEv7zXTUPRpiTvhRmTZkFyt9KHsb+WNLzNIgnBViJdA0Qu2fyAeOzO:JRgmh81Mg3CXiQowlnudA62fDE
TLSH
T11052C66AE92429BB5CD7C65AF922BB96E3F1102161D41F84FAFCC92C14E7ACD3207447
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000004
Size 73KB
SHA256 f3da3acb05ffefdc9ae669d4d171476ad2d7f4aefefa8fa9e0245a7a3b5ac2dd
MD5 9a896a1d99d04ee0f3fd1b7983fdf1b7
SHA1 a8e793d6fcdf858eceb9f42a9f75665d6a92abc0
SHA512 227c7027b7c944a7472f41c28056bad40b0d3116a3ea88fd350cd9f3c1a44f36d475ae8fee82b558619be48bf78982da14e87617a7a4e7a2241b94ab8272ef8a
SSDEEP 1536:O77BHwf0DFsAQtr1cHixbkJJqPrfkqrFDMllDv4nhz7y4vj:O779wTAwr1wGYJJkfDMXAnhny4b
TLSH
T1887302F82C92C0851875371B2FCEEC37990BBCE11295CE64368DF065D6B7A1B8E16D68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000a
Size 437KB
SHA256 a451b8791f9183f16a2b30959f9f69e20f35117f8ca6e34e463916869328f3c8
MD5 15d9ce7fe8b446c91cc0598983dde50a
SHA1 b2ad1e9b11a41f5176e3cc495dac68aa26e0955f
SHA512 39e14f23bbde8278b586057eeb648777afc1e6d11b71f3e5529688341f7868b61d0d7ef43cc925189a70def4a6b53e863a06fc8d36e7551c9a50745be6607529
SSDEEP 12288:9SyJNj5Vy52pw6eyroMIW3/dJhlzOH7pVUa0Uiku:9vJzV1pw/yroMfCIUfu
TLSH
T10B9423CFDB2108E7FE76C411CDAD9FE8049BA554056D8CB35BB6066D825A0808636FEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000018

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000018
Size 21KB
SHA256 ff2dbff8bd60aa8f5672c1ab0b7af96204f3825b90faf4dea5b54ad0243b7d63
MD5 1cb4adc1ef53f6452f06b6ddb500eeb9
SHA1 3223cfa4ab9da3a197c1018eee9820e57cdc12d6
SHA512 8f582596d6e517b4566056ab1d1d3add5ad3c83b8eb3d0d5d0c2bc63872253d9b71822e8f69a16af4a4adc911475a3c02676e3b5ed3c7fc527fab72d8186d8b5
SSDEEP 384:0f811LNGSzP80XqPlae+7L0SFU4ypynvwhXDL8U8VZjaj4Gf:0UXLp8AqPlX+Q5ynvQTL8HaUGf
TLSH
T1EBA2D17354BE8D03B5D90940DB4A6240296F3EF97A0A8F0D19C506E9716DC224B86BDE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000027

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000027
Size 50KB
SHA256 4cdca7bfc0613048c0f4664e71bc5c5e16560695134559d61c3357eceeffbb72
MD5 5ce74527730a6e6a7f20611fb425f950
SHA1 dd725cbf2465f1d17e57ecf2d409a99fa761e942
SHA512 8a11870f42ec9d385a529042e4b0a49d87d7bc70adac4fffad5d26d66b231637c09c8f28ebc6b43a8a8b8e2f32747c542b031550c7ddb0f345ecbee2c39430b6
SSDEEP 1536:G7k1IapVSTNH9ARuU3VaLcDq5nUhZ4SBv+g8XB:GIpUTB/NKhZRBv+g8XB
TLSH
T1A93302853DE6152B031D91BD7D635C32A53665B1B93495A3AC9CBFF8A4B904830C8F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000028

