74cb827e0324e02bae1b2632b624ff84bd4bd54b796bb046fa27f557ca8f8674

Analysis

max time kernel
123s
max time network
102s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
04/08/2024, 15:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SLAYER Leecher v0.7.exe
Size 6.6MB
Sample240804-sj455aselb
SHA256 74cb827e0324e02bae1b2632b624ff84bd4bd54b796bb046fa27f557ca8f8674
MD5 aa0b6211f5245f25392b74fdbab048eb
SHA1 05c37446aca08847a2688257d0fb138f560b4db2
SHA512 97e44da681f5b7db132cd37b1a6305f45d5ec546a23ae3f55f8a8cd214e5c76d22947d12a844767c88fc1844f297f7ce7a85569859286b3b5816144979d05176
SSDEEP 196608:D15/cj6W2xcU3DNGqNFlVMHa2X9FwKMhU+/Pr:S1tU3DNGIUa2NFYU+L
MD5 SHA1 SHA512 SSDEEP

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133672578762306870"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1472	chrome.exe
1472	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
1472	chrome.exe
1472	chrome.exe
1472	chrome.exe
1472	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1472	chrome.exe
Token: SeCreatePagefilePrivilege	1472	chrome.exe
Token: SeShutdownPrivilege	1472	chrome.exe
Token: SeCreatePagefilePrivilege	1472	chrome.exe
Token: SeShutdownPrivilege	1472	chrome.exe
Token: SeCreatePagefilePrivilege	1472	chrome.exe
Token: SeShutdownPrivilege	1472	chrome.exe
Token: SeCreatePagefilePrivilege	1472	chrome.exe
Token: SeShutdownPrivilege	1472	chrome.exe
Token: SeCreatePagefilePrivilege	1472	chrome.exe
Token: SeShutdownPrivilege	1472	chrome.exe
Token: SeCreatePagefilePrivilege	1472	chrome.exe
Token: SeShutdownPrivilege	1472	chrome.exe
Token: SeCreatePagefilePrivilege	1472	chrome.exe
Token: SeShutdownPrivilege	1472	chrome.exe
Token: SeCreatePagefilePrivilege	1472	chrome.exe
Token: SeShutdownPrivilege	1472	chrome.exe
Token: SeCreatePagefilePrivilege	1472	chrome.exe
Token: SeShutdownPrivilege	1472	chrome.exe
Token: SeCreatePagefilePrivilege	1472	chrome.exe
Token: SeShutdownPrivilege	1472	chrome.exe
Token: SeCreatePagefilePrivilege	1472	chrome.exe
Token: SeShutdownPrivilege	1472	chrome.exe
Token: SeCreatePagefilePrivilege	1472	chrome.exe
Token: SeShutdownPrivilege	1472	chrome.exe
Token: SeCreatePagefilePrivilege	1472	chrome.exe
Token: SeShutdownPrivilege	1472	chrome.exe
Token: SeCreatePagefilePrivilege	1472	chrome.exe
Token: SeShutdownPrivilege	1472	chrome.exe
Token: SeCreatePagefilePrivilege	1472	chrome.exe
Token: SeShutdownPrivilege	1472	chrome.exe
Token: SeCreatePagefilePrivilege	1472	chrome.exe
Token: SeShutdownPrivilege	1472	chrome.exe
Token: SeCreatePagefilePrivilege	1472	chrome.exe
Token: SeShutdownPrivilege	1472	chrome.exe
Token: SeCreatePagefilePrivilege	1472	chrome.exe
Token: SeShutdownPrivilege	1472	chrome.exe
Token: SeCreatePagefilePrivilege	1472	chrome.exe
Token: SeShutdownPrivilege	1472	chrome.exe
Token: SeCreatePagefilePrivilege	1472	chrome.exe
Token: SeShutdownPrivilege	1472	chrome.exe
Token: SeCreatePagefilePrivilege	1472	chrome.exe
Token: SeShutdownPrivilege	1472	chrome.exe
Token: SeCreatePagefilePrivilege	1472	chrome.exe
Token: SeShutdownPrivilege	1472	chrome.exe
Token: SeCreatePagefilePrivilege	1472	chrome.exe
Token: SeShutdownPrivilege	1472	chrome.exe
Token: SeCreatePagefilePrivilege	1472	chrome.exe
Token: SeShutdownPrivilege	1472	chrome.exe
Token: SeCreatePagefilePrivilege	1472	chrome.exe
Token: SeShutdownPrivilege	1472	chrome.exe
Token: SeCreatePagefilePrivilege	1472	chrome.exe
Token: SeShutdownPrivilege	1472	chrome.exe
Token: SeCreatePagefilePrivilege	1472	chrome.exe
Token: SeShutdownPrivilege	1472	chrome.exe
Token: SeCreatePagefilePrivilege	1472	chrome.exe
Token: SeShutdownPrivilege	1472	chrome.exe
Token: SeCreatePagefilePrivilege	1472	chrome.exe
Token: SeShutdownPrivilege	1472	chrome.exe
Token: SeCreatePagefilePrivilege	1472	chrome.exe
Token: SeShutdownPrivilege	1472	chrome.exe
Token: SeCreatePagefilePrivilege	1472	chrome.exe
Token: SeShutdownPrivilege	1472	chrome.exe
Token: SeCreatePagefilePrivilege	1472	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
