Analysis
- max time kernel
149s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
04/07/2024, 09:52
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240419-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target file.exe
- Size 1.1MB
- Sample240704-lv3ccaxcpe
- SHA256 cfcb861232c5a279c00fb72ea2ab408e20e9e159af5e514799aa478d71600ccd
- MD5 d3ea96ebf8b022f0483e7b7fe54d41c2
- SHA1 88ba17bc5aa324a86df6c491f70758993b016f4d
- SHA512 bb7abcff7f339925e5321063eb5a37e02699514401b2e194165d712efedf0db591eb3bd2c2fcb5ce08d3abe6da1e4c794a97c8bcee6d9218c23c3c6b8d1f309e
- SSDEEP 24576:QqDEvCTbMWu7rQYlBQcBiT6rprG8aSC2+b+HdiJUX:QTvC/MTQYxsWR7aSC2+b+HoJU
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation file.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133645603315346478" chrome.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 952 chrome.exe 952 chrome.exe 3040 chrome.exe 3040 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 952 chrome.exe 952 chrome.exe 952 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 952 chrome.exe Token: SeCreatePagefilePrivilege 952 chrome.exe Token: SeShutdownPrivilege 952 chrome.exe Token: SeCreatePagefilePrivilege 952 chrome.exe Token: SeShutdownPrivilege 952 chrome.exe Token: SeCreatePagefilePrivilege 952 chrome.exe Token: SeShutdownPrivilege 952 chrome.exe Token: SeCreatePagefilePrivilege 952 chrome.exe Token: SeShutdownPrivilege 952 chrome.exe Token: SeCreatePagefilePrivilege 952 chrome.exe Token: SeShutdownPrivilege 952 chrome.exe Token: SeCreatePagefilePrivilege 952 chrome.exe Token: SeShutdownPrivilege 952 chrome.exe Token: SeCreatePagefilePrivilege 952 chrome.exe Token: SeShutdownPrivilege 952 chrome.exe Token: SeCreatePagefilePrivilege 952 chrome.exe Token: SeShutdownPrivilege 952 chrome.exe Token: SeCreatePagefilePrivilege 952 chrome.exe Token: SeShutdownPrivilege 952 chrome.exe Token: SeCreatePagefilePrivilege 952 chrome.exe Token: SeShutdownPrivilege 952 chrome.exe Token: SeCreatePagefilePrivilege 952 chrome.exe Token: SeShutdownPrivilege 952 chrome.exe Token: SeCreatePagefilePrivilege 952 chrome.exe Token: SeShutdownPrivilege 952 chrome.exe Token: SeCreatePagefilePrivilege 952 chrome.exe Token: SeShutdownPrivilege 952 chrome.exe Token: SeCreatePagefilePrivilege 952 chrome.exe Token: SeShutdownPrivilege 952 chrome.exe Token: SeCreatePagefilePrivilege 952 chrome.exe Token: SeShutdownPrivilege 952 chrome.exe Token: SeCreatePagefilePrivilege 952 chrome.exe Token: SeShutdownPrivilege 952 chrome.exe Token: SeCreatePagefilePrivilege 952 chrome.exe Token: SeShutdownPrivilege 952 chrome.exe Token: SeCreatePagefilePrivilege 952 chrome.exe Token: SeShutdownPrivilege 952 chrome.exe Token: SeCreatePagefilePrivilege 952 chrome.exe Token: SeShutdownPrivilege 952 chrome.exe Token: SeCreatePagefilePrivilege 952 chrome.exe Token: SeShutdownPrivilege 952 chrome.exe Token: SeCreatePagefilePrivilege 952 chrome.exe Token: SeShutdownPrivilege 952 chrome.exe Token: SeCreatePagefilePrivilege 952 chrome.exe Token: SeShutdownPrivilege 952 chrome.exe Token: SeCreatePagefilePrivilege 952 chrome.exe Token: SeShutdownPrivilege 952 chrome.exe Token: SeCreatePagefilePrivilege 952 chrome.exe Token: SeShutdownPrivilege 952 chrome.exe Token: SeCreatePagefilePrivilege 952 chrome.exe Token: SeShutdownPrivilege 952 chrome.exe Token: SeCreatePagefilePrivilege 952 chrome.exe Token: SeShutdownPrivilege 952 chrome.exe Token: SeCreatePagefilePrivilege 