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000028
Size 55KB
SHA256 3f50e98da40ce92796f06cff44a9ad379791e3c629ac6d723752b9f27bf3cf5c
MD5 5cc50640ab03682bca133c08aca51693
SHA1 0d25c2de08909044d35f946a6110c1ec8b358515
SHA512 b6f25dccfc100870511fe3c595cae9f1ed242590769bed1bd9472632c67ec75d3db0952070db10b1514c8794713aa19251eef95f18c084b302f1d12aa2090ab7
SSDEEP 768:vgXZURLMo16kxQz0xabX+YdLU975DWo0jLymiPIl1o0XIlRWEzgZeZZxfbiFpfAI:vkURLVHa0xaSYdUqySlKou1yeXTXBO
TLSH
T1C44302FDFA9E86E20A23202AE1F0E14ED4784CE7D5EFB15D66421FD21B88381D5691DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00002a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002a
Size 66KB
SHA256 5a6f67eee3c0e1685695558ff3f87562b5f7b7671cf2de5113849b7703845149
MD5 a860d01b6e43e1c456e5deb9223bb378
SHA1 1a0d5b063100ccc9cfd467b992b4580a68f684ac
SHA512 dff1a5dd3202bc97f93f8e3e77a0b067316777c7e64049eedb0dd558d85bd9fd8dc2b4bc431f66bee969e78c3d5074a8b5de7b343acbe32d5dbca409403e032b
SSDEEP 1536:aRqP4r7fdwi7VR+OYnDkz7pFyvX9W4kQO5ENQjXzLtZo8jMheQL0Mb:a3VwOR+dnQzNFGtWDjXzLtWeMb
TLSH
T14963125F1F0EA6D1841EEA933A7D83B6C5E8D4C655C2C3A9BF2A075741BE38C14A2706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00002d

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002d
Size 80KB
SHA256 76615d0cbdf4bf165f1c3a734714386ff32a89aade3c04abfd5b463c755a079d
MD5 4aeae0fcc4e5b23385174829b0e6da7e
SHA1 b06452a28e5903f5fec913eabf06aa1a733812d8
SHA512 ab7b82e9262010e640466fcd960fcc09b1a1746b65de20e35e751cdd22315579868037168ad22dbb2550546dfb0720003a278b39b09be31fcafa59088f18281c
SSDEEP 1536:t22dFwST31xsrvamV0gEoya/T2dXqb+AZJO9gDF40QquPBjnZDq9gPZdK:hFwST3UrCpoyHpqb+ADfx45vhnJ4gPZw
TLSH
T175831232BDDD563A0BBA854CCD49E3239B17594C0EF025D5C1B280666B8BC717EC58BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000031

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000031
Size 433KB
SHA256 636fbf4bacfdeeb8e992e4dc5e98ca3a4bba0a193c7012cbd0c0bf5db5c3a5c9
MD5 1a127b55262f235b438ae6dad1263ba9
SHA1 c75c3c2009d692c4ddb282d490d74f2c1e6ed71b
SHA512 6b78797babef516d8faa0292848365093a6da380024ec2a5bceb9aa311db23aaa6e66b36858498349d6cc803cdc7b17a6b7c7679707a33d1f9ebad0c3b586f3a
SSDEEP 12288:qPfdtyyE7iJG8+gi0rENe1ob+2ezBlQlSVf8Vizx+i4e:qCyE7U9hPYF+1v2Vizxz4e
TLSH
T15E9423F1412F5C848EFBF65F230750A44F1271AFADD8BFE2593992CCC8657619C888A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000034

