d508f444542b2d7ac44a6e3c9a7a144ce7601bdaa5fbfd2de4de0e41efc50e99

Analysis

user interaction
yes
max time kernel
200s
max time network
203s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/07/2026, 07:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SynInstallerV2.exe
Size 11.8MB
Sample260704-jnt2aagy6n
SHA256 d508f444542b2d7ac44a6e3c9a7a144ce7601bdaa5fbfd2de4de0e41efc50e99
MD5 eb7600eada6f5fd145bc30c704907de6
SHA1 39a4a41ac8145536ed4150bf588ae1c3a1195101
SHA512 7e6bf9a65897405c22be2f8827d275430d81ae19715a383d86dae7a96e23fa1d6a09ef30e4e4a18b8deb8cd510a04df5df7b4fa2463b7765f31c986924ed57c6
SSDEEP 196608:gPurUNhLfJ/SNwxaZ1FOcWujU6Gfys1hEsDCtlnf5y6OkGT1T158:wBhTJ/SNwKFO7ujU6G6ghEs2vOR8
TLSH
T1CBC6022ABFC0DE44EFE693FE1C09688BBDC2111CA75E5212E5D91D381345B28A27D7D8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2104	SynInstallerV2.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2428	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134276249976945693"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
712	chrome.exe
712	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe
Token: SeShutdownPrivilege	1052	chrome.exe
Token: SeCreatePagefilePrivilege	1052	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe
1052	chrome.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 1052 wrote to memory of 5208	1052	chrome.exe	95
PID 1052 wrote to memory of 2428	1052	chrome.exe	96
PID 1052 wrote to memory of 2088	1052	chrome.exe	97
PID 1052 wrote to memory of 2088	1052	chrome.exe	97
PID 1052 wrote to memory of 5912	1052	chrome.exe	99
PID 1052 wrote to memory of 5912	1052	chrome.exe	99
PID 1052 wrote to memory of 3216	1052	chrome.exe	100
PID 1052 wrote to memory of 3216	1052	chrome.exe	100
PID 1052 wrote to memory of 3824	1052	chrome.exe	101
PID 1052 wrote to memory of 3824	1052	chrome.exe	101
PID 1052 wrote to memory of 2392	1052	chrome.exe	102
PID 1052 wrote to memory of 2392	1052	chrome.exe	102
PID 1052 wrote to memory of 4064	1052	chrome.exe	103
PID 1052 wrote to memory of 4064	1052	chrome.exe	103
PID 1052 wrote to memory of 1608	1052	chrome.exe	104
PID 1052 wrote to memory of 1608	1052	chrome.exe	104
PID 1052 wrote to memory of 3424	1052	chrome.exe	105
PID 1052 wrote to memory of 3424	1052	chrome.exe	105
PID 1052 wrote to memory of 1236	1052	chrome.exe	106
PID 1052 wrote to memory of 1236	1052	chrome.exe	106
PID 1052 wrote to memory of 972	1052	chrome.exe	107
PID 1052 wrote to memory of 5776	1052	chrome.exe	108
PID 1052 wrote to memory of 5776	1052	chrome.exe	108
PID 1052 wrote to memory of 4724	1052	chrome.exe	109
PID 1052 wrote to memory of 4724	1052	chrome.exe	109
PID 1052 wrote to memory of 1296	1052	chrome.exe	113
PID 1052 wrote to memory of 1296	1052	chrome.exe	113
PID 1052 wrote to memory of 920	1052	chrome.exe	115
PID 1052 wrote to memory of 920	1052	chrome.exe	115
PID 1052 wrote to memory of 1524	1052	chrome.exe	114
PID 1052 wrote to memory of 1524	1052	chrome.exe	114
PID 1052 wrote to memory of 1572	1052	chrome.exe	116
PID 1052 wrote to memory of 1572	1052	chrome.exe	116
PID 1052 wrote to memory of 2416	1052	chrome.exe	118
PID 1052 wrote to memory of 4336	1052	chrome.exe	119
PID 1052 wrote to memory of 2964	1052	chrome.exe	120
PID 1052 wrote to memory of 2416	1052	chrome.exe	118
PID 1052 wrote to memory of 4336	1052	chrome.exe	119
PID 1052 wrote to memory of 2964	1052	chrome.exe	120
PID 1052 wrote to memory of 424	1052	chrome.exe	122
PID 1052 wrote to memory of 3928	1052	chrome.exe	121
PID 1052 wrote to memory of 6120	1052	chrome.exe	123
PID 1052 wrote to memory of 424	1052	chrome.exe	122
PID 1052 wrote to memory of 3928	1052	chrome.exe	121
PID 1052 wrote to memory of 6120	1052	chrome.exe	123
PID 1052 wrote to memory of 2500	1052	chrome.exe	124
PID 1052 wrote to memory of 2500	1052	chrome.exe	124
PID 1052 wrote to memory of 4684	1052	chrome.exe	125
PID 1052 wrote to memory of 4684	1052	chrome.exe	125
PID 1052 wrote to memory of 1036	1052	chrome.exe	126
PID 1052 wrote to memory of 5604	1052	chrome.exe	127
PID 1052 wrote to memory of 5296	1052	chrome.exe	128
PID 1052 wrote to memory of 712	1052	chrome.exe	129

