aa3c2ebff55ee853e219c2244934c9199d32bdd090a79fce5a1079a1fe9aa3ec

Analysis

max time kernel
419s
max time network
420s
platform
windows10-1703_x64
resource
win10-20240404-es
resource tags

arch:x64arch:x86image:win10-20240404-eslocale:es-esos:windows10-1703-x64systemwindows
submitted
10/06/2024, 03:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Prison Life FREE GUI - KILL ALL & MORE!.txt
Size 106B
Sample240610-efwspacd35
SHA256 aa3c2ebff55ee853e219c2244934c9199d32bdd090a79fce5a1079a1fe9aa3ec
MD5 00b4f659c22ee657242d2a94208ce28f
SHA1 bb308480b62e3f6b7139aa5b33fe74d4c65907c8
SHA512 e01f3f6ac54c9dac1f9799d747d0caa1eb6db21c10091d2b0d4e323b8c21ad267698573998fb3615ef63d52df5d7cc549f5988f81ece8b6f1fd38a8b74f18142
MD5 SHA1 SHA512

Score

7^/10

Malware Config

Signatures

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	54.203.171.68

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133624652299082932"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3980	chrome.exe
3980	chrome.exe
4856	chrome.exe
4856	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe
Token: SeShutdownPrivilege	3980	chrome.exe
Token: SeCreatePagefilePrivilege	3980	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe
3980	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3980 wrote to memory of 500	3980	chrome.exe	75
PID 3980 wrote to memory of 500	3980	chrome.exe	75
PID 3980 wrote to memory of 4336	3980	chrome.exe	77
PID 3980 wrote to memory of 4336	3980	chrome.exe	77
PID 3980 wrote to memory of 4336	3980	chrome.exe	77
PID 3980 wrote to memory of 4336	3980	chrome.exe	77
PID 3980 wrote to memory of 4336	3980	chrome.exe	77
PID 3980 wrote to memory of 4336	3980	chrome.exe	77
PID 3980 wrote to memory of 4336	3980	chrome.exe	77
PID 3980 wrote to memory of 4336	3980	chrome.exe	77
PID 3980 wrote to memory of 4336	3980	chrome.exe	77
PID 3980 wrote to memory of 4336	3980	chrome.exe	77
PID 3980 wrote to memory of 4336	3980	chrome.exe	77
PID 3980 wrote to memory of 4336	3980	chrome.exe	77
PID 3980 wrote to memory of 4336	3980	chrome.exe	77
PID 3980 wrote to memory of 4336	3980	chrome.exe	77
PID 3980 wrote to memory of 4336	3980	chrome.exe	77
PID 3980 wrote to memory of 4336	3980	chrome.exe	77
PID 3980 wrote to memory of 4336	3980	chrome.exe	77
PID 3980 wrote to memory of 4336	3980	chrome.exe	77
PID 3980 wrote to memory of 4336	3980	chrome.exe	77
PID 3980 wrote to memory of 4336	3980	chrome.exe	77
PID 3980 wrote to memory of 4336	3980	chrome.exe	77
PID 3980 wrote to memory of 4336	3980	chrome.exe	77
PID 3980 wrote to memory of 4336	3980	chrome.exe	77
PID 3980 wrote to memory of 4336	3980	chrome.exe	77
PID 3980 wrote to memory of 4336	3980	chrome.exe	77
PID 3980 wrote to memory of 4336	3980	chrome.exe	77
PID 3980 wrote to memory of 4336	3980	chrome.exe	77
PID 3980 wrote to memory of 4336	3980	chrome.exe	77
PID 3980 wrote to memory of 4336	3980	chrome.exe	77
PID 3980 wrote to memory of 4336	3980	chrome.exe	77
PID 3980 wrote to memory of 4336	3980	chrome.exe	77
PID 3980 wrote to memory of 4336	3980	chrome.exe	77
PID 3980 wrote to memory of 4336	3980	chrome.exe	77
PID 3980 wrote to memory of 4336	3980	chrome.exe	77
PID 3980 wrote to memory of 4336	3980	chrome.exe	77
PID 3980 wrote to memory of 4336	3980	chrome.exe	77
PID 3980 wrote to memory of 4336	3980	chrome.exe	77
PID 3980 wrote to memory of 4336	3980	chrome.exe	77
PID 3980 wrote to memory of 4236	3980	chrome.exe	78
PID 3980 wrote to memory of 4236	3980	chrome.exe	78
PID 3980 wrote to memory of 3660	3980	chrome.exe	79
PID 3980 wrote to memory of 3660	3980	chrome.exe	79
PID 3980 wrote to memory of 3660	3980	chrome.exe	79
PID 3980 wrote to memory of 3660	3980	chrome.exe	79
PID 3980 wrote to memory of 3660	3980	chrome.exe	79
PID 3980 wrote to memory of 3660	3980	chrome.exe	79
PID 3980 wrote to memory of 3660	3980	chrome.exe	79
PID 3980 wrote to memory of 3660	3980	chrome.exe	79
PID 3980 wrote to memory of 3660	3980	chrome.exe	79
PID 3980 wrote to memory of 3660	3980	chrome.exe	79
PID 3980 wrote to memory of 3660	3980	chrome.exe	79
PID 3980 wrote to memory of 3660	3980	chrome.exe	79
PID 3980 wrote to memory of 3660	3980	chrome.exe	79
PID 3980 wrote to memory of 3660	3980	chrome.exe	79
PID 3980 wrote to memory of 3660	3980	chrome.exe	79
PID 3980 wrote to memory of 3660	3980	chrome.exe	79
PID 3980 wrote to memory of 3660	3980	chrome.exe	79
PID 3980 wrote to memory of 3660	3980	chrome.exe	79
PID 3980 wrote to memory of 3660	3980	chrome.exe	79
PID 3980 wrote to memory of 3660	3980	chrome.exe	79
PID 3980 wrote to memory of 3660	3980	chrome.exe	79
PID 3980 wrote to memory of 3660	3980	chrome.exe	79