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000034
Size 60KB
SHA256 bcf5f49615a2e4127c93e758bbc4db9df9f453ca4cd0bc5672879f910c3e4f5c
MD5 34d1add70e64fe02d59823ba8f482168
SHA1 00b9c06b04af940452a4060a39f34470f9076c44
SHA512 3f5ac95913f064b8d13fcc767ab8cb871931c00c08c812996bd90f5eaedee691a0eea0bdf82f11f33214fa183a99277511ed4d0807a23978864686b22993db98
SSDEEP 1536:JbTRyxtENv4jf2BsjXIO6PxI0iNgnfK27EWTAEj50F:NTRyx/eBqYFPxI0CgnfK2walj50F
TLSH
T1DB5302FF184114AADDE5B8D9519A480ADD8F2F13B75AFC188E1AC86F6A533CD7701630
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 cf1d64e2802c90a90ef87d6a85431d2f15dae9e51b1d3538a9f29e01ef6cc1cf
MD5 678d666553582f24122cf8e6110d9ad5
SHA1 c6717189b667b0ba0fda7542166337989d9ba88c
SHA512 618767b48d376b771892ff7c73d7217447dce6fdee633a78d271646b7d0c180c739816b33ae8f4685dbce16749ba60cefcf07c89394d965e051ff0b1e99a6c7d
TLSH
T136613230D177ECA5C78FB5713A710E1334A614EF5E4E2139813C05DC7DA6B7AA6660AC
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 5KB
SHA256 f962ee0b9adb3dc173720315bee9bf3c3895a536aca0eadcb4016a893996770a
MD5 ed6fcad7e714616fb5bb95ac1421311d
SHA1 3dce7654dbebb7071dbba7932dbd248d049f0583
SHA512 5338042eb90cc859c2826080bab491360f2fc28c2ce4d3099977bf847237b16286ff4888ac3d31a57421e01823621db888628768422a798f9726606c1dfcfd1b
SSDEEP 96:ULCLWeqEK5+6z2CyRQzAZpm06LkpbdYaskapCm9oZLkzI:jVq58+2CydULSdxxo2Z4zI
TLSH
T1C7B12130D077E854DF4E75B43BF20D2630B910DF895F193AA01801F87DB2BA9A6399AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1008B
SHA256 fd5959686fb58fe59702919f54a9cf2014f75882f175309975e4cc141ad6a5a1
MD5 31a643d7be3119ce14a06335b130dd81
SHA1 be0cfdbd7e73acc2f138fd992f91d60679f9c73d
SHA512 407ebd6727b1de1562cbc2ef2f6d148e0f049b30675babbb8591f33850af0ef69c0c04bff36ec0cf4ec82197863eb55fa58617ae9b4cdd93b2851c290df10abf
TLSH
T10411C031E9478C68CF92AFB43CC1020756E7145F5E9D217E16C844DCFD56238355945C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 1401b12025f0a011c2b2130491370941dfb169ef9486922664946f1c7e8e4939
MD5 467f397532126443009250bd30089236
SHA1 d2a7b58a12f5fc57d8f56c6bda68d5b8156725cd
SHA512 68d03140e1a2bae8be91cdcbab3e43e1567986c9cc69d716064a99d4aa3be912a11c1bfca5f1f53fd291a9f1b2ba6b45bc5353eae6993e0876cdbfa83c9a9068
SSDEEP 96:vLCLWeqEK704z+6Y2CyRtAZ3m06LkpbdYaskapCm9nZLkzYr:IVq57BCZ2Cyk2LSdxxoFZ4zYr
TLSH
T148B14130D073E854DF4E75B43BF20D2634B910DF895F1A3AA01801F87DB27A9A6795AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

410b3cfc-aabd-4ee0-a927-ef0359ad0306.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\410b3cfc-aabd-4ee0-a927-ef0359ad0306.tmp
Size 7KB
SHA256 5d88c12adb263a65e8b8f16ebee0ae1a2e7172ce91b7fbc1f8e017fe35b3346a
MD5 28dc246db182e0c3e0d3001b58ca3430
SHA1 e5eca7d5990b4de2daafa2adaf2339135a14211c
SHA512 ef5b27650e104bc95c26f7f52cba994555db5f4953066b0a07c92030be125e4ac1ae2443c20eb46689834f61a041979e764212e4f2eb2571c56d1a69440ee13f
SSDEEP 192:DF4/XUiOfleJ5Jf3JkGYeKBegIWeaPPcICTTNPeviyfPuKE:DF4/XUiOfleJ5Jf3JkGYeKBegIWea3cZ
TLSH
T13BF19FF7D3D8C62DC85156F89B15AF1ECE2D0A18421C3C26C9D8AF5B93E2871D25534E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

