Resubmissions
02-02-2023 03:06
230202-dlzwvsee69 1002-02-2023 03:04
230202-dk4tesee62 102-02-2023 02:57
230202-df3qkaee33 6Analysis
-
max time kernel
344s -
max time network
349s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
02-02-2023 02:57
Static task
static1
Behavioral task
behavioral1
Sample
Petya.A.zip
Resource
win7-20220812-en
General
-
Target
Petya.A.zip
-
Size
133KB
-
MD5
82e7fcb4516fe8aa646853a3dd996b52
-
SHA1
548f18a1d50b0a0eb38a4a7d5e31212e423071c1
-
SHA256
373c74b50f3db82289c7d04e2ae5b49af8a4f0f5aef2ebd62dd633dc16f76306
-
SHA512
687560aaa21657bd00b0dafb0efc43cc23a3451f04c874bcdf1e369a4495bea92da0d8674efcb188857735e49127530aca8ae7b69f9d0c4d0580d3223bf98119
-
SSDEEP
3072:pxTRgFloaoWrgdNHWkw1SBq25tdRRBXQmEZP6u3OP9HCmeDuqJkBgtBI38Etu8q5:HTRgFloQDuqJegtBI38EY8qiy1v+m//Z
Malware Config
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
firefox.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies registry class 2 IoCs
Processes:
firefox.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache firefox.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_Classes\Local Settings firefox.exe -
NTFS ADS 1 IoCs
Processes:
firefox.exedescription ioc process File created C:\Users\Admin\AppData\Local\Temp\Petya.A-1.zip:Zone.Identifier firefox.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
chrome.exechrome.exepid process 980 chrome.exe 1076 chrome.exe 1076 chrome.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
firefox.exeAUDIODG.EXEdescription pid process Token: SeDebugPrivilege 2660 firefox.exe Token: SeDebugPrivilege 2660 firefox.exe Token: SeDebugPrivilege 2660 firefox.exe Token: 33 564 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 564 AUDIODG.EXE Token: 33 564 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 564 AUDIODG.EXE -
Suspicious use of FindShellTrayWindow 39 IoCs
Processes:
chrome.exefirefox.exepid process 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 2660 firefox.exe 2660 firefox.exe 2660 firefox.exe 2660 firefox.exe -
Suspicious use of SendNotifyMessage 35 IoCs
Processes:
chrome.exefirefox.exepid process 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 2660 firefox.exe 2660 firefox.exe 2660 firefox.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
firefox.exepid process 2660 firefox.exe 2660 firefox.exe 2660 firefox.exe 2660 firefox.exe 2660 firefox.exe 2660 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 1076 wrote to memory of 1744 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 1744 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 1744 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 1416 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 1416 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 1416 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 1416 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 1416 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 1416 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 1416 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 1416 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 1416 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 1416 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 1416 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 1416 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 1416 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 1416 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 1416 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 1416 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 1416 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 1416 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 1416 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 1416 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 1416 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 1416 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 1416 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 1416 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 1416 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 1416 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 1416 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 1416 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 1416 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 1416 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 1416 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 1416 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 1416 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 1416 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 1416 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 1416 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 1416 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 1416 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 1416 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 1416 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 1416 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 980 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 980 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 980 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 1824 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 1824 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 1824 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 1824 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 1824 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 1824 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 1824 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 1824 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 1824 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 1824 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 1824 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 1824 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 1824 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 1824 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 1824 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 1824 1076 chrome.exe chrome.exe PID 1076 wrote to memory of 1824 1076 chrome.exe chrome.exe
