b2ac1e407ed3ecd7c7faa6de929a68fb51145662cf793c40b69eb59295bba6bc

Resubmissions

19/06/2024, 16:13

240619-tpb7zatbkh8

19/06/2024, 16:12

19/06/2024, 16:11

19/06/2024, 16:03

19/06/2024, 16:01

19/06/2024, 15:55

19/06/2024, 15:53

19/06/2024, 15:52

Analysis

max time kernel
285s
max time network
295s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
19/06/2024, 15:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Bloxstrap-v2.5.4 (3).exe
Size 7.6MB
Sample240619-tbc74sshqc
SHA256 b2ac1e407ed3ecd7c7faa6de929a68fb51145662cf793c40b69eb59295bba6bc
MD5 dbb820772caf0003967ef0f269fbdeb1
SHA1 31992bd4977a7dfeba67537a2da6c9ca64bc304c
SHA512 e8ac879c7198dffb78bc6ee4ad49b5de40a5a7dbbda53d427d0a034941487d13c8bb2b8d590a1fcdd81cd6abb8f21fdfcd52924eb00c45a42ee06c1e4b3d590f
SSDEEP 98304:XNd5DSd5DxTsed5D2ZT00UuOYoHwfLk3vSmaR0+Mc4AN0edaAHDfysrTl1:X+sdtObAbN0u
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Bloxstrap-v2.5.4 (3).exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133632860058461555"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4128	chrome.exe
4128	chrome.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe

