Analysis Overview
SHA256
97cfaaa4661e1fc410fc150bc0b03ae35a64558afe7c83a2435ad0724cbace14
Threat Level: Known bad
The file cnidc.exe was found to be: Known bad.
Malicious Activity Summary
Xenorat family
XenorRat
Checks computer location settings
Loads dropped DLL
Executes dropped EXE
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Browser Information Discovery
Unsigned PE
Suspicious use of AdjustPrivilegeToken
Suspicious use of SendNotifyMessage
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Checks SCSI registry key(s)
Scheduled Task/Job: Scheduled Task
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of FindShellTrayWindow
Enumerates system info in registry
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-08-12 02:58
Signatures
Xenorat family
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-08-12 02:58
Reported
2024-08-12 03:01
Platform
win7-20240704-en
Max time kernel
142s
Max time network
18s
Command Line
Signatures
XenorRat
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\XenoManager\cnidc.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\cnidc.exe | N/A |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\cnidc.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\XenoManager\cnidc.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\schtasks.exe | N/A |
Scheduled Task/Job: Scheduled Task
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\cnidc.exe
"C:\Users\Admin\AppData\Local\Temp\cnidc.exe"
C:\Users\Admin\AppData\Local\Temp\XenoManager\cnidc.exe
"C:\Users\Admin\AppData\Local\Temp\XenoManager\cnidc.exe"
C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /Create /TN "hi" /XML "C:\Users\Admin\AppData\Local\Temp\tmp59E3.tmp" /F
Network
| Country | Destination | Domain | Proto |
| N/A | 127.0.0.1:4444 | tcp | |
| N/A | 127.0.0.1:4444 | tcp | |
| N/A | 127.0.0.1:4444 | tcp | |
| N/A | 127.0.0.1:4444 | tcp | |
| N/A | 127.0.0.1:4444 | tcp | |
| N/A | 127.0.0.1:4444 | tcp | |
| N/A | 127.0.0.1:4444 | tcp | |
| N/A | 127.0.0.1:4444 | tcp | |
| N/A | 127.0.0.1:4444 | tcp | |
| N/A | 127.0.0.1:4444 | tcp | |
| N/A | 127.0.0.1:4444 | tcp | |
| N/A | 127.0.0.1:4444 | tcp | |
| N/A | 127.0.0.1:4444 | tcp |
Files
memory/2240-0-0x0000000073D3E000-0x0000000073D3F000-memory.dmp
memory/2240-1-0x0000000000FF0000-0x0000000001002000-memory.dmp
\Users\Admin\AppData\Local\Temp\XenoManager\cnidc.exe
| MD5 | 80988e2faaee97ee38873d13914e2c68 |
| SHA1 | cd2465aeeff61d78974f66ebce023cb294d95116 |
| SHA256 | 97cfaaa4661e1fc410fc150bc0b03ae35a64558afe7c83a2435ad0724cbace14 |
| SHA512 | ed45da0660f1c72ea5fa7452030adc9c77459df681ac2c3d3410fa444c8aea4c43e2399281f6156d90d7f3b31e1b007f39ad6137d607ae37ceb7b5d5b423956b |
memory/2300-9-0x0000000001090000-0x00000000010A2000-memory.dmp
memory/2300-10-0x0000000073D30000-0x000000007441E000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\tmp59E3.tmp
| MD5 | 51341935fdd22e880b0e8956566cb07d |
| SHA1 | c9c0115a2b59a5477d5750c1d7816342b49108b9 |
| SHA256 | 24949c5837ba14e03371d9a4ac98e977ee91fe81079779a5983773fd37f8141f |
| SHA512 | 4e99ec4b0164b11589651804edac1c6dcddbcc394e797b2d75be061d371dd75f3823c5d73bfa0510dab9697e9b8b35a28b0a163fa2d747b9d7a43799a1fb2b42 |
memory/2300-13-0x0000000073D30000-0x000000007441E000-memory.dmp
memory/2300-14-0x0000000073D30000-0x000000007441E000-memory.dmp
memory/2300-15-0x0000000073D30000-0x000000007441E000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-08-12 02:58
Reported
2024-08-12 02:59
Platform
win10v2004-20240802-en
Max time kernel
71s
Max time network
72s
Command Line
Signatures
XenorRat
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\cnidc.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\XenoManager\cnidc.exe | N/A |
Browser Information Discovery
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\schtasks.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\cnidc.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\XenoManager\cnidc.exe | N/A |
Checks SCSI registry key(s)
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 | C:\Windows\system32\taskmgr.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A | C:\Windows\system32\taskmgr.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName | C:\Windows\system32\taskmgr.exe | N/A |
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Modifies data under HKEY_USERS