1472	chrome.exe
1472	chrome.exe
1472	chrome.exe
1472	chrome.exe
1472	chrome.exe
1472	chrome.exe
1472	chrome.exe
1472	chrome.exe
1472	chrome.exe
1472	chrome.exe
1472	chrome.exe
1472	chrome.exe
1472	chrome.exe
1472	chrome.exe
1472	chrome.exe
1472	chrome.exe
1472	chrome.exe
1472	chrome.exe
1472	chrome.exe
1472	chrome.exe
1472	chrome.exe
1472	chrome.exe
1472	chrome.exe
1472	chrome.exe
1472	chrome.exe
1472	chrome.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1472	chrome.exe
1472	chrome.exe
1472	chrome.exe
1472	chrome.exe
1472	chrome.exe
1472	chrome.exe
1472	chrome.exe
1472	chrome.exe
1472	chrome.exe
1472	chrome.exe
1472	chrome.exe
1472	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1472 wrote to memory of 4568	1472	chrome.exe	89
PID 1472 wrote to memory of 4568	1472	chrome.exe	89
PID 1472 wrote to memory of 3048	1472	chrome.exe	90
PID 1472 wrote to memory of 3048	1472	chrome.exe	90
PID 1472 wrote to memory of 3048	1472	chrome.exe	90
PID 1472 wrote to memory of 3048	1472	chrome.exe	90
PID 1472 wrote to memory of 3048	1472	chrome.exe	90
PID 1472 wrote to memory of 3048	1472	chrome.exe	90
PID 1472 wrote to memory of 3048	1472	chrome.exe	90
PID 1472 wrote to memory of 3048	1472	chrome.exe	90
PID 1472 wrote to memory of 3048	1472	chrome.exe	90
PID 1472 wrote to memory of 3048	1472	chrome.exe	90
PID 1472 wrote to memory of 3048	1472	chrome.exe	90
PID 1472 wrote to memory of 3048	1472	chrome.exe	90
PID 1472 wrote to memory of 3048	1472	chrome.exe	90
PID 1472 wrote to memory of 3048	1472	chrome.exe	90
PID 1472 wrote to memory of 3048	1472	chrome.exe	90
PID 1472 wrote to memory of 3048	1472	chrome.exe	90
PID 1472 wrote to memory of 3048	1472	chrome.exe	90
PID 1472 wrote to memory of 3048	1472	chrome.exe	90
PID 1472 wrote to memory of 3048	1472	chrome.exe	90
PID 1472 wrote to memory of 3048	1472	chrome.exe	90
PID 1472 wrote to memory of 3048	1472	chrome.exe	90
PID 1472 wrote to memory of 3048	1472	chrome.exe	90
PID 1472 wrote to memory of 3048	1472	chrome.exe	90
PID 1472 wrote to memory of 3048	1472	chrome.exe	90
PID 1472 wrote to memory of 3048	1472	chrome.exe	90
PID 1472 wrote to memory of 3048	1472	chrome.exe	90
PID 1472 wrote to memory of 3048	1472	chrome.exe	90
PID 1472 wrote to memory of 3048	1472	chrome.exe	90
PID 1472 wrote to memory of 3048	1472	chrome.exe	90
PID 1472 wrote to memory of 3048	1472	chrome.exe	90
PID 1472 wrote to memory of 1588	1472	chrome.exe	91
PID 1472 wrote to memory of 1588	1472	chrome.exe	91
PID 1472 wrote to memory of 72	1472	chrome.exe	92
PID 1472 wrote to memory of 72	1472	chrome.exe	92
PID 1472 wrote to memory of 72	1472	chrome.exe	92
PID 1472 wrote to memory of 72	1472	chrome.exe	92
PID 1472 wrote to memory of 72	1472	chrome.exe	92
PID 1472 wrote to memory of 72	1472	chrome.exe	92
PID 1472 wrote to memory of 72	1472	chrome.exe	92
PID 1472 wrote to memory of 72	1472	chrome.exe	92
PID 1472 wrote to memory of 72	1472	chrome.exe	92
PID 1472 wrote to memory of 72	1472	chrome.exe	92
PID 1472 wrote to memory of 72	1472	chrome.exe	92
PID 1472 wrote to memory of 72	1472	chrome.exe	92
PID 1472 wrote to memory of 72	1472	chrome.exe	92
PID 1472 wrote to memory of 72	1472	chrome.exe	92
PID 1472 wrote to memory of 72	1472	chrome.exe	92
PID 1472 wrote to memory of 72	1472	chrome.exe	92
PID 1472 wrote to memory of 72	1472	chrome.exe	92
PID 1472 wrote to memory of 72	1472	chrome.exe	92
PID 1472 wrote to memory of 72	1472	chrome.exe	92
PID 1472 wrote to memory of 72	1472	chrome.exe	92
PID 1472 wrote to memory of 72	1472	chrome.exe	92
PID 1472 wrote to memory of 72	1472	chrome.exe	92
PID 1472 wrote to memory of 72	1472	chrome.exe	92
PID 1472 wrote to memory of 72	1472	chrome.exe	92
PID 1472 wrote to memory of 72	1472	chrome.exe	92
PID 1472 wrote to memory of 72	1472	chrome.exe	92
PID 1472 wrote to memory of 72	1472	chrome.exe	92
PID 1472 wrote to memory of 72	1472	chrome.exe	92
PID 1472 wrote to memory of 72	1472	chrome.exe	92
PID 1472 wrote to memory of 72	1472	chrome.exe	92