Suspicious use of AdjustPrivilegeToken 57 IoCs

description	pid	Process
Token: SeDebugPrivilege	5076	Bloxstrap-v2.5.4 (3).exe
Token: SeShutdownPrivilege	4128	chrome.exe
Token: SeCreatePagefilePrivilege	4128	chrome.exe
Token: SeShutdownPrivilege	4128	chrome.exe
Token: SeCreatePagefilePrivilege	4128	chrome.exe
Token: SeShutdownPrivilege	4128	chrome.exe
Token: SeCreatePagefilePrivilege	4128	chrome.exe
Token: SeShutdownPrivilege	4128	chrome.exe
Token: SeCreatePagefilePrivilege	4128	chrome.exe
Token: SeShutdownPrivilege	4128	chrome.exe
Token: SeCreatePagefilePrivilege	4128	chrome.exe
Token: SeShutdownPrivilege	4128	chrome.exe
Token: SeCreatePagefilePrivilege	4128	chrome.exe
Token: SeShutdownPrivilege	4128	chrome.exe
Token: SeCreatePagefilePrivilege	4128	chrome.exe
Token: SeShutdownPrivilege	4128	chrome.exe
Token: SeCreatePagefilePrivilege	4128	chrome.exe
Token: SeShutdownPrivilege	4128	chrome.exe
Token: SeCreatePagefilePrivilege	4128	chrome.exe
Token: SeShutdownPrivilege	4128	chrome.exe
Token: SeCreatePagefilePrivilege	4128	chrome.exe
Token: SeShutdownPrivilege	4128	chrome.exe
Token: SeCreatePagefilePrivilege	4128	chrome.exe
Token: SeShutdownPrivilege	4128	chrome.exe
Token: SeCreatePagefilePrivilege	4128	chrome.exe
Token: SeShutdownPrivilege	4128	chrome.exe
Token: SeCreatePagefilePrivilege	4128	chrome.exe
Token: SeShutdownPrivilege	4128	chrome.exe
Token: SeCreatePagefilePrivilege	4128	chrome.exe
Token: SeShutdownPrivilege	4128	chrome.exe
Token: SeCreatePagefilePrivilege	4128	chrome.exe
Token: SeShutdownPrivilege	4128	chrome.exe
Token: SeCreatePagefilePrivilege	4128	chrome.exe
Token: SeShutdownPrivilege	4128	chrome.exe
Token: SeCreatePagefilePrivilege	4128	chrome.exe
Token: SeShutdownPrivilege	4128	chrome.exe
Token: SeCreatePagefilePrivilege	4128	chrome.exe
Token: SeShutdownPrivilege	4128	chrome.exe
Token: SeCreatePagefilePrivilege	4128	chrome.exe
Token: SeShutdownPrivilege	4128	chrome.exe
Token: SeCreatePagefilePrivilege	4128	chrome.exe
Token: SeShutdownPrivilege	4128	chrome.exe
Token: SeCreatePagefilePrivilege	4128	chrome.exe
Token: SeShutdownPrivilege	4128	chrome.exe
Token: SeCreatePagefilePrivilege	4128	chrome.exe
Token: SeShutdownPrivilege	4128	chrome.exe
Token: SeCreatePagefilePrivilege	4128	chrome.exe
Token: SeShutdownPrivilege	4128	chrome.exe
Token: SeCreatePagefilePrivilege	4128	chrome.exe
Token: SeShutdownPrivilege	4128	chrome.exe
Token: SeCreatePagefilePrivilege	4128	chrome.exe
Token: SeShutdownPrivilege	4128	chrome.exe
Token: SeCreatePagefilePrivilege	4128	chrome.exe
Token: SeShutdownPrivilege	4128	chrome.exe
Token: SeCreatePagefilePrivilege	4128	chrome.exe
Token: SeShutdownPrivilege	4128	chrome.exe
Token: SeCreatePagefilePrivilege	4128	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe
4128	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4128 wrote to memory of 4960	4128	chrome.exe	88
PID 4128 wrote to memory of 4960	4128	chrome.exe	88
PID 4128 wrote to memory of 1884	4128	chrome.exe	89
PID 4128 wrote to memory of 1884	4128	chrome.exe	89
PID 4128 wrote to memory of 1884	4128	chrome.exe	89
PID 4128 wrote to memory of 1884	4128	chrome.exe	89
PID 4128 wrote to memory of 1884	4128	chrome.exe	89
PID 4128 wrote to memory of 1884	4128	chrome.exe	89
PID 4128 wrote to memory of 1884	4128	chrome.exe	89
PID 4128 wrote to memory of 1884	4128	chrome.exe	89
PID 4128 wrote to memory of 1884	4128	chrome.exe	89
PID 4128 wrote to memory of 1884	4128	chrome.exe	89
PID 4128 wrote to memory of 1884	4128	chrome.exe	89
PID 4128 wrote to memory of 1884	4128	chrome.exe	89
PID 4128 wrote to memory of 1884	4128	chrome.exe	89
PID 4128 wrote to memory of 1884	4128	chrome.exe	89
PID 4128 wrote to memory of 1884	4128	chrome.exe	89
PID 4128 wrote to memory of 1884	4128	chrome.exe	89
PID 4128 wrote to memory of 1884	4128	chrome.exe	89
PID 4128 wrote to memory of 1884	4128	chrome.exe	89
PID 4128 wrote to memory of 1884	4128	chrome.exe	89
PID 4128 wrote to memory of 1884	4128	chrome.exe	89
PID 4128 wrote to memory of 1884	4128	chrome.exe	89
PID 4128 wrote to memory of 1884	4128	chrome.exe	89
PID 4128 wrote to memory of 1884	4128	chrome.exe	89
PID 4128 wrote to memory of 1884	4128	chrome.exe	89
PID 4128 wrote to memory of 1884	4128	chrome.exe	89
PID 4128 wrote to memory of 1884	4128	chrome.exe	89
PID 4128 wrote to memory of 1884	4128	chrome.exe	89
PID 4128 wrote to memory of 1884	4128	chrome.exe	89
PID 4128 wrote to memory of 1884	4128	chrome.exe	89
PID 4128 wrote to memory of 1884	4128	chrome.exe	89
PID 4128 wrote to memory of 1884	4128	chrome.exe	89
PID 4128 wrote to memory of 560	4128	chrome.exe	90
PID 4128 wrote to memory of 560	4128	chrome.exe	90
PID 4128 wrote to memory of 3108	4128	chrome.exe	91
PID 4128 wrote to memory of 3108	4128	chrome.exe	91
PID 4128 wrote to memory of 3108	4128	chrome.exe	91
PID 4128 wrote to memory of 3108	4128	chrome.exe	91
PID 4128 wrote to memory of 3108	4128	chrome.exe	91
PID 4128 wrote to memory of 3108	4128	chrome.exe	91
PID 4128 wrote to memory of 3108	4128	chrome.exe	91
PID 4128 wrote to memory of 3108	4128	chrome.exe	91
PID 4128 wrote to memory of 3108	4128	chrome.exe	91
PID 4128 wrote to memory of 3108	4128	chrome.exe	91
PID 4128 wrote to memory of 3108	4128	chrome.exe	91
PID 4128 wrote to memory of 3108	4128	chrome.exe	91
PID 4128 wrote to memory of 3108	4128	chrome.exe	91
PID 4128 wrote to memory of 3108	4128	chrome.exe	91
PID 4128 wrote to memory of 3108	4128	chrome.exe	91
PID 4128 wrote to memory of 3108	4128	chrome.exe	91
PID 4128 wrote to memory of 3108	4128	chrome.exe	91
PID 4128 wrote to memory of 3108	4128	chrome.exe	91
PID 4128 wrote to memory of 3108	4128	chrome.exe	91
PID 4128 wrote to memory of 3108	4128	chrome.exe	91
PID 4128 wrote to memory of 3108	4128	chrome.exe	91
PID 4128 wrote to memory of 3108	4128	chrome.exe	91
PID 4128 wrote to memory of 3108	4128	chrome.exe	91
PID 4128 wrote to memory of 3108	4128	chrome.exe	91
PID 4128 wrote to memory of 3108	4128	chrome.exe	91
PID 4128 wrote to memory of 3108	4128	chrome.exe	91
PID 4128 wrote to memory of 3108	4128	chrome.exe	91
PID 4128 wrote to memory of 3108	4128	chrome.exe	91
PID 4128 wrote to memory of 3108	4128	chrome.exe	91

