Resubmissions
10/08/2023, 22:41
230810-2mj4sshd67107/08/2023, 20:48
230807-zlwebshd39106/08/2023, 01:58
230806-cd7q3agh6w105/08/2023, 22:43
230805-2ndcmsfa69104/08/2023, 23:11
230804-2593yaga7y104/08/2023, 15:03
230804-se8bzsch5z103/08/2023, 22:07
230803-11w5vagc74103/08/2023, 11:46
230803-nxsl2aec4y103/08/2023, 00:07
230803-aef9dsad88102/08/2023, 19:21
230802-x2q4faaf5s1Analysis
- max time kernel
53s - max time network
49s - platform
windows10-2004_x64 - resource
win10v2004-20230703-en - resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system - submitted
03/08/2023, 00:07
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://shop.awesomatix.com/auth
Resource
win10v2004-20230703-en
windows10-2004-x64
7 signatures
1800 seconds
General
- Target https://shop.awesomatix.com/auth
- Sample230803-aef9dsad88
Score
1/10
Malware Config
Signatures
- Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133354948616905860" chrome.exe - Suspicious behavior: EnumeratesProcesses 49 IoCs
pid Process 4928 chrome.exe 4928 chrome.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4928 chrome.exe 4928 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4928 chrome.exe Token: SeCreatePagefilePrivilege 4928 chrome.exe Token: SeDebugPrivilege 1204 taskmgr.exe Token: SeSystemProfilePrivilege 1204 taskmgr.exe Token: SeCreateGlobalPrivilege 1204 taskmgr.exe Token: SeShutdownPrivilege 4928 chrome.exe Token: SeCreatePagefilePrivilege 4928 chrome.exe Token: SeShutdownPrivilege 4928 chrome.exe Token: SeCreatePagefilePrivilege 4928 chrome.exe Token: SeShutdownPrivilege 4928 chrome.exe Token: SeCreatePagefilePrivilege 4928 chrome.exe Token: SeShutdownPrivilege 4928 chrome.exe Token: SeCreatePagefilePrivilege 4928 chrome.exe Token: SeShutdownPrivilege 4928 chrome.exe Token: SeCreatePagefilePrivilege 4928 chrome.exe Token: SeShutdownPrivilege 4928 chrome.exe Token: SeCreatePagefilePrivilege 4928 chrome.exe Token: SeShutdownPrivilege 4928 chrome.exe Token: SeCreatePagefilePrivilege 4928 chrome.exe Token: SeShutdownPrivilege 4928 chrome.exe Token: SeCreatePagefilePrivilege 4928 chrome.exe Token: SeShutdownPrivilege 4928 chrome.exe Token: SeCreatePagefilePrivilege 4928 chrome.exe Token: SeShutdownPrivilege 4928 chrome.exe Token: SeCreatePagefilePrivilege 4928 chrome.exe Token: SeShutdownPrivilege 4928 chrome.exe Token: SeCreatePagefilePrivilege 4928 chrome.exe Token: SeShutdownPrivilege 4928 chrome.exe Token: SeCreatePagefilePrivilege 4928 chrome.exe Token: SeShutdownPrivilege 4928 chrome.exe Token: SeCreatePagefilePrivilege 4928 chrome.exe Token: SeShutdownPrivilege 4928 chrome.exe Token: SeCreatePagefilePrivilege 4928 chrome.exe Token: SeShutdownPrivilege 4928 chrome.exe Token: SeCreatePagefilePrivilege 4928 chrome.exe Token: SeShutdownPrivilege 4928 chrome.exe Token: SeCreatePagefilePrivilege 4928 chrome.exe Token: SeShutdownPrivilege 4928 chrome.exe Token: SeCreatePagefilePrivilege 4928 chrome.exe Token: SeShutdownPrivilege 4928 chrome.exe Token: SeCreatePagefilePrivilege 4928 chrome.exe Token: SeShutdownPrivilege 4928 chrome.exe Token: SeCreatePagefilePrivilege 4928 chrome.exe Token: SeShutdownPrivilege 4928 chrome.exe Token: SeCreatePagefilePrivilege 4928 chrome.exe Token: SeShutdownPrivilege 4928 chrome.exe Token: SeCreatePagefilePrivilege 4928 chrome.exe Token: SeShutdownPrivilege 4928 chrome.exe Token: SeCreatePagefilePrivilege 4928 chrome.exe Token: SeShutdownPrivilege 4928 chrome.exe Token: SeCreatePagefilePrivilege 4928 chrome.exe Token: SeShutdownPrivilege 4928 chrome.exe Token: SeCreatePagefilePrivilege 4928 chrome.exe Token: SeShutdownPrivilege 4928 chrome.exe Token: SeCreatePagefilePrivilege 4928 chrome.exe Token: SeShutdownPrivilege 4928 chrome.exe Token: SeCreatePagefilePrivilege 4928 chrome.exe Token: SeShutdownPrivilege 4928 chrome.exe Token: SeCreatePagefilePrivilege 4928 chrome.exe Token: SeShutdownPrivilege 4928 chrome.exe Token: SeCreatePagefilePrivilege 4928 chrome.exe Token: SeShutdownPrivilege 4928 chrome.exe Token: SeCreatePagefilePrivilege 4928 chrome.exe Token: SeShutdownPrivilege 4928 chrome.