C:\Users\Admin\AppData\Local\Temp\SLAYER Leecher v0.7.exe
"C:\Users\Admin\AppData\Local\Temp\SLAYER Leecher v0.7.exe"
1⤵
PID:2380

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffef3d6cc40,0x7ffef3d6cc4c,0x7ffef3d6cc58
  2⤵
  PID:4568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1856,i,7493309902094621305,3782413312722183680,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1852 /prefetch:2
  2⤵
  PID:3048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2132,i,7493309902094621305,3782413312722183680,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2144 /prefetch:3
  2⤵
  PID:1588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2220,i,7493309902094621305,3782413312722183680,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2232 /prefetch:8
  2⤵
  PID:72
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3112,i,7493309902094621305,3782413312722183680,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3144 /prefetch:1
  2⤵
  PID:4804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3152,i,7493309902094621305,3782413312722183680,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:1188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4428,i,7493309902094621305,3782413312722183680,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4420 /prefetch:1
  2⤵
  PID:4780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4316,i,7493309902094621305,3782413312722183680,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4336 /prefetch:1
  2⤵
  PID:3724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4788,i,7493309902094621305,3782413312722183680,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4888 /prefetch:8
  2⤵
  PID:2756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3440,i,7493309902094621305,3782413312722183680,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4368 /prefetch:8
  2⤵
  PID:1860