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE "C:\Users\Admin\AppData\Local\Temp\Prison Life FREE GUI - KILL ALL & MORE!.txt"
1⤵
PID:1380

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ff838b99758,0x7ff838b99768,0x7ff838b99778
  2⤵
  PID:500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1580 --field-trial-handle=1868,i,7595696367998582527,11986575736012018824,131072 /prefetch:2
  2⤵
  PID:4336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1804 --field-trial-handle=1868,i,7595696367998582527,11986575736012018824,131072 /prefetch:8
  2⤵
  PID:4236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2068 --field-trial-handle=1868,i,7595696367998582527,11986575736012018824,131072 /prefetch:8
  2⤵
  PID:3660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2864 --field-trial-handle=1868,i,7595696367998582527,11986575736012018824,131072 /prefetch:1
  2⤵
  PID:3028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2872 --field-trial-handle=1868,i,7595696367998582527,11986575736012018824,131072 /prefetch:1
  2⤵
  PID:4552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3576 --field-trial-handle=1868,i,7595696367998582527,11986575736012018824,131072 /prefetch:1
  2⤵
  PID:3620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4460 --field-trial-handle=1868,i,7595696367998582527,11986575736012018824,131072 /prefetch:8
  2⤵
  PID:2120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4752 --field-trial-handle=1868,i,7595696367998582527,11986575736012018824,131072 /prefetch:8
  2⤵
  PID:1536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4924 --field-trial-handle=1868,i,7595696367998582527,11986575736012018824,131072 /prefetch:8
  2⤵
  PID:4692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5040 --field-trial-handle=1868,i,7595696367998582527,11986575736012018824,131072 /prefetch:8
  2⤵
  PID:4724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4964 --field-trial-handle=1868,i,7595696367998582527,11986575736012018824,131072 /prefetch:8
  2⤵
  PID:4280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5380 --field-trial-handle=1868,i,7595696367998582527,11986575736012018824,131072 /prefetch:1
  2⤵
  PID:4260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4644 --field-trial-handle=1868,i,7595696367998582527,11986575736012018824,131072 /prefetch:1
  2⤵
  PID:64
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=5652 --field-trial-handle=1868,i,7595696367998582527,11986575736012018824,131072 /prefetch:1
  2⤵
  PID:4076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=5640 --field-trial-handle=1868,i,7595696367998582527,11986575736012018824,131072 /prefetch:1
  2⤵
  PID:420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4644 --field-trial-handle=1868,i,7595696367998582527,11986575736012018824,131072 /prefetch:8
  2⤵
  PID:4684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5860 --field-trial-handle=1868,i,7595696367998582527,11986575736012018824,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4856