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133679051788062160" | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Scheduled Task/Job: Scheduled Task
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\cnidc.exe
"C:\Users\Admin\AppData\Local\Temp\cnidc.exe"
C:\Users\Admin\AppData\Local\Temp\XenoManager\cnidc.exe
"C:\Users\Admin\AppData\Local\Temp\XenoManager\cnidc.exe"
C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /Create /TN "hi" /XML "C:\Users\Admin\AppData\Local\Temp\tmp99EE.tmp" /F
C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff84400cc40,0x7ff84400cc4c,0x7ff84400cc58
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1908,i,17851100785156837873,7027587873009881281,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=1896 /prefetch:2
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2184,i,17851100785156837873,7027587873009881281,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2420 /prefetch:3
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2244,i,17851100785156837873,7027587873009881281,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2464 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3088,i,17851100785156837873,7027587873009881281,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3200 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3432,i,17851100785156837873,7027587873009881281,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3452 /prefetch:1
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3712,i,17851100785156837873,7027587873009881281,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3748 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4832,i,17851100785156837873,7027587873009881281,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4848 /prefetch:8
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4836,i,17851100785156837873,7027587873009881281,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4848 /prefetch:8
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 204.79.197.237:443 | g.bing.com | tcp |
| US | 8.8.8.8:53 | 133.211.185.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 22.160.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.221.184.93.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 237.197.79.204.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 88.156.103.20.in-addr.arpa | udp |
| N/A | 127.0.0.1:4444 | tcp | |
| US | 8.8.8.8:53 | 104.219.191.52.in-addr.arpa | udp |
| N/A | 127.0.0.1:4444 | tcp | |
| US | 8.8.8.8:53 | 86.23.85.13.in-addr.arpa | udp |
| N/A | 127.0.0.1:4444 | tcp | |
| US | 8.8.8.8:53 | 206.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 192.142.123.92.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 196.249.167.52.in-addr.arpa | udp |
| N/A | 127.0.0.1:4444 | tcp | |
| N/A | 127.0.0.1:4444 | tcp | |
| US | 8.8.8.8:53 | www.google.com | udp |
| NL | 142.250.179.196:443 | www.google.com | udp |
| NL | 142.250.179.196:443 | www.google.com | tcp |
| US | 8.8.8.8:53 | 10.36.251.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 131.179.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 196.179.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | clients2.google.com | udp |
| NL | 172.217.23.206:443 | clients2.google.com | udp |
| N/A | 224.0.0.251:5353 | udp | |
| NL | 172.217.23.206:443 | clients2.google.com | tcp |
| US | 8.8.8.8:53 | 206.23.217.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.143.123.92.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 55.36.223.20.in-addr.arpa | udp |
| N/A | 127.0.0.1:4444 | tcp |
Files
memory/5112-0-0x00000000749AE000-0x00000000749AF000-memory.dmp
memory/5112-1-0x00000000006A0000-0x00000000006B2000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\XenoManager\cnidc.exe
| MD5 | 80988e2faaee97ee38873d13914e2c68 |
| SHA1 | cd2465aeeff61d78974f66ebce023cb294d95116 |
| SHA256 | 97cfaaa4661e1fc410fc150bc0b03ae35a64558afe7c83a2435ad0724cbace14 |
| SHA512 | ed45da0660f1c72ea5fa7452030adc9c77459df681ac2c3d3410fa444c8aea4c43e2399281f6156d90d7f3b31e1b007f39ad6137d607ae37ceb7b5d5b423956b |
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\cnidc.exe.log
| MD5 | 916851e072fbabc4796d8916c5131092 |
| SHA1 | d48a602229a690c512d5fdaf4c8d77547a88e7a2 |
| SHA256 | 7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d |