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:4144

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

f_000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001
Size 209KB
SHA256 27d9c4613df7a3c04da0b79c13217aa69992b441acb7e44bf2a7578ca87d97d6
MD5 3e552d017d45f8fd93b94cfc86f842f2
SHA1 dbeebe83854328e2575ff67259e3fb6704b17a47
SHA512 e616436f2f15615429c7c5c37de3990c3e86c5e1da7d75a0f524fc458b75d44a5be1a3648a628d63e1cf8aa062e08b538f2f2bc9c6a0b42157beb24f82c571d9
SSDEEP 6144:ewpSHs6ljYg6trFqiSAprekukr20IgIgR:OHvhlo8XGus2oR
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 216B
SHA256 958fc34c895c25e0bbc54a3b5d2545c920eaa9080b880ad40d5b1e1abecb0995
MD5 3b683ebaffa057dd9578d65415d94c00
SHA1 54a36b8afab74377920cdb40323ec3e0d118571e
SHA512 47240d53ee03b03baa12329c618773e0a2a40e9cb71b9a9ef44589239ee0b6671e5426566fb8585221ce5ea6afee751cf1ed80e49e3a995b2d2cb5ff806c60d4
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 f3b3e934a4fac3a2c1a448ab1597d614c3e9d12fb960ea1f52723530798442bb
MD5 79726e17fabb7fb75e2bd32b5fea91bc
SHA1 b863ad5352283c3cc76da4dfc16568d7a5b954f9
SHA512 13be2350c65674a60889cf411a08a6c380adcbcafd7bf1641ca6ea7590af8c513fead98b58e4357cc4326a937afb08e946d4c3a25044db8642f1629e8c88601c
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 356B
SHA256 b99ecbe61b0db9145b3383ccef8b9056070c31d7a5b7cb4ad38ca227a7fad161
MD5 c59264fc0f79091bb58ee2ebf55bbc8c
SHA1 92fe9d2f158467177f1438d0fd0ffe0f9e29b264
SHA512 5a2c0549a92fd9097c88ea4c10b289fdbf1efcafd3c27fa90b43967bac83c25139f28f0be046eb20338f0d04ea3bb6faa2c43f9895e52a19233f5b26fc1b50db
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 2d1452d34bc25c8850e37ac9bc007bfea9df766341474a9ce1476b26377a13c7
MD5 511731174e898e6e5f1f1f4796fd1387
SHA1 811a2fa3d05864a9f7c72d8b58d0cd3854a6fed3
SHA512 ac9d14acf10ab77a34c930f6ebdf5ae08fe47f8ae613194f6a982c4e9458aaf75efd12030781d67a346f5900fa0e0cf0036c83252498c450c8876efa8b30dd26
SSDEEP 192:wR8GXibarepYHV+FhYsHeVn+Po6yIsnVdg4:wR8GXPiMG6ss+4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 8KB
SHA256 3e178b51fa984bf5c8550459e58947f9d21be4107570b22469f8ba68568cec37
MD5 5f12013b99aa223396ebd18edc7c52b0
SHA1 fd8baed27c95e994d9594aa84955f19026374478
SHA512 1298ac538ad2f15c91b54de5c68d861d6a39c5a54591895a908f173acf7afa184297a0d150a6b77ae659233c5a3268bdb2d75ff2a156387e408e1a727b51a5ca
SSDEEP 192:wR8GXibfrepYHV+FhYshepn+Po6yIsnVdg4:wR8GX2iMG6s++4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 8KB
SHA256 d0d6ddbdd58332bec0fb88dab03ab4f86aec386d0a21fb42fb7b5b1c41b8488d
MD5 c7bbd75d7a91064e54eb9565f59cab7d
SHA1 f7851f49ede62f884660f972db20c369da3bb29b