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

f_000004

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000004
Size 18KB
SHA256 3b8da26166f2684fa66a4ef8c446eead122065b815246c7f482cff1b6a158898
MD5 88ff4599ea841c53baba3e2386f78767
SHA1 8479842232da57648dc195070e0c4e7da36f8451
SHA512 6b6403dff6ec466616c5ccaca91ec7dc1fef10d89c5f3cb82d3b342983a7af33ed1322528a6424a4e013c12c20cc1b508c83368bd0ace551a879261c289d8202
SSDEEP 384:VN2ZGaJ/CISj37HvqfEqXGG0x8vQJwt2FiCBjdUhJxsNW5p:VE4qSj37H4EqWEwwAFiuYjL
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000015

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000015
Size 18KB
SHA256 bdf17cc4e2192017be07cec20662af8c5c2e88eb5907d8f6ed293dc113b13db4
MD5 3df4c4f9a601faf370943431e26b357f
SHA1 ce3fa754177319525dd71d47dd85695388d67775
SHA512 d8aa3d59bfdc15c344c3b09fc4ba8c33728e3bc74a03c767bbd54f3d27a80aac6d984a603e8d253c7c2d191ccb128253d09d21ae33aa484d9321c4c2cc071ea1
SSDEEP 384:3onuAMXlwLcQfZjKI3vGxhnGXbusaSRyGwOrKalFMQSqj4sBRRknp+:3glMXAcE3eaSs8OJSQP/RRx
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 99531b9905953a163a30110131225ee5a96caf26270d117517208311f84ada84
MD5 1b4963fbb8b063be6e813573f38fb400
SHA1 38de34ecffd8603872df2f2dfcd04a8709768fe8
SHA512 3630d7d9d6e1f08ae8299bda101037a437e4b550591822cc28a19ce533c62fbfca4ebf8da7fa58b00993e5da5cd8052bc67b31decb93fce242759f06c9e78033
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 0d790ab1840df4b355a97ec76a81e1c038cbe79779059b7ad2ffc3cf39966331
MD5 e6d4366123ed7a0669838216d8fa7895
SHA1 d2979ec547b8e1b358c060cd63b364b3a1294478
SHA512 e8ee091380314c9c7e844bf5ec394d8d46a2fdf144cadd94be99953acefb6da094310aa5885d716eebe7f8912dd4303572cd6de033b9da45e3540e9807d6d6ef
SSDEEP 96:J0X452e+VG6Vg98cKGOG5GGgG2GlGGsG/2Gr1GpGbG2G5BGliGdSm:J0X452e+VG6Vg985DwGZ/NXXE1eEtix0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 1ee70bcde423dd6ac32449bb8530783230bc8a82d2b8478c170b4cf97729a33c
MD5 4361d069527204effa93202edb307305
SHA1 aeee15662a746c2e6882255999c46cc30ca8eae1
SHA512 f6b3d6e20671c433611e3ec09a8b4168a0703a3b8a2a3ee9ea15af1efbf669bd451f967d74c73ba880711a481f80efc050004c936988ccf0260391574ded3f2c
SSDEEP 96:J0X452e+VG6VPr2+98iGuKGOG5TsPGb0G2GlGGFm:J0X452e+VG6VPK+98iKDwTsPG0/Nz
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 1ea190cf7284913d929498566f7ec9f9d5b6adf78a80315cf2d17e39b6cf9d69
MD5 04594c2d09efde869ba7c75469257d0d
SHA1 66d63372216b59fdb5213786be86e8033ab893e3
SHA512 cb3d44c06cc7bc6b74369df34230fcfaaad1ecc65374bc235bce93f66611a74bf9dd6a3319f9889492ff8c3cb36a8f242aa6cee036fe29427bef3ac8a3b5748b
