Resubmissions
13/02/2024, 15:44
240213-s6rtbadg29613/02/2024, 14:50
240213-r71xyadc69613/02/2024, 14:44
240213-r4jt9adc33613/02/2024, 14:41
240213-r2we9scb21613/02/2024, 14:40
240213-r17f5scb2t1Analysis
- max time kernel
2699s - max time network
2678s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system - submitted
13/02/2024, 15:44
Static task
static1
Behavioral task
behavioral1
Sample
Untitled document.txt
Resource
win7-20231129-en
windows7-x64
0 signatures
1800 seconds
Behavioral task
behavioral2
Sample
Untitled document.txt
Resource
win10v2004-20231222-en
windows10-2004-x64
9 signatures
1800 seconds
General
- Target Untitled document.txt
- Size 173B
- Sample240213-s6rtbadg29
- SHA256 2c433ffb2a21830ae7f7e01afdaf08b9f015492355dacfa51fb139bf4a088f1c
- MD5 f388b88f4839029e5198fe8e2de36b36
- SHA1 305c1aaf8d44d9cb4f74cc67c1bbf084aca27acd
- SHA512 38e012cb4d4a65691234746bd06f01ef9835f75ea648bc3b0e83d32c220784efede34f44007171be79d87a27763f8d38383bf3e252c8507c4f744307e28ad457
- MD5 SHA1 SHA512
Score
6/10
Malware Config
Signatures
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
flow ioc 69 drive.google.com 70 drive.google.com 71 drive.google.com - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133523139281375946" chrome.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1472 chrome.exe 1472 chrome.exe 3012 chrome.exe 3012 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 1472 chrome.exe 1472 chrome.exe 1472 chrome.exe 1472 chrome.exe 1472 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1472 chrome.exe Token: SeCreatePagefilePrivilege 1472 chrome.exe Token: SeShutdownPrivilege 1472 chrome.exe Token: SeCreatePagefilePrivilege 1472 chrome.exe Token: SeShutdownPrivilege 1472 chrome.exe Token: SeCreatePagefilePrivilege 1472 chrome.exe Token: SeShutdownPrivilege 1472 chrome.exe Token: SeCreatePagefilePrivilege 1472 chrome.exe Token: SeShutdownPrivilege 1472 chrome.exe Token: SeCreatePagefilePrivilege 1472 chrome.exe Token: SeShutdownPrivilege 1472 chrome.exe Token: SeCreatePagefilePrivilege 1472 chrome.exe Token: SeShutdownPrivilege 1472 chrome.exe Token: SeCreatePagefilePrivilege 1472 chrome.exe Token: SeShutdownPrivilege 1472 chrome.exe Token: SeCreatePagefilePrivilege 1472 chrome.exe Token: SeShutdownPrivilege 1472 chrome.exe Token: SeCreatePagefilePrivilege 1472 chrome.exe Token: SeShutdownPrivilege 1472 chrome.exe Token: SeCreatePagefilePrivilege 1472 chrome.exe Token: SeShutdownPrivilege 1472 chrome.exe Token: SeCreatePagefilePrivilege 1472 chrome.exe Token: SeShutdownPrivilege 1472 chrome.exe Token: SeCreatePagefilePrivilege 1472 chrome.exe Token: SeShutdownPrivilege 1472 chrome.exe Token: SeCreatePagefilePrivilege 1472 chrome.exe Token: SeShutdownPrivilege 1472 chrome.exe Token: SeCreatePagefilePrivilege 1472 chrome.exe Token: SeShutdownPrivilege 1472 chrome.exe Token: SeCreatePagefilePrivilege 1472 chrome.exe Token: SeShutdownPrivilege 1472 chrome.exe Token: SeCreatePagefilePrivilege 1472 chrome.exe Token: SeShutdownPrivilege 1472 chrome.exe Token: SeCreatePagefilePrivilege 1472 chrome.exe Token: SeShutdownPrivilege 1472 chrome.exe Token: SeCreatePagefilePrivilege 1472 chrome.exe Token: SeShutdownPrivilege 1472 chrome.exe