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe 1204 taskmgr.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4928 wrote to memory of 3832 4928 chrome.exe 80 PID 4928 wrote to memory of 3832 4928 chrome.exe 80 PID 4928 wrote to memory of 4580 4928 chrome.exe 82 PID 4928 wrote to memory of 4580 4928 chrome.exe 82 PID 4928 wrote to memory of 4580 4928 chrome.exe 82 PID 4928 wrote to memory of 4580 4928 chrome.exe 82 PID 4928 wrote to memory of 4580 4928 chrome.exe 82 PID 4928 wrote to memory of 4580 4928 chrome.exe 82 PID 4928 wrote to memory of 4580 4928 chrome.exe 82 PID 4928 wrote to memory of 4580 4928 chrome.exe 82 PID 4928 wrote to memory of 4580 4928 chrome.exe 82 PID 4928 wrote to memory of 4580 4928 chrome.exe 82 PID 4928 wrote to memory of 4580 4928 chrome.exe 82 PID 4928 wrote to memory of 4580 4928 chrome.exe 82 PID 4928 wrote to memory of 4580 4928 chrome.exe 82 PID 4928 wrote to memory of 4580 4928 chrome.exe 82 PID 4928 wrote to memory of 4580 4928 chrome.exe 82 PID 4928 wrote to memory of 4580 4928 chrome.exe 82 PID 4928 wrote to memory of 4580 4928 chrome.exe 82 PID 4928 wrote to memory of 4580 4928 chrome.exe 82 PID 4928 wrote to memory of 4580 4928 chrome.exe 82 PID 4928 wrote to memory of 4580 4928 chrome.exe 82 PID 4928 wrote to memory of 4580 4928 chrome.exe 82 PID 4928 wrote to memory of 4580 4928 chrome.exe 82 PID 4928 wrote to memory of 4580 4928 chrome.exe 82 PID 4928 wrote to memory of 4580 4928 chrome.exe 82 PID 4928 wrote to memory of 4580 4928 chrome.exe 82 PID 4928 wrote to memory of 4580 4928 chrome.exe 82 PID 4928 wrote to memory of 4580 4928 chrome.exe 82 PID 4928 wrote to memory of 4580 4928 chrome.exe 82 PID 4928 wrote to memory of 4580 4928 chrome.exe 82 PID 4928 wrote to memory of 4580 4928 chrome.exe 82 PID 4928 wrote to memory of 4580 4928 chrome.exe 82 PID 4928 wrote to memory of 4580 4928 chrome.exe 82 PID 4928 wrote to memory of 4580 4928 chrome.exe 82 PID 4928 wrote to memory of 4580 4928 chrome.exe 82 PID 4928 wrote to memory of 4580 4928 chrome.exe 82 PID 4928 wrote to memory of 4580 4928 chrome.exe 82 PID 4928 wrote to memory of 4580 4928 chrome.exe 82 PID 4928 wrote to memory of 4580 4928 chrome.exe 82 PID 4928 wrote to memory of 4972 4928 chrome.exe 83 PID 4928 wrote to memory of 4972 4928 chrome.exe 83 PID 4928 wrote to memory of 2360 4928 chrome.exe 84 PID 4928 wrote to memory of 2360 4928 chrome.exe 84 PID 4928 wrote to memory of 2360 4928 chrome.exe 84 PID 4928 wrote to memory of 2360 4928 chrome.exe 84 PID 4928 wrote to memory of 2360 4928 chrome.exe 84 PID 4928 wrote to memory of 2360 4928 chrome.exe 84 PID 4928 wrote to memory of 2360 4928 chrome.exe 84 PID 4928 wrote to memory of 2360 4928 chrome.exe 84 PID 4928 wrote to memory of 2360 4928 chrome.exe 84 PID 4928 wrote to memory of 2360 4928 chrome.exe 84 PID 4928 wrote to memory of 2360 4928 chrome.exe 84 PID 4928 wrote to memory of 2360 4928 chrome.exe 84 PID 4928 wrote to memory of 2360 4928 chrome.exe 84 PID 4928 wrote to memory of 2360 4928 chrome.exe 84 PID 4928 wrote to memory of 2360 4928 chrome.exe 84 PID 4928 wrote to memory of 2360 4928 chrome.exe 84 PID 4928 wrote to memory of 2360 4928 chrome.exe 84 PID 4928 wrote to memory of 2360 4928 chrome.exe 84 PID 4928 wrote to memory of 2360 4928 chrome.exe 84 PID 4928 wrote to memory of 2360 4928 chrome.exe 84 PID 4928 wrote to memory of 2360 4928 chrome.exe 84 PID 4928 wrote to memory of 2360 4928 chrome.exe 84
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://shop.awesomatix.com/auth1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff987c29758,0x7ff987c29768,0x7ff987c297782⤵PID:3832
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1792 --field-trial-handle=1864,i,12838594268168374106,6391259387506890312,131072 /prefetch:22⤵PID:4580