952 chrome.exe Token: SeShutdownPrivilege 952 chrome.exe Token: SeCreatePagefilePrivilege 952 chrome.exe Token: SeShutdownPrivilege 952 chrome.exe Token: SeCreatePagefilePrivilege 952 chrome.exe Token: SeShutdownPrivilege 952 chrome.exe Token: SeCreatePagefilePrivilege 952 chrome.exe Token: SeShutdownPrivilege 952 chrome.exe Token: SeCreatePagefilePrivilege 952 chrome.exe Token: SeShutdownPrivilege 952 chrome.exe Token: SeCreatePagefilePrivilege 952 chrome.exe - Suspicious use of FindShellTrayWindow 63 IoCs
pid Process 3160 file.exe 3160 file.exe 952 chrome.exe 952 chrome.exe 952 chrome.exe 952 chrome.exe 952 chrome.exe 952 chrome.exe 952 chrome.exe 952 chrome.exe 952 chrome.exe 952 chrome.exe 952 chrome.exe 952 chrome.exe 952 chrome.exe 952 chrome.exe 952 chrome.exe 952 chrome.exe 952 chrome.exe 3160 file.exe 952 chrome.exe 952 chrome.exe 952 chrome.exe 952 chrome.exe 952 chrome.exe 952 chrome.exe 952 chrome.exe 952 chrome.exe 952 chrome.exe 3160 file.exe 3160 file.exe 952 chrome.exe 3160 file.exe 3160 file.exe 3160 file.exe 3160 file.exe 3160 file.exe 3160 file.exe 3160 file.exe 3160 file.exe 3160 file.exe 3160 file.exe 3160 file.exe 3160 file.exe 3160 file.exe 3160 file.exe 3160 file.exe 3160 file.exe 3160 file.exe 3160 file.exe 3160 file.exe 3160 file.exe 3160 file.exe 3160 file.exe 3160 file.exe 3160 file.exe 3160 file.exe 3160 file.exe 3160 file.exe 3160 file.exe 3160 file.exe 3160 file.exe 3160 file.exe - Suspicious use of SendNotifyMessage 60 IoCs
pid Process 3160 file.exe 3160 file.exe 952 chrome.exe 952 chrome.exe 952 chrome.exe 952 chrome.exe 952 chrome.exe 952 chrome.exe 952 chrome.exe 952 chrome.exe 952 chrome.exe 952 chrome.exe 952 chrome.exe 952 chrome.exe 952 chrome.exe 952 chrome.exe 952 chrome.exe 952 chrome.exe 3160 file.exe 952 chrome.exe 952 chrome.exe 952 chrome.exe 952 chrome.exe 952 chrome.exe 952 chrome.exe 952 chrome.exe 952 chrome.exe 3160 file.exe 3160 file.exe 3160 file.exe 3160 file.exe 3160 file.exe 3160 file.exe 3160 file.exe 3160 file.exe 3160 file.exe 3160 file.exe 3160 file.exe 3160 file.exe 3160 file.exe 3160 file.exe 3160 file.exe 3160 file.exe 3160 file.exe 3160 file.exe 3160 file.exe 3160 file.exe 3160 file.exe 3160 file.exe 3160 file.exe 3160 file.exe 3160 file.exe 3160 file.exe 3160 file.exe 3160 file.exe 3160 file.exe 3160 file.exe 3160 file.exe 3160 file.exe 3160 file.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3160 wrote to memory of 952 3160 file.exe 81 PID 3160 wrote to memory of 952 3160 file.exe 81 PID 952 wrote to memory of 60 952 chrome.exe 83 PID 952 wrote to memory of 60 952 chrome.exe 83 PID 952 wrote to memory of 4544 952 chrome.exe 84 PID 952 wrote to memory of 4544 952 chrome.exe 84 PID 952 wrote to memory of 4544 952 chrome.exe 84 PID 952 wrote to memory of 4544 952 chrome.exe 84 PID 952 wrote to memory of 4544 952 chrome.exe 84 PID 952 wrote to memory of 4544 952 chrome.exe 84 PID 952 wrote to memory of 4544 952 chrome.exe 84 PID 952 wrote to memory of 4544 952 chrome.exe 84 PID 952 wrote to memory of 4544 952 chrome.exe 84 PID 952 wrote to memory of 4544 952 chrome.exe 84 PID 952 wrote to memory of 4544 952 chrome.exe 84 PID 952 wrote to memory of 4544 952 chrome.exe 84 PID 952 wrote to memory of 4544 952 chrome.exe 84 PID 952 wrote to memory of 4544 952 chrome.exe 84 PID 952 wrote to memory of 4544 952 chrome.exe 84 PID 952 wrote to memory of 4544 952 chrome.exe 84 PID 952 wrote to