SSDEEP 96:J0X452e+VG6Vg98cKGOG5GGgG2GlGGsG/2GrOkGpGbG2G4um:J0X452e+VG6Vg985DwGZ/NXXEOkeEtNr
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 0f75d5d65a1f1d670f17db4ce0e9dbaea2316798172bdedc383571b97265664d
MD5 4c46745fc792a4c1bcac627aaf2b1c4f
SHA1 c91d00ed9828628f7996753057e13677480799bf
SHA512 96eaf6f0fcf08282b447a505095e9582b7951cb837aa8b3a2e9898a9295d45593b720a2ea7c834f6c2384ddf6532e53e741a47d91aa4589bc9726ffb5068f08d
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 dd35ed7caf7cbce3c5c028a1c8fe237cf8fffeb1dd0390e9ceb8629488fb3594
MD5 2c028a5682d285bf12fc42d98131dfad
SHA1 2c79dc42124edcc8cef9299ae3fea82ea1b64d53
SHA512 da58c74e859643a0176ad4409565173126b5b18ff964e3420a333e5eeace6c57121b1b48a398a89db0190294c3cc49ad5b350e2f8c802a227e8d520b0b89b7f3
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 894866c18cc430a8f13076903d8e128505ec0de2d4d274e6f4a9b9aaf900a5d2
MD5 27d0e7e277c275a803a68e9f66737c74
SHA1 13997766199d2d933387f9756990bb492826dde2
SHA512 75ed0e516c407c718bd903ae2edfd1829d14d915058f5ab5d4188158c2f263a0ba01d576cbebc350782c6267417bc252596c32a41b50d400fcbc8d5d69a5a36d
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 9fad66cece9f7acb5eddbef228d4f8856d12d51c35f2b024f6d5a21c227a7412
MD5 5f9354f5bdf7b3c1a6dcb51ecf705e42
SHA1 942c0b46aae73f9440faff9983a88bc2f8e6d351
SHA512 5db956b95895f612c536021f9e5db96773c9b54f555af013aece74cb68eeda024c7d1225fc80c451c61441273f054074e90c4b237f4a9537f356ac7e65fc31d8
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 3a135fc0031a4294834e01f0ce373a34de7ded49d034e729fd9dde0370e502af
MD5 b2690d427c25930a6a256dbf9709ab39
SHA1 78c4adcee79e9cac9cc28a64ffff3a8c2bb20a26
SHA512 bde8cc7f37989f119ce412d7ad0e064bcf49eaf0660c2f478db44955a2eb6058570b58941cb2b6750f897edb2981fee21036e2d8302a41caeb2bea37f8e445a0
SSDEEP 96:s8PlKIl3WP8iZRy1Jt8Di+6MsmdeBSkmSjuO+U1x9+jVhYtjEsXt0/cg2Vup:s4lc8sy3f+FRkRRR+otjEsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 f13a5a30366a1bfcd22e6a891ee1e13bb7693151b3bf06886d5970e6bdd43444
MD5 9a7211290453da3c6639610d2a9a629b
SHA1 3a512d073447b5ae7908bea0408054e7e768427c
SHA512 ffa8fd2c616c8115af0fcf5573f7f708130a9aecff978a1deb90373e1c9a3071f83ebc78651ef257615ae4e055e2b27b546e7e9aab8280b2e93466b450acc742
SSDEEP 96:s8PlKIl3WP8iZRy7Di+6MsmdeBwkUS1qO+U1x9+jVhYtjEsXt0/cg2Vup:s4lc8syy+F/k7nR+otjEsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 4acb4941e84c480a947f93ecd616ed37c3741f1efed23019aa8dd867c004dd26