453f81c1-8d8b-4098-a6c4-0eaed937f736.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\453f81c1-8d8b-4098-a6c4-0eaed937f736.tmp
Size 34KB
SHA256 6e45d5a5e058bd98cd57d038551746529326552ed4b0a1c364dfa0327afe2d29
MD5 7e259973c449012bd743749224fead6d
SHA1 2119192a81d2fb4c3c1f720091d656549158fd61
SHA512 a6c17c522fecfc36940cc33e4a51759d2a2b4f31a0a54958271481e0d33bca4e16602e761c9046f23d8fd356f500284b6d461f924d6bb9ee8cb6e7c93c4c45c8
SSDEEP 384:DF4/XUiOfleJ5JIAx/L2+iaGEep3bqeRI2l+i00J/VmtBeF9Ju513JWBegIWeaJm:wzkQwWYyuWHTnVYizUo10NamYkU3L
TLSH
T193F2BBF7D3E5C52E89115AF896146E1BCF1D0618432C3C2A89D4EE4BE3E3472E25964F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a334806b-097b-4b1b-b18a-84315d288f36.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\a334806b-097b-4b1b-b18a-84315d288f36.tmp
Size 8KB
SHA256 d7c54889274e57496a34353051e7b376b1c2b36ea6cab0b268de4870d4b349e6
MD5 4adf3198da1651ae7c87ee385eba29ae
SHA1 3caf9454afd369ad7415bbef2248070db948fc45
SHA512 4b459be368c883b8838cf289af09733ea8afccc8afd92dd19b23d63c5e892e9e467ddc884a479721cfac812694e9654a4757c82b5e728c170a23530ce5634a23
SSDEEP 192:DF4/XUiOfleJ5JIAa3JWBegIWeaPxIaMDGvn5fPyNPeRmOtkHzH2:DF4/XUiOfleJ5JIAa3JWBegIWeaJIaMY
TLSH
T11B1291F7C3D8C62DC85156F89B256F1ECE2D0A28431C3C66C9D8AE5B93E2872D25534E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e9627374-c19f-49a8-81bf-5ed4b77d38fe.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\e9627374-c19f-49a8-81bf-5ed4b77d38fe.tmp
Size 32KB
SHA256 9a23dd3769101997392336e09aa1994f888d7b048dbdf8503c3c67562ae8302c
MD5 c09a2832a4dc766ea609c0cd1c171683
SHA1 c23c83aa77dfa3ba2b4720b18d06728603a1cf32
SHA512 212f1e86623be6126b48adf6a32f398e0de9c34df0447b6fc6158efaf46098e3dffaa6264ee0a3fbae26202cdb954c0c896548f10b1bd9ecfa91fe034f341b8a
SSDEEP 384:DTOhumtnHGJJ5JjNE/L2+iaGEep3bqeRI2l+i00J/VmtBeF9Ju5uv3JWBegImea6:bDZQwzI12ZTnVYi9Uo10NxmYkU3U
TLSH
T1F9E2CBF793E5D52E89115AF896146E1FCF1C0619432C3C2A89D4EE4BE3E3432E16A64F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ef4bf03d-44d2-4a67-998e-b8fe3d5db0f4.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\ef4bf03d-44d2-4a67-998e-b8fe3d5db0f4.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

ad1c0786d08709ed_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\ad1c0786d08709ed_0
Size 63KB
SHA256 2919a840fdee640f036b3ca19e7245e78141efe02cda80650509a2a35f607d73
MD5 80b4ac251b17a85546e93f744c634984
SHA1 f372fa65cedba9c9ca52191ee9935e2e2b9aaf49
SHA512 e2f10a5625ddcb1a8d76219a726c0a1bdfe8649e41de568aba9ca81ae1f97eef898d2790fdf0a1c27a8f0d016da8e8f9610dc81bf319e859ccea96b1b4cf32b0
SSDEEP 1536:WPu5XhviJCQOynnmmYXDNno2ilY1DXuB3iHxG:R5hYOUnYTpiMD
TLSH
T15E534BD97731B4B3837BA1F1506F1307613AE1A7B404C4E4B1A8EDE15A54B96027BFAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\temp-index
Size 120B
SHA256 58f6626c7cb27825eb2fb9b0b26cc245320b7aa2c4b067fd18ff06ee52847ca4
MD5 edc7220c3b47030988e2f0f827f48e67
SHA1 6051482772bdc331258e0e98bff328b3f79ab086
SHA512 31b6fecc2feb3042f5b1b57ff08c25ef2fc11d44bb7832d45dd737a737936821eab1b2bfc6fe72f593523e75532bec6ea84ac11dc8aa2d2ce05040f8bc44d8ef
TLSH
T1B6B0121311C1EF06CC1446F4BDC37084315B3A2001834A226CC1C244805628440E0104
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\temp-index
Size 96B
SHA256 317255e3dc7a67fb109babc5e30b1a841766295bd04b302273db89abc3ff974f
MD5 03eed9f0b2caae54d91d5bf8189633c0
SHA1 d3d18906128ee183386ce8611e8639e77d336751
SHA512 115c93e5573ff5dd73192ddf2437f40d6d59ba1e455baab54b988d7af3834aec04da99f77cfc915833b884e24b6340cda18719f0f979dd370dd8d4404d030fe6
TLSH
T11DB012610581DC12CD1032F07CC2504832336A50628340535CD0019490113000242100
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 15ed07dd5574947fab3d85a292657cd403fcde606caff6aa3e76484e49a2ed81
MD5 daf7240f5f95e9dbf0a96b15e57e7575
SHA1 e79018858c82fe15b353b29fe22787645d3de9dc
SHA512 33621cf28ba650c975647fefa6941d5d2f06769f50b28c83450ed298189136656fae7020f6b327a46cb98a4a527172370b7bff8a05307966560bcf81cd740b99
TLSH
T170A002E05281C602C29003F1B68217C673E77B2003434A11CC91418EB85835745157C1
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\temp-index
Size 72B
SHA256 2e67541bf0baf9bdda2d441bf7985af6eae74b3375a5f5dc0680ecc73a9c54a8
MD5 5b08bbe311d843c30e4028ebab90e40b
SHA1 98bcbf635f0f881c5a0097a6324410d2822e0584
SHA512 eddd617a6b95c637e3e17ded8a4fe4d5eb86a16ead4231eda94b85de8280a7735ae8f421a6162c8479e7b90fe33f07ec31cf465e2ed38b36673e9af2066679a8
TLSH
T1F0A002344EDA196ADE00637068A11589235A58651655A733949904C4ADAF6D0521A208
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 8f2ae3c1e37ed815ac3640c029222bf7fb4a7297a2c017d7b16719c0f4cf7eba
MD5 a799e96b383ebc00cae8239776b54138
SHA1 188c1c5f0cb629726c3f064a75b6978d22a67a8f
SHA512 7215dd2e4dde30d4fc339a96707391cd2abb83a01d344629569c6ed5d3e980363548341d06db80d2c26f267a48eed83849fa9454cbeb612784f855487ed13675
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