Token: SeCreatePagefilePrivilege 1472 chrome.exe Token: SeShutdownPrivilege 1472 chrome.exe Token: SeCreatePagefilePrivilege 1472 chrome.exe Token: SeShutdownPrivilege 1472 chrome.exe Token: SeCreatePagefilePrivilege 1472 chrome.exe Token: SeShutdownPrivilege 1472 chrome.exe Token: SeCreatePagefilePrivilege 1472 chrome.exe Token: SeShutdownPrivilege 1472 chrome.exe Token: SeCreatePagefilePrivilege 1472 chrome.exe Token: SeShutdownPrivilege 1472 chrome.exe Token: SeCreatePagefilePrivilege 1472 chrome.exe Token: SeShutdownPrivilege 1472 chrome.exe Token: SeCreatePagefilePrivilege 1472 chrome.exe Token: SeShutdownPrivilege 1472 chrome.exe Token: SeCreatePagefilePrivilege 1472 chrome.exe Token: SeShutdownPrivilege 1472 chrome.exe Token: SeCreatePagefilePrivilege 1472 chrome.exe Token: SeShutdownPrivilege 1472 chrome.exe Token: SeCreatePagefilePrivilege 1472 chrome.exe Token: SeShutdownPrivilege 1472 chrome.exe Token: SeCreatePagefilePrivilege 1472 chrome.exe Token: SeShutdownPrivilege 1472 chrome.exe Token: SeCreatePagefilePrivilege 1472 chrome.exe Token: SeShutdownPrivilege 1472 chrome.exe Token: SeCreatePagefilePrivilege 1472 chrome.exe Token: SeShutdownPrivilege 1472 chrome.exe Token: SeCreatePagefilePrivilege 1472 chrome.exe - Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1472 chrome.exe 1472 chrome.exe 1472 chrome.exe 1472 chrome.exe 1472 chrome.exe 1472 chrome.exe 1472 chrome.exe 1472 chrome.exe 1472 chrome.exe 1472 chrome.exe 1472 chrome.exe 1472 chrome.exe 1472 chrome.exe 1472 chrome.exe 1472 chrome.exe 1472 chrome.exe 1472 chrome.exe 1472 chrome.exe 1472 chrome.exe 1472 chrome.exe 1472 chrome.exe 1472 chrome.exe 1472 chrome.exe 1472 chrome.exe 1472 chrome.exe 1472 chrome.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1472 chrome.exe 1472 chrome.exe 1472 chrome.exe 1472 chrome.exe 1472 chrome.exe 1472 chrome.exe 1472 chrome.exe 1472 chrome.exe 1472 chrome.exe 1472 chrome.exe 1472 chrome.exe 1472 chrome.exe 1472 chrome.exe 1472 chrome.exe 1472 chrome.exe 1472 chrome.exe 1472 chrome.exe 1472 chrome.exe 1472 chrome.exe 1472 chrome.exe 1472 chrome.exe 1472 chrome.exe 1472 chrome.exe 1472 chrome.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1472 wrote to memory of 468 1472 chrome.exe 100 PID 1472 wrote to memory of 468 1472 chrome.exe 100 PID 1472 wrote to memory of 2820 1472 chrome.exe 102 PID 1472 wrote to memory of 2820 1472 chrome.exe 102 PID 1472 wrote to memory of 2820 1472 chrome.exe 102 PID 1472 wrote to memory of 2820 1472 chrome.exe 102 PID 1472 wrote to memory of 2820 1472 chrome.exe 102 PID 1472 wrote to memory of 2820 1472 chrome.exe 102 PID 1472 wrote to memory of 2820 1472 chrome.exe 102 PID 1472 wrote to memory of 2820 1472 chrome.exe 102 PID 1472 wrote to memory of 2820 1472 chrome.exe 102 PID 1472 wrote to memory of 2820 1472 chrome.exe 102 PID 1472 wrote to memory of 2820 1472 chrome.exe 102 PID 1472 wrote to memory of 2820 1472 chrome.exe 102 PID 1472 wrote to memory of 2820 1472 chrome.exe 102 PID 1472 wrote to memory of 2820 1472 chrome.exe 102 PID 1472 wrote to memory of 2820 1472 chrome.exe 102 PID 1472 wrote to memory of 2820 1472 chrome.exe 102 PID 1472 wrote to memory of 2820 1472 chrome.exe 102 PID 