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Petya.A.zip1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6344f50,0x7fef6344f60,0x7fef6344f702⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1036,5456341762814784301,6458516154471862981,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1068 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1036,5456341762814784301,6458516154471862981,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1244 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1036,5456341762814784301,6458516154471862981,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1824 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1036,5456341762814784301,6458516154471862981,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2020 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1036,5456341762814784301,6458516154471862981,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2032 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1036,5456341762814784301,6458516154471862981,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2960 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1036,5456341762814784301,6458516154471862981,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3296 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1036,5456341762814784301,6458516154471862981,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1036,5456341762814784301,6458516154471862981,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3380 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1036,5456341762814784301,6458516154471862981,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3540 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6344f50,0x7fef6344f60,0x7fef6344f702⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=996,2197117573882414245,4708690546687500002,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1012 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=996,2197117573882414245,4708690546687500002,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1352 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6344f50,0x7fef6344f60,0x7fef6344f702⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1060,5736795597655710384,13274070580620459352,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1068 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1060,5736795597655710384,13274070580620459352,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1436 /prefetch:82⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2660.0.85775812\841333631" -parentBuildID 20200403170909 -prefsHandle 1196 -prefMapHandle 1188 -prefsLen 1 -prefMapSize 220106 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2660 "\\.\pipe\gecko-crash-server-pipe.2660" 1276 gpu3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2660.3.1570906141\1267102619" -childID 1 -isForBrowser -prefsHandle 1712 -prefMapHandle 1700 -prefsLen 156 -prefMapSize 220106 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2660 "\\.\pipe\gecko-crash-server-pipe.2660" 1720 tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2660.13.1981673082\1806729135" -childID 2 -isForBrowser -prefsHandle 2688 -prefMapHandle 2680 -prefsLen 6938 -prefMapSize 220106 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2660 "\\.\pipe\gecko-crash-server-pipe.2660" 2700 tab3⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4381⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.datFilesize
40B
MD5ca0c469b8152e7e371cf08d73b026433
SHA107a87b72da129c4af371a735398bd1aefdb0e74a
SHA25649bf5be3f0eae3a1851a7ac6e98c2aacfd41d04b0bee3f34ea75d3fe76ac4996
SHA5122a051c82401a439602f6400b7af49353c869f464815dbefe068c3ad6249f7875e42d4c486dfdc22e60d54f711afc339491bb74922bba551df98e9ec0780dbafa
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.datFilesize
40B
MD5ca0c469b8152e7e371cf08d73b026433
SHA107a87b72da129c4af371a735398bd1aefdb0e74a
SHA25649bf5be3f0eae3a1851a7ac6e98c2aacfd41d04b0bee3f34ea75d3fe76ac4996
SHA5122a051c82401a439602f6400b7af49353c869f464815dbefe068c3ad6249f7875e42d4c486dfdc22e60d54f711afc339491bb74922bba551df98e9ec0780dbafa
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
109KB
MD506dcdf758c0a5fd1442f6e0ab9e1c8a4
SHA148d1ca8cf0c5a1e33760fc09b684574b9a967d79
SHA25655e179bbc2f3d37bb38b2c1545de99e0b22de1820903f6d5dbd809e15705fa3c
SHA5126fe9e223ce0c9481f544d7dcdb54e560c35f5d76c14866c67a5a01d7ed6817f38bf85bd7839ef18454705d6473c2273db3c428ea6010670a4fe70086cc907b1d
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
109KB
MD58aa65fb7494b9f46b297f720a03665ed
SHA14103769660cd0e09f8a816c76da98005e22d4270
SHA256466abbb87ee2087e51a7cf1d6cf765605cf34e01568cc61792e176098069d558
SHA5127524efb09a366a4b40de962e422c011ea70c92995484b2e2e34c49d8702484c2124485b7f2b235e79f9d1d5a68e85da3c94647b2b2a7ce94fe24651e76c7f558
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_1Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_1Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
\??\PIPE\samrMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\PIPE\samrMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\pipe\crashpad_1076_IPTLHJIDJVPNEQBHMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\pipe\crashpad_2160_MHLYFGZEYIEFFFPRMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\pipe\crashpad_2360_SMYDTWFHIMDZRKOOMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e