a9485910-3c3e-4b8b-bc68-042cddd973f8.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\a9485910-3c3e-4b8b-bc68-042cddd973f8.tmp
Size 13KB
SHA256 2ace5ada0edf24384101640e76cf1fde76ba8a80d4edf48c1887edae4f7bedfe
MD5 ad63657e5c1eaabeae0e4227674b46dd
SHA1 1e525b138009b3b75c0fb120a80e5eddb663c815
SHA512 a8b21025c150bfdec37cdaddc2c7429ba564429b650449ae5ba4572263e563d49806baa17b9ae60581dd1e8f5e01d3742c829126ea93f074f5b479dc58a12173
SSDEEP 192:JR7McBh8DRMDv7zXTUPRpiTvhRmTZkFyt9KHsb+WNLVgnBViJdA0Qu2fyAeOzVyN:JRgmh81M73CXiQow2nudA62fDE
TLSH
T15E52C56AA924297B5CD7C65AF922BB96E3F1102160D81F88EAFCC92C14E76CD3217447
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bbdb94cd-7cfe-4d68-9afd-481f50487f5a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\bbdb94cd-7cfe-4d68-9afd-481f50487f5a.tmp
Size 12KB
SHA256 7926bea7d35988beaea11a0e629d76d196bff2cf7ce0cca926741c07a1e0a2d3
MD5 b7fb4dac59b59db5427509dcb8db2865
SHA1 13af434d1979dcaca5b2901dbdf4cdb925ceb778
SHA512 f27d93a53f84797f5f875ef34c298ae9cf5a3412b8009408cf4e99d048de65590fb5032ad28beedc8d4ef1d3b202a939460c07fab6178e4250ba9cbfdbd7391f
SSDEEP 192:JR7EcBhMDRYJv7zXTUPRpiTvmmlz9KHsb+WNngnBViJdYfaAeOzVyIsnAUgE:JRQmhM1YJ3CXi/owsnudYfLE
TLSH
T19E42B46AA914397B5CDBD65AF9367B92E3F1102220D42F84EAFCCA2C15E76CD3217007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cacfcd1c-761f-4131-b6c7-b52ea41dc793.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\cacfcd1c-761f-4131-b6c7-b52ea41dc793.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