1472 wrote to memory of 2820 1472 chrome.exe 102 PID 1472 wrote to memory of 2820 1472 chrome.exe 102 PID 1472 wrote to memory of 2820 1472 chrome.exe 102 PID 1472 wrote to memory of 2820 1472 chrome.exe 102 PID 1472 wrote to memory of 2820 1472 chrome.exe 102 PID 1472 wrote to memory of 2820 1472 chrome.exe 102 PID 1472 wrote to memory of 2820 1472 chrome.exe 102 PID 1472 wrote to memory of 2820 1472 chrome.exe 102 PID 1472 wrote to memory of 2820 1472 chrome.exe 102 PID 1472 wrote to memory of 2820 1472 chrome.exe 102 PID 1472 wrote to memory of 2820 1472 chrome.exe 102 PID 1472 wrote to memory of 2820 1472 chrome.exe 102 PID 1472 wrote to memory of 2820 1472 chrome.exe 102 PID 1472 wrote to memory of 2820 1472 chrome.exe 102 PID 1472 wrote to memory of 2820 1472 chrome.exe 102 PID 1472 wrote to memory of 2820 1472 chrome.exe 102 PID 1472 wrote to memory of 2820 1472 chrome.exe 102 PID 1472 wrote to memory of 2820 1472 chrome.exe 102 PID 1472 wrote to memory of 2820 1472 chrome.exe 102 PID 1472 wrote to memory of 2820 1472 chrome.exe 102 PID 1472 wrote to memory of 2820 1472 chrome.exe 102 PID 1472 wrote to memory of 3128 1472 chrome.exe 103 PID 1472 wrote to memory of 3128 1472 chrome.exe 103 PID 1472 wrote to memory of 1868 1472 chrome.exe 104 PID 1472 wrote to memory of 1868 1472 chrome.exe 104 PID 1472 wrote to memory of 1868 1472 chrome.exe 104 PID 1472 wrote to memory of 1868 1472 chrome.exe 104 PID 1472 wrote to memory of 1868 1472 chrome.exe 104 PID 1472 wrote to memory of 1868 1472 chrome.exe 104 PID 1472 wrote to memory of 1868 1472 chrome.exe 104 PID 1472 wrote to memory of 1868 1472 chrome.exe 104 PID 1472 wrote to memory of 1868 1472 chrome.exe 104 PID 1472 wrote to memory of 1868 1472 chrome.exe 104 PID 1472 wrote to memory of 1868 1472 chrome.exe 104 PID 1472 wrote to memory of 1868 1472 chrome.exe 104 PID 1472 wrote to memory of 1868 1472 chrome.exe 104 PID 1472 wrote to memory of 1868 1472 chrome.exe 104 PID 1472 wrote to memory of 1868 1472 chrome.exe 104 PID 1472 wrote to memory of 1868 1472 chrome.exe 104 PID 1472 wrote to memory of 1868 1472 chrome.exe 104 PID 1472 wrote to memory of 1868 1472 chrome.exe 104 PID 1472 wrote to memory of 1868 1472 chrome.exe 104 PID 1472 wrote to memory of 1868 1472 chrome.exe 104 PID 1472 wrote to memory of 1868 1472 chrome.exe 104 PID 1472 wrote to memory of 1868 1472 chrome.exe 104
Processes
-
C:\Windows\system32\NOTEPAD.EXEC:\Windows\system32\NOTEPAD.EXE "C:\Users\Admin\AppData\Local\Temp\Untitled document.txt"1⤵PID:2044
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff8d9c69758,0x7ff8d9c69768,0x7ff8d9c697782⤵PID:468
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1728 --field-trial-handle=1840,i,11381474803087320526,5588844910422693112,131072 /prefetch:22⤵PID:2820
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1840,i,11381474803087320526,5588844910422693112,131072 /prefetch:82⤵PID:3128
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2244 --field-trial-handle=1840,i,11381474803087320526,5588844910422693112,131072 /prefetch:82⤵PID:1868
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2880 --field-trial-handle=1840,i,11381474803087320526,5588844910422693112,131072 /prefetch:12⤵PID:4392