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1864,i,12838594268168374106,6391259387506890312,131072 /prefetch:82⤵PID:4972
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2236 --field-trial-handle=1864,i,12838594268168374106,6391259387506890312,131072 /prefetch:82⤵PID:2360
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2896 --field-trial-handle=1864,i,12838594268168374106,6391259387506890312,131072 /prefetch:12⤵PID:4124
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2876 --field-trial-handle=1864,i,12838594268168374106,6391259387506890312,131072 /prefetch:12⤵PID:2816
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5048 --field-trial-handle=1864,i,12838594268168374106,6391259387506890312,131072 /prefetch:82⤵PID:1296
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4992 --field-trial-handle=1864,i,12838594268168374106,6391259387506890312,131072 /prefetch:82⤵PID:4392
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:652
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1204
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 168B
- SHA256 322d99e31654b09bff42d1c1badce8f235a5e0f5bc118b65a2e1ceebf6cfb36e
- MD5 d0a7369b2433669eed8e4336458883cd
- SHA1 0ce7f11a6495ffa181ef6f25b3b8745e31049d4a
- SHA512 cd9cee2e4bd57fd27959adbf815ac19b43603f69d8f53078a2e54b92ed42e74e8d297e97fa407afe1fee45374b13749aab2b57135e691d6163c8b8d1cb4bf8d5
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 537B
- SHA256 94293fd50004f63e33f1a449522dc268363b43b739a97ed99fb98f82d222e2ca
- MD5 8dc3cff5ee467fb46482cb1b333a9888
- SHA1 de00186c4ae8afd2b2f733df68ada44a3ae9aac5
- SHA512 e76c0b9a383bd285a3a46e3627b7845c231a1dfdd2767dee9f75b4133bbe847faf74b06df07b8cbe6505f67fdcc7e0fad95e3c69330ff46c8fbdfa07be75d812
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 537B
- SHA256 3a651ffdf50bf8aa5b76c0d790fc2b1c23c1b41f326959af4e38011fdb71509f
- MD5 1ce291f27b23f3ea6b088a6510795a81
- SHA1 2deeef4cc40c6a27294dcec842ddbe9e45b41ee4
- SHA512 11a8818d4a3d7b2cac109043a8eadf71fb61fbeb73ac191109b8ec2c89e4ce40d218d8ff3e4db50cbfb8f7d1f62b77216a922587e932050ebc494b9388393aaf
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 6KB
- SHA256 641a777dd10d6b05da9962c428cc419616da4c581bb4cc9c4edff769318e6eaa
- MD5 c281dc64822b3eafd0378a729eef589a
- SHA1 e4d9717d948f586d1658b2cfff59a738ab253ae9
- SHA512 1c884903ee0a30e4c125d5d7677ad3b32e941107a4b35f95a0d7da6113027fda9c98c98766c6e935e146fd77394d7ef655f778679dd3dbcb2ce1a0f8b689bde9
- SSDEEP 192:TuCNI1jrfrI8syy+FJkpribIotjEsXtScPS:T1MGyx6raLtIsXtScPS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 6KB
- SHA256 6c69cdf65ca2651908a5d6a4d2478d750a8d42468efe7ae832879c42d74c5e8e
- MD5 4b8641a5130cd43d6740e29421b71c58
- SHA1 23b4565f4dd514daeeb4693abaa7981f7e36859e
- SHA512 b5f77c341ad6afa692d4df0fe0ed6c2fa102671c1a4ec024f2c81ce53a207376207a30700f5bcfaeb3846d5fa27923408eac13f99e19bec217e45e7b0e4f5aeb
- SSDEEP 192:TuCNI1jrfrh8syy+F8k45bIotjEsXtScPS:T1MjyxCFLtIsXtScPS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 6KB
- SHA256 863aa5591985f5b52a53c89206236e48bc7af45278f7c7daefcb0788ed7dc171
- MD5 1dc20af39d75257a026e4a6e0994d3c1
- SHA1 b16868caf97a8ba5f3a830512063658b7a4a4041
- SHA512 c984eccd39e982cac86c17cd0c3710fd2ab4e17f35225b7ec854936089b9985a169b667c195f61f65fdd3b1416f0fce5b124dfb41b9db3d02a57f02b959afec3
- SSDEEP 192:TuCNI1jrfrI8syy+FRk1MbIotjEsXtScPS:T1MGyxyELtIsXtScPS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 87KB
- SHA256 890d2cb76afc14fc8b8ff945540782a4bd576e016bf899be26695acbfc8039a2
- MD5 5b27847b838f46bd38cf27356e10f13c
- SHA1 3dcea3e9d0c4a703c3435462f7acdfede0332796
- SHA512 0a2643a856a70ec86dc9c683df5d8cae770f7df8de21b46e53a7d0a5ed9bdc51ebb6e378408f4aedbe716743583810ef6406589d94a0270909b4d9624a4b8c8a
- SSDEEP 1536:xBZ/0F7wh4WJK9sHAi/quHrOvKs6BIK2P0bRMPJU+2obeVzAVu2:xBZ/0FQ4Wl3/quHKvx1K2P9wjV32
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512