cdec010f-5613-459b-b0c0-2a5958b77bb5.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\cdec010f-5613-459b-b0c0-2a5958b77bb5.tmp
Size 13KB
SHA256 14b1c752bd9eaab276d8052bdf66a2f8f686911fbfbaecefa096c3c564876545
MD5 03076f21cf62cf028f5606fc0c529123
SHA1 dc1023e64790e8b3021dfe5fd10180ab9d026022
SHA512 330e96c9959a1034f62398ac7fb7bee9358f02eb9ab0442faba6d35b89dacacc6054ea9d060918700386e8a736e467e9ea13fe229545127c4b84869f114cd7bc
SSDEEP 192:JR7PcBh8DRMEv7zXTUPRpiTvhRmTZkFyt9KHsb+WNLzNIgnBViJdA0Qu2fyAeOzO:JRLmh81Mg3CXiQowlnudA62fDE
TLSH
T17752C66AE92429BB4CD7C65AF922BB96E3F1102160D41F84FAFCC92C14E7ACD3207447
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e1497c2f-8827-4270-8101-94ce1727ec09.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\e1497c2f-8827-4270-8101-94ce1727ec09.tmp
Size 12KB
SHA256 900fb830f2ffae8e6da406649cb9cd0d06811802395f66d264d182c8a57a6ba4
MD5 f2cf6ded1273f5a40ff3be4e826548b5
SHA1 9d9c4fd6095768b3e06ec7e95b8a251ed663b290
SHA512 ecc1f7cf46cda8bf9853edfde49e0f193bb7e0d3b546027925000e9569d6d55aa32312c20935edd33346b6f4dfc23b65ae2a7c2c73e9f6d9d4732d4b3f248289
SSDEEP 192:JR7EcBhMDRCJv7zXTUPRpiTvmmlz9KHsb+WNngnBViJdYfaAeOzVyIsnAUgE:JRQmhM1CJ3CXi/owsnudYfLE
TLSH
T11142B46AA914397B5CDBD65AF9367B92E3F1102220942F84EAFCCA2C15E76CD3217007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e154e3f6-c48e-4f9b-bafd-7e141264dc4b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\e154e3f6-c48e-4f9b-bafd-7e141264dc4b.tmp
Size 12KB
SHA256 b18cf2ca0bea4c3f96d4a321a0192628926055a0d1e1b573c1526931cf5de32b
MD5 d689d991fc1d78a6c267254baaef2584
SHA1 a512556d771282bd96cf6bc7df9f3096ee2569cd
SHA512 21cc30a08f64c26846db570d6e47ef445d53af18ddcf1292f77502d992938c21c48545f9f6be3a26a5c63d23896f0cc02c00d8d1781a6c01fe65b0e97bee7b2a
SSDEEP 192:FR7EcBhMDRn3v7gXTUPRpiTvmVKVZI9KHsb+WNn+d4ViJdYfu5AeOzVyIsnAUgE:FRQmhM1nf0CXiWWyowwsudYfu6E
TLSH
T11542C46AA924397B5CDBD659F9727B92E3F1102220942F84E6FCCA2C15EB6CD3317007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5273f2f-d492-47b8-9ebe-5289a9c7b216.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\e5273f2f-d492-47b8-9ebe-5289a9c7b216.tmp
Size 12KB
SHA256 108ba997325da384f3595b4d54fc2df6ce8a071a4fc3bf6a66eca6c914add667
MD5 e66acd9fd3da41d27256293a2ed96718
SHA1 f1cb6b83e02103efbe3b83c8e772638d8f70de4d
SHA512 10a3c2be3db62a4233b55a4208cfd52c2b659b3f637269b200c7ec7c11a7cbe4e6d742452ef74efa3c9e0d482b3948c28b0b0526846a5aa454c90087789e8a28
SSDEEP 192:FR7EcBzMDRn3v7gAPRp2mhP9KHsb+WNn+d44H2fHAeOTVyIsnAUge:FRQmzM1nfVXlowwH2f6e
TLSH
T19B42A36EAA24357B4CDBD25AF9767B53E7F1002161982F84EAFC892C15EB6CC3217007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e90b062b-aedd-4b3b-bcb3-cb1f300f5ba8.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\e90b062b-aedd-4b3b-bcb3-cb1f300f5ba8.tmp
Size 11KB
SHA256 fa91eb81753715297c82c342fddafc702bc7789a906dee10646c13ba111e9e9e
MD5 4ff6208e4ef4c9486c7e278f54f81b30
SHA1 c430dd6dadf960d5e44d05e75d29a1e49e2e7f06
SHA512 50679e663dee90118bd122495073ed23717490ffe44cf44c124907052119dfa3d26834904b3ede935886d5ba8da21a377b647d52ac35d13949670b2393d592f0
SSDEEP 192:FR70MDRx3v7gAPRp2F9KHsb+WNn+d0fVAeOTVyIsnAUge:FR4M1xfVXOoww0fEe
TLSH
T1E0329329AE24357B5CDBD25AEA767B53E7F1002121942F84EAFC9A2C15EB6CC2317007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd94de97-5ab5-46fa-a696-08b26cdd1bd7.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\dd94de97-5ab5-46fa-a696-08b26cdd1bd7.tmp
Size 139KB
SHA256 48740ffc41f820238fe2fc85809a3c2692bea38829dae20706587956cd8a2e24
MD5 7ff77fa9de73dbac6a4da1454326f66e
SHA1 7fecaf4749f83dd3da084d8d1f30b716ae177c62
SHA512 9c0a425e44bd57737f17979bed48b44734a668d6c0486309ad6938bc77c666e69bdbfb73824421283973c9cab8095153317a4584f1fbf72aa50bb7fb179d1231
SSDEEP 3072:hQLxY2KwIK+h3Kl83X3d8yhp8p9AdJQiyqjQDrj1xuuq+fobLcvf2v:hcxlKwIKw3Kl8niyhpMWdJKAQ71xlq+Q
TLSH
T1A7D312F2B8E7CD724E7A214A75513271DCB2E8CE5448AC129DEE53CB42DB1D807C6C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e770c585-d191-4864-b96a-db72a300ce4e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\e770c585-d191-4864-b96a-db72a300ce4e.tmp
Size 139KB
SHA256 02483be9cc5983cbe859c6ed662dc30d2ce08d75fb402edf71589df685e99603
MD5 bb7e66de3fdac45537c3c660bb9ebc94
SHA1 1a481fe24859668c12a8a67232b095d84deb2110
SHA512 c4072af9b86355cc9db87e8766ba13f0a003bf497651e475c6a7b214758368bc3ba09aefe58cbfbad12c0aab02a1043dd72e00145252dd745f57e57aacd90f52
SSDEEP 3072:hQhxY2KwIK+h3Kl83X3d8yhp8p9AdJQiyqjQDrj1xuuq+fobLcvf2v:h2xlKwIKw3Kl8niyhpMWdJKAQ71xlq+Q
TLSH
T180D312F2B8E7CD624E7A214A75513271DCB2E8CE5448AC129DEE53CB42DB1D807C6C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