memory of 4544 952 chrome.exe 84 PID 952 wrote to memory of 4544 952 chrome.exe 84 PID 952 wrote to memory of 4544 952 chrome.exe 84 PID 952 wrote to memory of 4544 952 chrome.exe 84 PID 952 wrote to memory of 4544 952 chrome.exe 84 PID 952 wrote to memory of 4544 952 chrome.exe 84 PID 952 wrote to memory of 4544 952 chrome.exe 84 PID 952 wrote to memory of 4544 952 chrome.exe 84 PID 952 wrote to memory of 4544 952 chrome.exe 84 PID 952 wrote to memory of 4544 952 chrome.exe 84 PID 952 wrote to memory of 4544 952 chrome.exe 84 PID 952 wrote to memory of 4544 952 chrome.exe 84 PID 952 wrote to memory of 4544 952 chrome.exe 84 PID 952 wrote to memory of 4544 952 chrome.exe 84 PID 952 wrote to memory of 4544 952 chrome.exe 84 PID 952 wrote to memory of 3048 952 chrome.exe 85 PID 952 wrote to memory of 3048 952 chrome.exe 85 PID 952 wrote to memory of 4844 952 chrome.exe 86 PID 952 wrote to memory of 4844 952 chrome.exe 86 PID 952 wrote to memory of 4844 952 chrome.exe 86 PID 952 wrote to memory of 4844 952 chrome.exe 86 PID 952 wrote to memory of 4844 952 chrome.exe 86 PID 952 wrote to memory of 4844 952 chrome.exe 86 PID 952 wrote to memory of 4844 952 chrome.exe 86 PID 952 wrote to memory of 4844 952 chrome.exe 86 PID 952 wrote to memory of 4844 952 chrome.exe 86 PID 952 wrote to memory of 4844 952 chrome.exe 86 PID 952 wrote to memory of 4844 952 chrome.exe 86 PID 952 wrote to memory of 4844 952 chrome.exe 86 PID 952 wrote to memory of 4844 952 chrome.exe 86 PID 952 wrote to memory of 4844 952 chrome.exe 86 PID 952 wrote to memory of 4844 952 chrome.exe 86 PID 952 wrote to memory of 4844 952 chrome.exe 86 PID 952 wrote to memory of 4844 952 chrome.exe 86 PID 952 wrote to memory of 4844 952 chrome.exe 86 PID 952 wrote to memory of 4844 952 chrome.exe 86 PID 952 wrote to memory of 4844 952 chrome.exe 86 PID 952 wrote to memory of 4844 952 chrome.exe 86 PID 952 wrote to memory of 4844 952 chrome.exe 86 PID 952 wrote to memory of 4844 952 chrome.exe 86 PID 952 wrote to memory of 4844 952 chrome.exe 86 PID 952 wrote to memory of 4844 952 chrome.exe 86 PID 952 wrote to memory of 4844 952 chrome.exe 86 PID 952 wrote to memory of 4844 952 chrome.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account2⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:952 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe930fab58,0x7ffe930fab68,0x7ffe930fab783⤵PID:60
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1608 --field-trial-handle=1916,i,16027348855134200422,5532986203465256014,131072 /prefetch:23⤵PID:4544
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1916,i,16027348855134200422,5532986203465256014,131072 /prefetch:83⤵PID:3048
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2212 --field-trial-handle=1916,i,16027348855134200422,5532986203465256014,131072 /prefetch:83⤵PID:4844
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3068 --field-trial-handle=1916,i,16027348855134200422,5532986203465256014,131072 /prefetch:13⤵PID:4836
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3080 --field-trial-handle=1916,i,16027348855134200422,5532986203465256014,131072 /prefetch:13⤵PID:4536
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4300 --field-trial-handle=1916,i,16027348855134200422,5532986203465256014,131072 /prefetch:13⤵PID:4944
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3356 --field-trial-handle=1916,i,16027348855134200422,5532986203465256014,131072 /prefetch:83⤵PID:1136