C:\Users\Admin\AppData\Local\Temp\SynInstallerV2.exe
"C:\Users\Admin\AppData\Local\Temp\SynInstallerV2.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2104

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4400

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0xb4,0x134,0x7ffbf318c728,0x7ffbf318c734,0x7ffbf318c740
  2⤵
  PID:5208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1496,i,12503043595157004325,13575356898316050492,524288 --field-trial-handle=2124,i,8897051931338553333,14720841143631054642,262144 --variations-seed-version --mojo-platform-channel-handle=2152 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1632,i,18179119901951091244,13024243940015089757,262144 --field-trial-handle=2124,i,8897051931338553333,14720841143631054642,262144 --variations-seed-version --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:2088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2328,i,5397231860139184746,9223361664131273005,524288 --field-trial-handle=2124,i,8897051931338553333,14720841143631054642,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:13
  2⤵
  PID:5912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3240,i,3577282327551961294,13211755621308740818,2097152 --field-trial-handle=2124,i,8897051931338553333,14720841143631054642,262144 --variations-seed-version --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:3216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3248,i,2831163470090832046,12353463817871790643,2097152 --field-trial-handle=2124,i,8897051931338553333,14720841143631054642,262144 --variations-seed-version --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:3824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4696,i,12149630567240196607,8889491614176690076,2097152 --field-trial-handle=2124,i,8897051931338553333,14720841143631054642,262144 --variations-seed-version --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:2392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4844,i,14905170831262139937,6037657547415745728,524288 --field-trial-handle=2124,i,8897051931338553333,14720841143631054642,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:14
  2⤵
  PID:4064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5032,i,15495929506467345731,16702489618410496148,524288 --field-trial-handle=2124,i,8897051931338553333,14720841143631054642,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:14
  2⤵
  PID:1608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5180,i,18144591098698100989,6718253578087951148,524288 --field-trial-handle=2124,i,8897051931338553333,14720841143631054642,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:14
  2⤵
  PID:3424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5452,i,5677986502605457028,3347766369341987804,2097152 --field-trial-handle=2124,i,8897051931338553333,14720841143631054642,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:1236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5556,i,11082239503105722239,15566538801801959157,524288 --field-trial-handle=2124,i,8897051931338553333,14720841143631054642,262144 --variations-seed-version --mojo-platform-channel-handle=3380 /prefetch:14
  2⤵
  PID:972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3224,i,8631262318060713043,10941593733294006666,2097152 --field-trial-handle=2124,i,8897051931338553333,14720841143631054642,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:5776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5648,i,13403476802329042354,8481635496100366774,2097152 --field-trial-handle=2124,i,8897051931338553333,14720841143631054642,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5932,i,5643044260084195298,8886414520918537510,2097152 --field-trial-handle=2124,i,8897051931338553333,14720841143631054642,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:1296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3948,i,3051686264297080044,5766569016557870343,524288 --field-trial-handle=2124,i,8897051931338553333,14720841143631054642,262144 --variations-seed-version --mojo-platform-channel-handle=3216 /prefetch:14
  2⤵