C:\Users\Admin\AppData\Local\Temp\Bloxstrap-v2.5.4 (3).exe
"C:\Users\Admin\AppData\Local\Temp\Bloxstrap-v2.5.4 (3).exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
PID:5076

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd41d3ab58,0x7ffd41d3ab68,0x7ffd41d3ab78
  2⤵
  PID:4960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1728 --field-trial-handle=1940,i,9867043976371431610,58042161351717531,131072 /prefetch:2
  2⤵
  PID:1884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1940,i,9867043976371431610,58042161351717531,131072 /prefetch:8
  2⤵
  PID:560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1880 --field-trial-handle=1940,i,9867043976371431610,58042161351717531,131072 /prefetch:8
  2⤵
  PID:3108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3064 --field-trial-handle=1940,i,9867043976371431610,58042161351717531,131072 /prefetch:1
  2⤵
  PID:3848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3068 --field-trial-handle=1940,i,9867043976371431610,58042161351717531,131072 /prefetch:1
  2⤵
  PID:3732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4288 --field-trial-handle=1940,i,9867043976371431610,58042161351717531,131072 /prefetch:1
  2⤵
  PID:1396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4592 --field-trial-handle=1940,i,9867043976371431610,58042161351717531,131072 /prefetch:8
  2⤵
  PID:4912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4636 --field-trial-handle=1940,i,9867043976371431610,58042161351717531,131072 /prefetch:8
  2⤵
  PID:2596
- C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
  "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe" --reenable-autoupdates --system-level
  2⤵
  PID:2324
- - C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
    "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x238,0x23c,0x240,0x214,0x244,0x7ff7f870ae48,0x7ff7f870ae58,0x7ff7f870ae68
    3⤵
    PID:2112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5044 --field-trial-handle=1940,i,9867043976371431610,58042161351717531,131072 /prefetch:1
  2⤵
  PID:4372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4860 --field-trial-handle=1940,i,9867043976371431610,58042161351717531,131072 /prefetch:1
  2⤵
  PID:1584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3076 --field-trial-handle=1940,i,9867043976371431610,58042161351717531,131072 /prefetch:1
  2⤵
  PID:2872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4972 --field-trial-handle=1940,i,9867043976371431610,58042161351717531,131072 /prefetch:1
  2⤵
  PID:4148