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2860 --field-trial-handle=1840,i,11381474803087320526,5588844910422693112,131072 /prefetch:12⤵PID:4732
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4624 --field-trial-handle=1840,i,11381474803087320526,5588844910422693112,131072 /prefetch:12⤵PID:3992
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 --field-trial-handle=1840,i,11381474803087320526,5588844910422693112,131072 /prefetch:82⤵PID:4428
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 --field-trial-handle=1840,i,11381474803087320526,5588844910422693112,131072 /prefetch:82⤵PID:1696
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5316 --field-trial-handle=1840,i,11381474803087320526,5588844910422693112,131072 /prefetch:82⤵PID:3228
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5096 --field-trial-handle=1840,i,11381474803087320526,5588844910422693112,131072 /prefetch:12⤵PID:1248
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3480 --field-trial-handle=1840,i,11381474803087320526,5588844910422693112,131072 /prefetch:12⤵PID:1028
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1148 --field-trial-handle=1840,i,11381474803087320526,5588844910422693112,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3012
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:352
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000010
- Size 27KB
- SHA256 b0caf825c0456cc2e5ffef6801f361e34d5533c3bf55e3af0cb983e39343ba14
- MD5 8e726f705237de526d24bef1bf3a0631
- SHA1 32686afb7c33d0ea65c413d773bdff6a01a59899
- SHA512 c62c7e9ee6d1c5408811099f5bd5dde0ea20dd5d9d85deec980b3bab8344eefcd55143eda98b995d2418ca20522420f0d2d6c8f18bc0ecb48ad32b4a5e2e8c9c
- SSDEEP 768:zhTwQJmZeyqod4BSVNELj0mm4LhYb8SajO5/lCjTewb:zhVyzfVaLEbxR/lCjT1b
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 384B
- SHA256 46ee9bc6b4ec92a330b38d10995f4a4cb76709404a8c074a3bf3c67a5acb8f81
- MD5 fe0b0a42185a195d188b3680d281fd9c
- SHA1 eefa4d923e38e45ea65c0e1ea626e78be0748206
- SHA512 9e6f59ce8e5c5ee881f34e70f31a9b42a8db4d79c83c4bc3473c7908602c56b77dcd8b1839c5dbbaaf93398e6182cc29e9213381cc8bd7125f15b2feac17e674
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 4KB
- SHA256 09ac02255984dab9c60fa98c1b5a94c1368885dba13b28bcb8b269ebc4e081b7
- MD5 3ffdb55910590c4dc25852c9e7909c17
- SHA1 19cb37cd3495684c9d030383daf76e628bc9bc0f
- SHA512 5b0f929bdb879ec9b10092d6a62f374dbbe6aec813c0c3d60bf7bbbdfce350248cfccc050842db3880712f1d0a34c50db965e0944ef708a418fc7106caf870fb
- SSDEEP 96:JBj5ETQHuGiGdkGNGBGTGBG6GVG4GesGEGfWU8Gzh:JBj5SQHu/pqESmvAZfsDQWU8W
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 3KB
- SHA256 87a4c88aae47ccb83d85b7c0426dc287b728c79b39c014b30c553b09d013432b
- MD5 57d4d4e5bcc5d3843b6e36566e646233
- SHA1 a88e61b451051292e69711bc4e4134ab6386b101
- SHA512 27b9e05c5aad3f682c7478222ae9b0cc6e45a72abdc2fb4174d97a79e8ae215698c59e1f98f1ee832b3fcccaf5761243776348c6ddc92258dc2d8f819cd3b8bb
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 4KB
- SHA256 99992d34f58bebdef94c905521f17e18d85b8b955ce63247930f9fdeb729cc4a
- MD5 a60a2bad1108afe889e3a48dfbb3cf45
- SHA1 3ab6979c6179ff50344ab1cd9a33b2950b6cf54b