  PID:1524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=2988,i,2738269697030210800,15282000441168894417,2097152 --field-trial-handle=2124,i,8897051931338553333,14720841143631054642,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=2932,i,10582225906616493586,5664090236386756322,2097152 --field-trial-handle=2124,i,8897051931338553333,14720841143631054642,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:1572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6504,i,6484397837161284778,88107684619311948,2097152 --field-trial-handle=2124,i,8897051931338553333,14720841143631054642,262144 --variations-seed-version --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:2416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6240,i,15191020323114151820,290886334155473501,524288 --field-trial-handle=2124,i,8897051931338553333,14720841143631054642,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:14
  2⤵
  PID:4336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=4432,i,7271868390144960591,14285010385170726180,2097152 --field-trial-handle=2124,i,8897051931338553333,14720841143631054642,262144 --variations-seed-version --mojo-platform-channel-handle=2932 /prefetch:1
  2⤵
  PID:2964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6352,i,8169993100297200472,12450606917432941884,2097152 --field-trial-handle=2124,i,8897051931338553333,14720841143631054642,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:1
  2⤵
  PID:3928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6508,i,16388080631655382493,11423479481873916262,524288 --field-trial-handle=2124,i,8897051931338553333,14720841143631054642,262144 --variations-seed-version --mojo-platform-channel-handle=3820 /prefetch:14
  2⤵
  PID:424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=5604,i,1678761957943653461,6210892582150939138,2097152 --field-trial-handle=2124,i,8897051931338553333,14720841143631054642,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:1
  2⤵
  PID:6120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=3804,i,403187682351731636,13284683912759531502,2097152 --field-trial-handle=2124,i,8897051931338553333,14720841143631054642,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
  2⤵
  PID:2500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=3668,i,9600045130557007734,1752580180891675116,2097152 --field-trial-handle=2124,i,8897051931338553333,14720841143631054642,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:9
  2⤵
  PID:4684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6340,i,367222486659823319,9416092337250161195,524288 --field-trial-handle=2124,i,8897051931338553333,14720841143631054642,262144 --variations-seed-version --mojo-platform-channel-handle=260 /prefetch:14
  2⤵
  PID:1036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6128,i,8228654388837199156,18327046749427573932,524288 --field-trial-handle=2124,i,8897051931338553333,14720841143631054642,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:14
  2⤵
  PID:5604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5768,i,13252038654474116909,5873875777705056502,524288 --field-trial-handle=2124,i,8897051931338553333,14720841143631054642,262144 --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:14
  2⤵
  PID:5296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6128,i,708936174998954224,9382431639981585172,262144 --field-trial-handle=2124,i,8897051931338553333,14720841143631054642,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:712

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2968

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2976

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 960B
SHA256 8716942cdad84f90d5b5245975bac5016dc087faa5aabc53a5ecf5e4978cba17
MD5 d8f80f850f2defe771c4dea2e4757e6e
SHA1 b89b6f4089dabc2f9332cde9d8110aa4f9b6c418
SHA512 d0b055d430e43f9acb78ccb1cb897395a5c56ca91646b23b81321bde0d9423ba17d190b1b054442dbb17cee0872b98a2e8d0caa24ff3b571a7fe69bcb16d21d5
TLSH
T1CE1199812AC56059FF7C62B415E90F83E2324624F6E1077B0ED5616DB5F33EE0A05D53
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

