Overview
overview
7Static
static
3background.js
windows11-21h2-x64
3data/inject.js
windows11-21h2-x64
3data/optio...x.html
windows11-21h2-x64
1data/options/index.js
windows11-21h2-x64
3audiocontext.js
windows11-21h2-x64
3canvas.js
windows11-21h2-x64
3font.js
windows11-21h2-x64
3webgl.js
windows11-21h2-x64
3background.js
windows11-21h2-x64
3data/conte...ect.js
windows11-21h2-x64
3data/conte...ces.js
windows11-21h2-x64
3data/conte...ion.js
windows11-21h2-x64
3data/optio...s.html
windows11-21h2-x64
1data/optio...ons.js
windows11-21h2-x64
3lib/chrome.js
windows11-21h2-x64
3lib/common.js
windows11-21h2-x64
3lib/config.js
windows11-21h2-x64
3lib/runtime.js
windows11-21h2-x64
3killdrive.bat
windows11-21h2-x64
1proxy_check.exe
windows11-21h2-x64
7youtube_viewer.exe
windows11-21h2-x64
7Analysis
- max time kernel
1173s - max time network
1174s - platform
windows11-21h2_x64 - resource
win11-20240426-en - resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system - submitted
10/06/2024, 18:38
Behavioral task
behavioral1
Sample
background.js
Resource
win11-20240426-en
windows11-21h2-x64
1 signatures
1200 seconds
Behavioral task
behavioral2
Sample
data/inject.js
Resource
win11-20240419-en
windows11-21h2-x64
1 signatures
1200 seconds
Behavioral task
behavioral3
Sample
data/options/index.html
Resource
win11-20240426-en
windows11-21h2-x64
6 signatures
1200 seconds
Behavioral task
behavioral4
Sample
data/options/index.js
Resource
win11-20240508-en
windows11-21h2-x64
1 signatures
1200 seconds
Behavioral task
behavioral5
Sample
audiocontext.js
Resource
win11-20240508-en
windows11-21h2-x64
1 signatures
1200 seconds
Behavioral task
behavioral6
Sample
canvas.js
Resource
win11-20240508-en
windows11-21h2-x64
1 signatures
1200 seconds
Behavioral task
behavioral7
Sample
font.js
Resource
win11-20240419-en
windows11-21h2-x64
1 signatures
1200 seconds
Behavioral task
behavioral8
Sample
webgl.js
Resource
win11-20240426-en
windows11-21h2-x64
1 signatures
1200 seconds
Behavioral task
behavioral9
Sample
background.js
Resource
win11-20240508-en
windows11-21h2-x64
1 signatures
1200 seconds
Behavioral task
behavioral10
Sample
data/content_script/inject.js
Resource
win11-20240426-en
windows11-21h2-x64
1 signatures
1200 seconds
Behavioral task
behavioral11
Sample
data/content_script/page_context/media_devices.js
Resource
win11-20240426-en
windows11-21h2-x64
1 signatures
1200 seconds
Behavioral task
behavioral12
Sample
data/content_script/page_context/support_detection.js
Resource
win11-20240508-en
windows11-21h2-x64
1 signatures
1200 seconds
Behavioral task
behavioral13
Sample
data/options/options.html
Resource
win11-20240426-en
windows11-21h2-x64
6 signatures
1200 seconds
Behavioral task
behavioral14
Sample
data/options/options.js
Resource
win11-20240508-en
windows11-21h2-x64
1 signatures
1200 seconds
Behavioral task
behavioral15
Sample
lib/chrome.js
Resource
win11-20240426-en
windows11-21h2-x64
1 signatures
1200 seconds
Behavioral task
behavioral16
Sample
lib/common.js
Resource
win11-20240508-en
windows11-21h2-x64
1 signatures
1200 seconds
Behavioral task
behavioral17
Sample
lib/config.js
Resource
win11-20240426-en
windows11-21h2-x64
1 signatures
1200 seconds
Behavioral task
behavioral18
Sample
lib/runtime.js
Resource
win11-20240508-en
windows11-21h2-x64
1 signatures
1200 seconds
Behavioral task
behavioral19
Sample
killdrive.bat
Resource
win11-20240508-en
windows11-21h2-x64
3 signatures
1200 seconds
Behavioral task
behavioral20
Sample
proxy_check.exe
Resource
win11-20240419-en
windows11-21h2-x64
2 signatures
1200 seconds
Behavioral task
behavioral21
Sample
youtube_viewer.exe
Resource
win11-20240508-en
windows11-21h2-x64
3 signatures
1200 seconds
General
- Target data/options/index.html
- Size 1KB
- Sample240610-w92dpswcra
- SHA256 fba857260ecd685271990fbba79219e29d8fb3a010e1d9adbe14a28467eb2272
- MD5 9506e64d094d312e2088c800141ccdae
- SHA1 c56b7cd838b5dd2bd84a07db9027f608f8ba4d00
- SHA512 e4cc00dc6576d9171634a0fc587672b26afa9837828521d7435df39da9011f07ef75d3bec98641866ed2908b294ae7776228bead60dbaeadd4137f7f8f6310d1
- MD5 SHA1 SHA512