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3136 --field-trial-handle=1916,i,16027348855134200422,5532986203465256014,131072 /prefetch:83⤵PID:3348
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4704 --field-trial-handle=1916,i,16027348855134200422,5532986203465256014,131072 /prefetch:83⤵PID:4316
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2368 --field-trial-handle=1916,i,16027348855134200422,5532986203465256014,131072 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
PID:3040
-
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:404
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 216B
- SHA256 067afd81813a7bd6af5126ce737c153982069947e7bc52062adb289057022963
- MD5 bc5e094d1238ad278b8382278dfd7c30
- SHA1 9a469f0a4e281e243ece97a289730817ac2c444e
- SHA512 1ff83beb6da7ebf26dbde956012fba2a55bde43d0a7114374316d1e26befbbefa442b2451c704ba4db333ef4a90aa57a0738a8777c08d184ddb384f41c92b111
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 cfe78bf51e8d05b866c8d15844ef86895c4d74cc31b78b8058e2499fd4df4c89
- MD5 336671638bfdb215fc4747c5f3e4a964
- SHA1 1218d5c87dabcaf9a4810438852ea2f9bc0a414b
- SHA512 8e42b91c33c3a167e881ce62dba66c84b91cb1abd9fa84f5f4ac1e7938d69d8d606921c6dbb673750ddc6350269ea8d92c8961aaf2a28532d24f04ce6f202c9e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 686B
- SHA256 ab927950a51256bad15e612e0463b7b4d8e51df7ee6cb570cd0f2bcc40273abd
- MD5 2b9d2e0debc0d3ad160194f79c37b15e
- SHA1 4435148654a2da2ee62f9a28b45f0f63682d64f1
- SHA512 3c9b95eafae83e24558690ecafe66b715ebafefad664cd3512a7130281fde84f7a2db5966cb758b9553821a69c2709edf853bb94b17fd8fe5990388dc734bc9b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\a9d4ccce-8630-4b8c-8a7d-1412b150370d.tmp
- Size 2KB
- SHA256 6edfc3ef1948c4ed827ee79b6d1015edad6eba1f2d3d153fc1658fa96fd360ec
- MD5 863eebae7b532199e13049c75078e7ec
- SHA1 39aad837539631ace06add615b7f4ba3ee094e34
- SHA512 bc29bdec07110158df574e28212f049047bac12c9db40509cb0e9d83777144265e40e188dbb8c513b59ab3734aa86631ab33a187014010896c6ff88a7c8e9656
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 7KB
- SHA256 f036baa98d211bd9d4176edc0c3fd37b4ce556177a1968a8d5f349568c4f577e
- MD5 6cce307ddac3f6fd5f20098ec9bd09b5
- SHA1 12009b826056a264aac0540e3f83eeea98e1adee
- SHA512 b21bf8a73ec2095859c7e2e8a9025a7b687805242ad4051ccb711fe78bea8657526c3af317a2df201cd888260e899b29c4d374a89b8831c6a61bcd93d2b69daa
- SSDEEP 192:omD7yWaJsV8Qyh+FpdW85gb8g8F858fxP5tjEsXtScR:omDa4yqH+S/tIsXtScR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 16KB
- SHA256 c80d78f0895a764172614b837a5260da58d37cbdb9a5b3cba2af3dee351657ed
- MD5 9318107a0b30c772658fe3f0869211e3
- SHA1 cf5c6c278d33d5bfde9af47181d554e947bc271a
- SHA512 c0e6874cbb5f7eaf44aed28771f0bb5052328376e47dab0761a7594510de1622b19d80b25bcf5ab4ec60dd290347a83a89d77ccd049d5862de50bbde4bbf653b
- SSDEEP 384:sUbNLPLeb9X1/1kXqKf/pUZNCgVLH2Hf9ElrUwKHG60+4S:s6NLPLG51/1kXqKf/pUZNCgVLH2Hfqli
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 270KB
- SHA256 ebb28e6064680238efee5e612cf824ffe3ccb7102a8a1289fd812dbb096a0a42
- MD5 a01b4730ac76c9fa7a756eba9d7bfdbd
- SHA1 34aedbf899c0af570c7b1f649938689f813cad73
- SHA512 1ccb45972f296fa03bd75c0f8c05796886b6d50e4ee77083a7e30d4ff10d49817a54eabf37d24cba8ec262124ac1562efd22f160cdef05a4bff3ea22c2867843
- SSDEEP 6144:RvgMTjAuH05nN4T4tcGAzeQYRPILxZnhLMJjX0EeGzY2rLf:33x+Xn2eQ5fnReEFsLLf
- MD5 SHA1 SHA512 SSDEEP