MD5 a1baec3d14fe5d68a6675c88ccebcb98
SHA1 6e6dd27ff71baa68143a682545760d5aa79a90e6
SHA512 a2c72f10bcac0be6783ed6885abe1ee8aacafcc057de126da04e7c61f86f0c50b4516f5f2d0af57faf4205ff1f84185b761be4f8a3154dbf4661c526754d3838
SSDEEP 96:s8PlKIl3WP8iZRy1Jt8Di+6MsmdeBSkmSj2O+U1x9+jVhYtjEsXt0/cg2Vup:s4lc8sy3f+FRkRBR+otjEsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 7caea89b84469b620ce1990ed58a7c7e99b087e09594bbe83a11d1ac8a2f0b8b
MD5 ba3b616173caaa09bf703d56942bc3b3
SHA1 128e9f355d9297ce19e810c1cf3df4cfb55aaafc
SHA512 28d70e0d6e3f097e83599e2d3adcd809e2205b8e7664d304a394fa61602649ee3a4f78f77d88f503399e7bc48728e309844eeef0c8b021c6dbaaf25e4f11b193
SSDEEP 96:s8PlKIl3WP8iZRy1Jt8Di+6MsmdeBSkmSjaO+U1x9+jVhYtjEsXt0/cg2Vup:s4lc8sy3f+FRkR9R+otjEsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 12KB
SHA256 dd410e870f2049ff3e81b9fd72227e595bbdd3fd370aedfdb875ca39abef81dd
MD5 5da088e0db908964957cb8c67a16d912
SHA1 0a2483d313f9905d754d263b510283db9c3e0775
SHA512 f613dc5c3ff30ec93a5acfa226ac34e8a437b16a3d9a3e2eaccc413c5343730786443cb7af950171b173bb9758e0d9023bd7d0e1f9f4504653d935bd073d7b65
SSDEEP 384:slXC1kXqKf/pUZNCgVLH2Hfk5rUUHG6hcxGh:YC1kXqKf/pUZNCgVLH2HfirUYGoh
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 3924f177f600f8f7aec92a3a80aa683065e94c689b38c11c0d6b04ef17db3f0e
MD5 c892d8f73b4c1bf4cf9e34009b1f9117
SHA1 3384c601b5f4019e8f155457303d7cd83c37c288
SHA512 de75c719d7929061648a7824c3c507af35a5701b9bc54d1480429b16b09cd2c7022c7d6f892bf571dc1e39eaa74f09cc00654b83fe9885bd2eef8da57994ac73
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe584c66.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe584c66.TMP
Size 48B
SHA256 e88a2cd3447e03ad5fa847148fa0a54fb2b62555eb2579674e41b8c2552f21c2
MD5 ce3e14a47d57bbc0ccf34278b5f4abfe
SHA1 61801b2c687b30d25d40a9b15dd0b1a6344b6b5a
SHA512 5fd34361d7f44e8e1247f22071f2a8a44e5b3651e18b7399ce300ba25b2e9003b92421c3d2d7470eb2a0c49ba2e5d47ab8776cb904a72ea4b86583c431479224
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 280KB
SHA256 b0a3aa75846c52d15ce45688dfef39417e15765ef19754b7f1a3d2a89f249a7a
MD5 edf657e13213fc27c081f0417bf171c1
SHA1 e0278f96dd1b3084b23fee94672917fe2ef35b91
SHA512 f4203e4cc84be1725f7fd737f74b885464b87eaca018767e1a65eae526b5b8f5c8e9f54ea5ada84b142d1aaaf614abd4c6aa10898cb486e83bbbf1259a39638f
SSDEEP 6144:wha1s/a8UATr1kYQvPOeFkdmaLDgETdARLMUKgoFstyx2f4tQpkQJS+:0RikZQhKfgERAoBQsbSS+
MD5 SHA1 SHA512 SSDEEP

Submit Download

persisted_first_party_sets.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download