- SHA512 fb7f57dfff7be3287d3ed199682f995179dc40473057145b841318876e0bd8fc7193321cb9eaf4c02021123aa704e552568b7480aa68ff8e15d602fb255d7409
- SSDEEP 96:JBkTQHuGiGdkGNGBGTGBG6GdGjGyGTGwGi1GdsUGCGd/GfZGEh:JByQHu/pqESmvcQb8/zoheI5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 4KB
- SHA256 9d8ef750c83f6d268a78049845246a67f0a58e8116dada02accf23c1fd0bcb73
- MD5 6aa8207b664becd6f08770fa01cacd3b
- SHA1 a4df7177b8c21aad6a73c73d3a6e900b222dcd36
- SHA512 c22ff220c832c217bcbd896b527cff2527737e554b5efbd36befd6dce708eea703c18b822326cb79ddd483823c032ece971e0f4599075a17c689f09c3ba51fce
- SSDEEP 96:JBj5ETQHuGiGdkGNGBGTGBG6GdGjGyG3G9Gn21pjGEh:JBj5SQHu/pqESmvcQbwUg4pjB
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 1KB
- SHA256 09559380cb6c7f9d3ac92d8208cab878755d8fd6f39f2a194dca14a78158b5c1
- MD5 81b6bbfd42c549bc6ee153ed6f5ab9dd
- SHA1 8331676716e32c6713017140c0db7f624b0a4c6d
- SHA512 28bac4a5dfb0ba96e67238abea439aca8c4c0d7cf04e24058bd49677f80d69a82d98ce2b715462a7a0e66c44672717037231e7f6b4cff95a06efae0b61fbcb0d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 1KB
- SHA256 8c250dd998b0f1f14a870ff4a987c6859a9da2b2ed4b71fa2ed6c4a1e2eab41d
- MD5 5b8a0caf4339ebddf0d93c987fb6220f
- SHA1 6c896bda2826622230e079afc4d6adabe0e724f7
- SHA512 071abcf0f1e0338b04cc95bfe5c1a1127e9202507a9dc52fedbe8971a34019676060c21bc4ea021be08d9a44a4177c29cf857834272f6cde0a19ff660521cb96
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 6KB
- SHA256 fd7dfadaa6ada782b39baddd8dbeb6e8a27936769f4507fcd05148d87abee39a
- MD5 26840b16ece8d5067863788c27b0a399
- SHA1 326e89f77f143f4b18203b745424f404736c91df
- SHA512 355850f3dca91c5dfbad086d2fc87ac6b2c7e615bddd073ea03250c1c844a5db95fd684d058c4f44ae4bf1dc88c1b6ef142692b0741775c7345280359a9ba7a0
- SSDEEP 96:yR0+XugcVylRKIxSh8iZRy7Di+6MsmdeykX1TOWOScjVhYtjEsXt0/cg2Vup:ym+egNRKh8syy+F1kXsotjEsXtScPS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 6KB
- SHA256 0b57c43e5da62c8cb218fa1bfd1753885b18987158cdcd6dcd34f677333c5bdc
- MD5 4dedfc216ba9476f50f7eab335a3b7eb
- SHA1 a6959e66a169a2999a8dc3fc11efd62a6997988b
- SHA512 d539df797818a14f267ca07e8edcff85646f321b6b09af5a86bfb321840c99fe3f761b8c95d01192e2bab1aed8d0fb88d99c862d77299564aa21c72b43428ac5
- SSDEEP 96:yR0+XugcVylRKIxSh8iZRy7Di+6MsmdeyqkBuSMH+q/OWOScjVhYtjEsXt0/cg2S:ym+egNRKh8syy+FmkrFotjEsXtScPS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 15KB
- SHA256 fdb599de8e85c5fab7e996d11b264a684f6b50dceb19e3b275f72ef2d04c13f0
- MD5 2bdf1cbe35e0f608602987ac8dc5871d
- SHA1 60687357bd29fbfa4929d14319668b42da61a61b
- SHA512 8d52734582ba9388b99c95ce7efb796c81925e978f552040518f30f1a8cea0aa9294a1465f1c71ba0147a9c437ff20edc2485c5e73e5af05b3b94d2dda7a2819
- SSDEEP 384:CuLPLeLXk1kXqKf/pUZNCgVLH2HfknrUkHGdXeY14:jLPLsk1kXqKf/pUZNCgVLH2HfsrUoGkr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 239KB
- SHA256 b2eea4527cf5e97dd005df30c61c40966338f7226635c14f82c69bd5c212937a
- MD5 49648e25c370fed83b2fe316586e6c5a
- SHA1 29756a3afd372ec0aead8e069f1a8677622763d8
- SHA512 05e3a7c4489b95cbef31c906e10ae50dd2f7d6e44af06c0f1f0a7232c5a0e1cca57d0e2e4d35b6fbbbf1b043fea3c00beed9539f530a465037d38c80649927bc
- SSDEEP 6144:KLiE+kFfi929APrrk50HbJtQDGVG1fyE4+VqiQfgG:hE+QC29caMdtQD6G1fyE4CWgG
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512