76824055-81bd-44f5-9ad1-38001d005251.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\76824055-81bd-44f5-9ad1-38001d005251.tmp
Size 6KB
SHA256 f8411add6689554c226e9bd92bdf39b29e14c427c03eb10bf1ff0f8755e38445
MD5 d3e66ab68270604a975246b92bf23588
SHA1 7b1f0982508acbd565b33dda0afbbd0508317d5b
SHA512 e6717b974923bd15ce040390b5fd4110efdaa4da995229dbd7f35c4522bbb375f42786c2c788912e640edfe62643983a3ace70ff32bc8a8afecb309397dd4c3f
SSDEEP 192:DIy3PitFctQ/TEpAUfk6C0NPyNBHuaPiimXHbiQ:DIy3PitFctQ/TEpAok6C0NaNBHuaqimT
TLSH
T1F2E19EFBC3D8852DC91196F8AB156F1FCE2D0918431C3C66C9D8AE5B93E2871D21174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 7ebefbec15ee85ccfde1f06fb3711b28e8936abd5c2d18fd8356f547b7cc72c5
MD5 e8f5d01f39ab9ed30726efbe38e502ab
SHA1 a3fe6b9f9f6fa04ad3b735692bd1b97a791893fd
SHA512 0150d03257edb27f642a646741116b72b2a1259b5a1d77beeb0f4bfb8772eec26ecc491d09b91e6f6e81c0dc53e4e3b97e02482536b879444bdaf9602237a061
SSDEEP 192:SRTcBzWO3lrv7+fAPRp2cZzA9WHsb+WNl0rg46x2PeewVyIsnAUge:SRTmzhVTHXs4w1P2we
TLSH
T13242B56FAD2465BB4CCBC21AF961B757E2F1103575A42EC4EAFC8A6C12DB9CC6213017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 ff729b5d5a87c7cae0f111496ea0af65f70cfb8ceadcf6d3f4332e251c73b7c9
MD5 4e3f7d50fe66a27e18df9ae23ab5bc4f
SHA1 62688f73bb533d24cdb0a83749e2db006e33be58
SHA512 df5c12d00e7b59c08c38dcb2769cde3649495df5e3b587ef847fc0447d2fca1f1c4ffe97516fb792f7086d29207d2829398078428d243de3722dd1d9fe499efb
SSDEEP 192:SRTcBzWO3lFv7+f+PRp4cZzA9WHsb+WNl0rgmw3+6x2ReevVyIsnAUgE:SRTmzhV1RX+4w1hN2PE
TLSH
T13042B76FAD24657B4CDBD259FD61BB56E2F1103265A01EC4EAFCCA2C12EB9CC6213017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 17a0e07b3bf40051bd88075f626b27d1b275796ae64ca9192659e14469e64794
MD5 ba09e461330e135b28430ec5cb9b82d0
SHA1 f0daeef8ab0b2d17cd0f1307db4aa3b8634786c1
SHA512 494715aaae79fa3ebbbb5c4610ecb6314c6d2892e2f33fad7c41e3afdd572a376c2cb5ac665629c6ba6d235f98160be51eef10f9327033e5fd6cd9d8c9a828e0
SSDEEP 192:e8j4K6867KxkXqK4I40pUZNCgVLHrKHfFKslEdUCXzKD/hg+ErUkKN9Vb1ee8Z/Z:Vjjz67KxkXqKf/pUZNCgVLH2HfgslPC7
TLSH
T13032E827988D5A7F4FECD50CDC136F8BACB5025676684D2862FB9C0803A578E124A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 6a5f0d6d1752da4d6bdec17fd938aba87465cdf27f1b58a213bcf79d8765bc79
MD5 731eb4936797b3b938b21c905697bb44
SHA1 3c672d7c84c539194171d897f121054c13b04778
SHA512 8b894e0398a9d9fdab493a9553eaec2646336ac209388974d10ebb89ffa22d5c192adade905b6f35377c9b5a4d8d584ef811db4e74ec4171788a8b31f8ac136e
TLSH
T1E1B01200C04F5A00D90091B01244518821104F35C0106342A3F265FA98630E00760611
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 098375138af5fea0f7ce6843eca01f9f34554328fb8bbdc48d22807c24a320ac
MD5 0e85692cebd4f2d6b31f8f71547b21bc
SHA1 7bbb2a5dd8b5088a935febb4e93f9d6d68cb6d5e