faa968b5-fd4d-40dd-9aae-75d8c7940414.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\faa968b5-fd4d-40dd-9aae-75d8c7940414.tmp
Size 138KB
SHA256 c54a0a0d5ee2141d54df296a02fdfe9a770a5c2dd920df8291ebe7ef1880cd75
MD5 62f12d1e41ccf4004929d55905bc7277
SHA1 6d93c0ac7011915744d2d6c368f86881d6a04f0b
SHA512 28d8b370604cb29c783eacb853e086c0fe006a02a2f49353cbea0adb159e6887e7a62f2ecf404eb1ad4627e3a3bc303c55dce87c25a68469715e98fcd6863f88
SSDEEP 3072:sQp8Y2KwIK+h3Kl83X3d8yhp8p9AdJQiyqjQDrj1xuuq+fobLcvf2v:sQ8lKwIKw3Kl8niyhpMWdJKAQ71xlq+Q
TLSH
T147D312F3B9F7CE724A6A614A64513171D8B2D8CC544858139DEE93CB46EB1E513C2C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffd46393-75fe-49ee-8a82-bb86fe780986.tmp

Path C:\Users\Admin\AppData\Local\Temp\ffd46393-75fe-49ee-8a82-bb86fe780986.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4476_102879000\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

Unconfirmed 814589.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 814589.crdownload
Size 2.4MB
SHA256 3e5efbc530923793421edd42430284048e220df64ec6e7240b1a7a44a61a2f5e
MD5 c1f82d06ff0d0152dc0090d41cb6e564
SHA1 7c9f0ec46b9ce4395f88014a47ea84903ee92ed2
SHA512 2291f996eaf97d6bb3bd4d9447f28cb57eb9dff7a2a9cb531b5f1284cc0479f75fb750cebf0c61cf648b1074d7ef24055b7d8585f9220968ed31dbd378c1c17f
SSDEEP 49152:Tpl07tmpd9tzvZoq8M+LLNEqM9sUT4g3r/66vsF/P4JxXovKR96Ix5nK2hMw:VjZoq2ENCb2ew
TLSH
T1A6C58C3A764460B8C076D178CA9B35D3EE7A38090F798AF3EED065158E671E05A7EF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download