SHA512 2c27f386db6740b6b815d550cdaca82fda946aadb71abebdaa1a694d3416c1bfc7b5806132cf0b0a04b954f8db2620bd83017eeb9999a095f90d3db759502778
SSDEEP 192:wRXGXib1repYHV+FZsktepn+Po6yIsnVdg4:wRXGX4iMGakS+4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 0d1b6fc3fb7561e50672e4b32e32284fbdbfcbaa3196e1832eab06e73040fc65
MD5 47bf947926570d1a5d8e988d3f78e312
SHA1 c85161084b4a9e9950da1236f637a58f4050b66f
SHA512 ceaad25b7ea4037d7d87e99c64ec0f8ce7a02a5bd2bc800a4e3d2ada213dc3e87e1b16bfcc356135112f440ce6d16181532deb33e5a0a5549b4d7cc97a333ace
SSDEEP 192:wR8GXibaErepYHV+FhYsSeRn+Po6yIsnVdg4:wR8GXyiMG6sB+4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 a00f22d867d1eec8cfa9029f673e1cd3647d8997874b1e87f6552edff4eeb916
MD5 eb9a8e406dcee9e73715ebe7e7f1efed
SHA1 af6fb452255a74e9a49b1042548ba05852473270
SHA512 50fb1096b80de97c5868641671067744a1f887a794a0d66347433d8fbae6a1382ead0afd119ea569b3c7b7789143edc3c64058d9ab2b8bf2ef7727913522286d
SSDEEP 192:wR8GXibXrepYHV+FhYsHeVn+Po6yIsnVdg4:wR8GXyiMG6ss+4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 15KB
SHA256 49f1d24053112dcd810a01d243c5cef1a16ec35d29d81cdba35e296d8484fb50
MD5 2c8ee77e7667cf4984baadf27e02242d
SHA1 c0de98e47c17d7b15c63c60b0df597c698d58520
SHA512 e3f26c0daab0fe158b21810f7a4f7a435287b678e81eb8b8c597e911a2dffa08a8b68c8e28b14131a79d474790cbaea23325cd9812b83b50f3f58fa4e6ffbaa3
SSDEEP 384:oIJI7pLhLc+ew5Xv71kXqKf/pUZNCgVLH2HfSQprUOHHGn3KCB:oAI7pLhLnzdv71kXqKf/pUZNCgVLH2HE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 195KB
SHA256 1b77baaec52583a1ae75e5e71fd315d3433a6205db82273e908415d58d4d0cf8
MD5 5a405fb7d9dc7fc9f2d97c951b9bcdc9
SHA1 36fc6a4a21f13f68af73a3a8cee1e7b80eef70e3
SHA512 e9447267716e9869cd1d4bf0b89f6eaac28796db289ebbfdd6f6945cfc6c0dd2330aee46d708d3483284d86ca52809c13849a796a92dc6f5420e639974f48213
SSDEEP 3072:iUY1dFvj9CXpgL3QJOWpCRBT975wAQqiMausf0pMIAfelh5DHz/TOaEne1iTaFP/:t8zvpCcWor6AThXnt7X0ewWFmo
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 195KB
SHA256 a4931c9c290a625490efa31c69f24017fc5a5a7b6ad43dd814b2bdaedd21065c
MD5 0d3e210f54a1c5428764dec7e68bbead
SHA1 fbbbce38821087fbfb720b3026ccde36ba5b9f0f
SHA512 b580420aba1193d3722bea9dd82248b671e3368ecbe3be75a777b05fc2fdcaab91b5b09cbdc1e033c747195e21d4db0e5bdab0de3128102618726398c1f66cab
SSDEEP 3072:hUY1dFvj9CXpgL3QJOWpCRBT975wAQqiMausf0pMIAfelh5DHz/TOaEne1iTaFP/:W8zvpCcWor6AThXnt7X0ewWFmo
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2380-0-0x00007FFEE2653000-0x00007FFEE2655000-memory.dmp

Download

memory/2380-3-0x00007FFEE2650000-0x00007FFEE3112000-memory.dmp

Download

memory/2380-2-0x00007FFEE2650000-0x00007FFEE3112000-memory.dmp

Download

memory/2380-1-0x000001EE5EC10000-0x000001EE5F2AC000-memory.dmp

Download