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 2136 msedge.exe 2136 msedge.exe 2892 msedge.exe 2892 msedge.exe 848 msedge.exe 848 msedge.exe 1084 identity_helper.exe 1084 identity_helper.exe 3176 msedge.exe 3176 msedge.exe 3176 msedge.exe 3176 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 2892 msedge.exe 2892 msedge.exe 2892 msedge.exe 2892 msedge.exe 2892 msedge.exe 2892 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2892 msedge.exe 2892 msedge.exe 2892 msedge.exe 2892 msedge.exe 2892 msedge.exe 2892 msedge.exe 2892 msedge.exe 2892 msedge.exe 2892 msedge.exe 2892 msedge.exe 2892 msedge.exe 2892 msedge.exe 2892 msedge.exe 2892 msedge.exe 2892 msedge.exe 2892 msedge.exe 2892 msedge.exe 2892 msedge.exe 2892 msedge.exe 2892 msedge.exe 2892 msedge.exe 2892 msedge.exe 2892 msedge.exe 2892 msedge.exe 2892 msedge.exe - Suspicious use of SendNotifyMessage 12 IoCs
pid Process 2892 msedge.exe 2892 msedge.exe 2892 msedge.exe 2892 msedge.exe 2892 msedge.exe 2892 msedge.exe 2892 msedge.exe 2892 msedge.exe 2892 msedge.exe 2892 msedge.exe 2892 msedge.exe 2892 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2892 wrote to memory of 4192 2892 msedge.exe 77 PID 2892 wrote to memory of 4192 2892 msedge.exe 77 PID 2892 wrote to memory of 464 2892 msedge.exe 78 PID 2892 wrote to memory of 464 2892 msedge.exe 78 PID 2892 wrote to memory of 464 2892 msedge.exe 78 PID 2892 wrote to memory of 464 2892 msedge.exe 78 PID 2892 wrote to memory of 464 2892 msedge.exe 78 PID 2892 wrote to memory of 464 2892 msedge.exe 78 PID 2892 wrote to memory of 464 2892 msedge.exe 78 PID 2892 wrote to memory of 464 2892 msedge.exe 78 PID 2892 wrote to memory of 464 2892 msedge.exe 78 PID 2892 wrote to memory of 464 2892 msedge.exe 78 PID 2892 wrote to memory of 464 2892 msedge.exe 78 PID 2892 wrote to memory of 464 2892 msedge.exe 78 PID 2892 wrote to memory of 464 2892 msedge.exe 78 PID 2892 wrote to memory of 464 2892 msedge.exe 78 PID 2892 wrote to memory of 464 2892 msedge.exe 78 PID 2892 wrote to memory of 464 2892 msedge.exe 78 PID 2892 wrote to memory of 464 2892 msedge.exe 78 PID 2892 wrote to memory of 464 2892 msedge.exe 78 PID 2892 wrote to memory of 464 2892 msedge.exe 78 PID 2892 wrote to memory of 464 2892 msedge.exe 78 PID 2892 wrote to memory of 464 2892 msedge.exe 78 PID 2892 wrote to memory of 464 2892 msedge.exe 78 PID 2892 wrote to memory of 464 2892 msedge.exe 78 PID 2892 wrote to memory of 464 2892 msedge.exe 78 PID 2892 wrote to memory of 464 2892 msedge.exe 78 PID 2892 wrote to memory of 464 2892 msedge.exe 78 PID 2892 wrote to memory of 464 2892 msedge.exe 78 PID 2892 wrote to memory of 464 2892 msedge.exe 78 PID 2892 wrote to memory of 464 2892 msedge.exe 78 PID 2892 wrote to memory of 464 2892 msedge.exe 78 PID 2892 wrote to memory of 464 2892 msedge.exe 78 PID 2892 wrote to memory of 464 2892 msedge.exe 78 PID 2892 wrote to memory of 464 2892 msedge.exe 78 PID 2892 wrote to memory of 464 2892 msedge.exe 78 PID 2892 wrote to memory of 464 2892 msedge.exe 78 PID 2892 wrote to memory of 464 2892 msedge.exe 78 PID 2892 wrote to memory of 464 2892 msedge.exe 78 PID 2892 wrote to memory of 464 2892 msedge.exe 78 PID 2892 wrote to memory of 464 2892 msedge.exe 78 PID 2892 wrote to memory of 464 2892 msedge.exe 78 PID 2892 wrote to memory of 2136 2892 msedge.exe 79 PID 2892 wrote to memory of 2136 2892 msedge.exe 79 PID 2892 wrote to memory of 3184 2892 msedge.exe 80 PID 2892 wrote to memory of 3184 2892 msedge.exe 80 PID 2892 wrote to memory of 3184 2892 msedge.exe 80 PID 2892 wrote to memory of 3184 2892 msedge.exe 80 PID 2892 wrote to memory of 3184 2892 msedge.exe 80 PID 2892 wrote to memory of 3184 2892 msedge.exe 80 PID 2892 wrote to memory of 3184 2892 msedge.exe 80 PID 2892 wrote to memory of 3184 2892 msedge.exe 80 PID 2892 wrote to memory of 3184 2892 msedge.exe 80 PID 2892 wrote to memory of 3184 2892 msedge.exe 80 PID 2892 wrote to memory of 3184 2892 msedge.exe 80 PID 2892 wrote to memory of 3184 2892 msedge.exe 80 PID 2892 wrote to memory of 3184 2892 msedge.exe 80 PID 2892 wrote to memory of 3184 2892 msedge.exe 80 PID 2892 wrote to memory of 3184 2892 msedge.exe 80 PID 2892 wrote to memory of 3184 2892 msedge.exe 80 PID 2892 wrote to memory of 3184 2892 msedge.exe 80 PID 2892 wrote to memory of 3184 2892 msedge.exe 80 PID 2892 wrote to memory of 3184 2892 msedge.exe 80 PID 2892 wrote to memory of 3184 2892 msedge.exe 80
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\data\options\index.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff223a3cb8,0x7fff223a3cc8,0x7fff223a3cd82⤵PID:4192