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:2532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 811B
SHA256 f5b92db27f63b8ed9d8bf83dd347e0174d2fd11e20d6938ffcf403570102ee50
MD5 d9a3d0e60df2ace1bbc6760d74f37458
SHA1 5eecb77be5b2dc4d4c23ebedf128bfc62d6fbb7b
SHA512 bb80dd9321417238ff5b2ce8b21ad3eba4567064b4452665b8f86f7228338d198c09a9c14cc87a1cd9d08024f167b2e68a62abebd1be6be1f37f2656de25d035
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 7KB
SHA256 2722e87abed881ac69e476d70f47cd15714db7936976a3eda603782f4b8034a3
MD5 78acb74d7379433a4aa293b9ba82af06
SHA1 9cc8480567a296f0ac94a6db8d47d55e6c0658ae
SHA512 10bebde64568cd59bc267ec918ca2384a89d92a5c91e5307c49a79ae71d9c37acf5d7bd7fda0e688fca967261fad7465554e3f9485c3d8f9054263453559de49
SSDEEP 192:ALc2kJ2EpOjAE8aJR8syh+FvyGI8+P5tjEsXtScR:ALc2ErgvyqKGZ6tIsXtScR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 7KB
SHA256 c02ca47d8776434f19f4bb6b661ee6e4e0959ac0bf8e222b33106dfe4f9416b6
MD5 6071cae7190e458ba10294a69894da6a
SHA1 4d2a3f8389740f5f35e585e24b00a92875d1dbb8
SHA512 4077a7a087cd7c104484393ef706a4fd35967b8d1b5bbaf3baad43b06a63808023ebaa5546bc6246bcf44e2066ded91a3556487da5bc4b241e05a246110e20f6
SSDEEP 192:AbEpOjAE8aJR8syh+FCpI8+P5tjEsXtScR:AbErgvyqOZ6tIsXtScR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 7KB
SHA256 f834c656d55748dab92e150eac79097045846f34c7d846cf682d407cb324eea7
MD5 040e962e7da25a3b61c2fc64023bc55d
SHA1 11ed64ac3c01e4708e89ac9c57610b2002f12eae
SHA512 42caf1938e52f97f31c5431ca4eef35f4c59adb3d3de66250bb92ccc5a1f050c495d05d9ed303f17351550ee682bd44597caf7f0dc51030c6fca04d89d2d73b6
SSDEEP 192:ALc2kJnEpOjAE8aJR8syh+FvyPI8YKd5tjEsXtScR:ALcnErgvyqKPZ3tIsXtScR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 257KB
SHA256 5783bc86a5ad01dfcdebc5c75be96e48ecd4f55dd50600acb1cd4009eb810126
MD5 fdfc1d5a51d571209167d6944156cbf4
SHA1 daeb659d1138cff6c7bf4c53b302c4c3fea58254
SHA512 eee5f523d7c8436ba68bf3c43514088ca4243f8ac83606f7cb6f46f29110d57b06a3c8f6b5a90bbf970a15255d0c2201160dab7baf960f56744a63fd7d4072bf
SSDEEP 6144:uOZ5IZXqXHjTdCP3y/BQYRPILxZnhLMJjX0EeGzY2rLR:7sqlGSBQ5fnReEFsLLR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 257KB
SHA256 57a858b9b447129c9b2f4e7ab3d191f41901dce4c775c3809f9012ff5ba80e7a
MD5 2f2119fccbcd9f366d717581036dba7b
SHA1 71168256ab3619d78c251224bb4109532cfb3382
SHA512 fe1dd1ffa7c2e68bbcb8308bc8d557d4d84691dafaab035719e3838934cd353b1d2663a60f6165af9e553a473cbb1a4ce521702cf92288d26852d4c6629b84b9
SSDEEP 6144:ZyZ5IZXqXHjTdCP3y/AQYRPILxZnhLMJjX0EeGzY2rLR:wsqlGSAQ5fnReEFsLLR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 257KB
SHA256 99a758cbdbb34f62fbf365ef0b47f6e9df42740ba6cb47f81aaa2708a08e8ff9
MD5 d5c53f63e0a0d360c1b2a48ca6159d0b
SHA1 d1c3e39bc869aaaec7de2707df910c7326f8180d
SHA512 ae54aad1f7be5a7aa425cefa62c7341ea682f5b2ad75654814a0309c8206bf8aede4a8b52043a6767f956322aafcd3a5b2a671cb3e8d0fb4aec4e5779706f9c3
SSDEEP 6144:ZSZ5IZXqXHjTdCP3y/AQYRPILxZnhLMJjX0EeGzY2rLR:UsqlGSAQ5fnReEFsLLR
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/5076-0-0x00007FFD32E5B000-0x00007FFD32E5C000-memory.dmp

Download