SHA512 bc6621c353f44472ffbb9641f2eb143ad18774aa8c13549ecc34765bc3064f0540f2a63c9f56a7775008d0d814e96a24b8fd7c67692afeedef7fe1b1fd90257b
TLSH
T13CA0022146C91966CE2A467061F18645AF624D58B591530754B5CA58C86B5C48A01E00
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 77668a139bb7228a936d758d5312f9da2ba627810d826629d5d52035021eff61
MD5 6e7f75c062333e514453224338413636
SHA1 463dc083112189ca61972bb5c744c927ce674e9b
SHA512 330304d3c8cec2bf36a8b3dbaab193002c497741fe6f7ab924d28134b7132f285a287151c5b93b2bbd86500188d8d8a746e3b6846d824ecf87b046c811cd2efc
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 123KB
SHA256 43289555b1f86e5280301157f12b09b11a11051d6f9e2b41daf38d31e47a9a8e
MD5 6c4466091ac760df883586f8847b3fed
SHA1 4b7a648b493db081c3f51932ea5d37bc5cb1cf4c
SHA512 171f339c2c58dd22dbe3e1b27ac5198663c39f8508629bdcff68034310de9d5f9d48b4a84a9f8aec864763c2b31e683b0e04437657b334821d4adfb0cd8ccd82
SSDEEP 3072:T1mgCELZtCpXh5qTfATCuIbzQACV1cnJLL5c:pmg1kQfATCFbzQACjb
TLSH
T1D2C3137B4DE409FE171208D121422E65EED5A77FDF523E9C926A0BF516CBC8A1343823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 122KB
SHA256 423609248d6ea96bda302c512d45a979e040c87401202563f7ea16d7e33064f7
MD5 70f7c5c50d31c75dabf546a0bdebfd4e
SHA1 9f40f4c85b1c6f89e541e8e0f8afaf5692544db5
SHA512 34bb2df613f27aed523bbc68729c4e4236f922fdd0b92e4878177dc374ffe09e99e87eb6d996e105f1f025e0495fb348e26730d1cc23adc397af3b67cff8a3b2
SSDEEP 3072:B1mgCELZtCpXh5qTfATCuIbzQACV1cnJLL5c:vmg1kQfATCFbzQACjb
TLSH
T1CFC3125A89F40DBE1752046221421E76F3D6A77FDE632EEC936B07F616C7C8A1387422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 122KB
SHA256 a05a113e9991ed701d44b115d00643fe8a87273b02041512cc9d248ed8e9a6a5
MD5 52d4e5afff5ff3d310ca6a5a3d8c5594
SHA1 64d0b37a85a1d6d49ba5db9139851c16a320968c
SHA512 e8545310794992de339d0b76a293ac4f88d1a5cecb49121d74d57d474dc21e0abadadf3407d0c002729c4c231601807bc43185130608df35f2bf08a037b78d8d
SSDEEP 3072:c1mgCELZtCpXh5qTfATCuIbzQACV1cnJLL5c:qmg1kQfATCFbzQACjb
TLSH
T19AC3125A89F40DBE1752046221421E76F3D6A77FDE632EEC936B07F616C7C8A1387412
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 9eb71ae784e1e90b972c821fed0183e7db42389a9c8f3c45635d568f403003e1
MD5 cc8a06b638610a75bbf98d57a2a81d5a
SHA1 a1d67363659134e9e2b7e151774a2ca087a8a68f
SHA512 8ea27d1651739ddde3e69b6ac468344a09915e2c819ef7b0e9b4ca8f729c41d8270f6a9433487aae8bb80d4695cf6bacefcb649ea848b1f174b74994597362fa
SSDEEP 96:JC6rd+FKJXPXDJAKWTeVslfnbj5EsVRDotok56xDEB6ydGyvyv1PVibmjiv4a:JC6PJX/dAeyt/3DUDMoFw7PVibqM
TLSH
T1DCA11A72686C5DB748F2D089B9832F03CF6521979961EFC899EC4B1C05EB0E80343973
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1052_1146617252\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2104-0-0x0000000002C60000-0x0000000002C61000-memory.dmp

Download