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1836,11075695559452234697,4257603693893274767,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1900 /prefetch:22⤵PID:464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1836,11075695559452234697,4257603693893274767,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2136
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1836,11075695559452234697,4257603693893274767,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:82⤵PID:3184
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,11075695559452234697,4257603693893274767,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:12⤵PID:4564
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,11075695559452234697,4257603693893274767,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:12⤵PID:4432
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1836,11075695559452234697,4257603693893274767,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4952 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:848
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1836,11075695559452234697,4257603693893274767,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5372 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1084
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,11075695559452234697,4257603693893274767,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:12⤵PID:3376
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,11075695559452234697,4257603693893274767,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:12⤵PID:3300
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,11075695559452234697,4257603693893274767,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:12⤵PID:1440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,11075695559452234697,4257603693893274767,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:12⤵PID:1504
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1836,11075695559452234697,4257603693893274767,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4828 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3176
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2936
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2416
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 64a60300c46447926ce44b48ce179d01eff3dba906b83b17e48db0c738ca38a9
- MD5 9faad3e004614b187287bed750e56acc
- SHA1 eeea3627a208df5a8cf627b0d39561167d272ac5
- SHA512 a7470fe359229c2932aa39417e1cd0dc47f351963cbb39f4026f3a2954e05e3238f3605e13c870c9fe24ae56a0d07e1a6943df0e891bdcd46fd9ae4b7a48ab90
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 e79d4b86d8cabd981d719da7f55e0540831df7fa0f8df5b19c0671137406c3da
- MD5 7915c5c12c884cc2fa03af40f3d2e49d
- SHA1 d48085f85761cde9c287b0b70a918c7ce8008629
- SHA512 4c71eb6836546d4cfdb39cd84b6c44687b2c2dee31e2e658d12f809225cbd495f20ce69030bff1d80468605a3523d23b6dea166975cedae25b02a75479c3f217
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 b07ff41c93a9bccd24fe7fca922902069964d0e421bfae874baadaa89ef4676a
- MD5 9d286011d793ff66d1c3d104605e9424
- SHA1 b6fd2d2b4256d755cac9d7bed86ac60635437b78
- SHA512 9286000c44b8b0889c9139e9bab5f32231464933e7456821fb5dc74cb374d228291c516c2906a548ac3a4475a9b8dae5cb2a9e49a89aa50c292411f0c382699d
- SSDEEP 96:ntk35mAk9AwSv0MoiVmdHIrJHt0WQyV+VuziX3wI3:ntk38Akev0MAIFHtLM93
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 53d71fb982aa8e34f76d3f20ab784167b3e574d3f79778ff46253118b29030f4
- MD5 1615d31939e38519d1db048db4958fe7
- SHA1 f11a13a57de04dec6ee604fd0bc7a8bd13d69e9c
- SHA512 73c1ba106804ef466234a6cfe9c0c682d0d9a1c14dd94c258f1978ac8ca638d389ef450ad70f3f37877e2bb18da5662d796ae06e927f81f4d260e0e9f3702008
- SSDEEP 96:ntk3mmAkTAwSv0MoiVmdHIrJHt0WQyV+VpAiX3wI3:ntk3HAkMv0MAIFHtLe93
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
- MD5 6752a1d65b201c13b62ea44016eb221f
- SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
- SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 84ef2bb0b928cb5aa6250dc21989c899541ee818b73e696fae47f66b7a02d321
- MD5 ec180d2d86f63bf110fdf37742650950
- SHA1 9b6a5e18d7ef0905cbea0a803c07b1b2c300f694
- SHA512 710e80750255985a909ad1ca57064f463192f6f1bed125ebf1672042c002671b6bde28eac197ca4568a718d7e3898e42896256949651042dd97cee30ec51c677
- SSDEEP 192:coCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASGvvJhe2RUqBRIcf7YvmljEW5t:M9iIxuERzA83h09RZxASGJ1Hkcf7Yk9f
- MD5 SHA1 SHA512 SSDEEP