| SHA512 | 07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521 |
memory/4780-15-0x00000000749A0000-0x0000000075150000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\tmp99EE.tmp
| MD5 | 51341935fdd22e880b0e8956566cb07d |
| SHA1 | c9c0115a2b59a5477d5750c1d7816342b49108b9 |
| SHA256 | 24949c5837ba14e03371d9a4ac98e977ee91fe81079779a5983773fd37f8141f |
| SHA512 | 4e99ec4b0164b11589651804edac1c6dcddbcc394e797b2d75be061d371dd75f3823c5d73bfa0510dab9697e9b8b35a28b0a163fa2d747b9d7a43799a1fb2b42 |
memory/4780-18-0x00000000749A0000-0x0000000075150000-memory.dmp
memory/4780-19-0x00000000749A0000-0x0000000075150000-memory.dmp
memory/1124-20-0x0000026317960000-0x0000026317961000-memory.dmp
memory/1124-21-0x0000026317960000-0x0000026317961000-memory.dmp
memory/1124-22-0x0000026317960000-0x0000026317961000-memory.dmp
memory/1124-32-0x0000026317960000-0x0000026317961000-memory.dmp
memory/1124-31-0x0000026317960000-0x0000026317961000-memory.dmp
memory/1124-30-0x0000026317960000-0x0000026317961000-memory.dmp
memory/1124-29-0x0000026317960000-0x0000026317961000-memory.dmp
memory/1124-28-0x0000026317960000-0x0000026317961000-memory.dmp
memory/1124-27-0x0000026317960000-0x0000026317961000-memory.dmp
memory/1124-26-0x0000026317960000-0x0000026317961000-memory.dmp
\??\pipe\crashpad_4412_OKLHVGFCNMKLYCRM
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
| MD5 | d751713988987e9331980363e24189ce |
| SHA1 | 97d170e1550eee4afc0af065b78cda302a97674c |
| SHA256 | 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945 |
| SHA512 | b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
| MD5 | 75eee54b6ced099c8b70156431364f77 |
| SHA1 | 43cbf2893625968196396388d1d68ddf6669bc09 |
| SHA256 | 8406e9392a28f448277062d52b59687b552826c3cef42b297525ceb0404f7599 |
| SHA512 | 852af7bc75280426127e3ce5f221ab3f3c793fb6f0e175ab001af76bd28f33ad79c9bdd276aa250a6e9a7aa8f81c9d263b5c8918cd0fe5af7f154faa1202a4a0 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\43fe3d72-3d03-4bff-bc32-2857827d3222.tmp
| MD5 | e3e76076bce56318c4678cf6eb4b74c4 |
| SHA1 | 65407fafcfba5f72122c4a0cda87034255007925 |
| SHA256 | 53de037aae2c18f24925dfc1bf6f185c46dea3cc69f3a98543d1b3e98a846daa |
| SHA512 | 57013fceec2d89f2c9247e4f5fffd521181d7ef8a0fa603808e35ae08931616a19fc2ed2eff36edf5d24dec27b6b22735e7b8ec90434d110888b4f6d59edf183 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | a61280e5913c3063175ffe50960fd09d |
| SHA1 | 0d9860b8f5f140b508c5053e057ecfa54a9e76d6 |
| SHA256 | 8c9bf1dc9ed6c5f850e11c777404ca0317e3b9afd4160fdf447c537869ff5728 |
| SHA512 | 744a99eedaf2fc48e783ca4291797ca0f952b62467866ada1a5aaf7d6a8880d484de76e54cb98a5518ff7d912e32bda52349c3744b470fa2f3ceb82b5d7946d6 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | 0990647524619f241b1307af1645c08c |
| SHA1 | 84a2cee0267ac83e3412d13c935da0fedaa56ae4 |
| SHA256 | a44774943a8cd4d596d6ccc5097b1722081563fadb565945d2bec68887e60c2b |
| SHA512 | f90d1feff1f8beef1a646e822697b2dc7866eca469e4fca70f4a80d553ed916c69317a01985e609111d86df494fd2722c4cf38a2ca7eb4b407ac99b07d629eec |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
| MD5 | 375b93ad9ecd317ed1dabfe878229785 |
| SHA1 | d8e0eca47d048b5704743272deb6e8f66ec69644 |
| SHA256 | aee882b4b54fe8c7856ac806210de0628c6d8393b47c2a42967564d5cef0ea5a |
| SHA512 | 53b4dff87e9d68eebb0e266130eb63d0537fb780bd6cdf8d5ccdb2d5456ca5a1fa5397f57d178e4b32b19e03d500aba439d9566445a6512856acb461a770f237 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
| MD5 | 4d86992895568b25dfaa2e2896dc4044 |
| SHA1 | 24eaf41e79d507e970012d0665d5ced3d926235f |
| SHA256 | 418a0e2242aa73ee63dfc7e850e65a40503e97ec84efc5653c20d5b892da85a7 |
| SHA512 | 57a60edbf7454d101ea59e6eaf13bdf3912b6d8cc31c8617a27e60b2c273ae22206e8cb93973d2b06cd80e7c5ee6d9f81e8bfe761dc7c6d8904534801cb5945d |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
| MD5 | 5b3b003273093367c5299294079dd31c |
| SHA1 | 7f4c870d63c1ab7cb856f2c4d1ab199099c04f1d |
| SHA256 | dbb1cbc7aa613a936dc9001b2d1e2dbcab730e1847a68923eb25bcb33332fa67 |
| SHA512 | 9d743e3f9312282226f956914e8e275b9abcdae1f16941b82479dbe5e4c5ad110f640bf0fd966305535628b101f4c860aaf97e226651b46af9407ef46a31c31e |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
| MD5 | f50f89a0a91564d0b8a211f8921aa7de |
| SHA1 | 112403a17dd69d5b9018b8cede023cb3b54eab7d |
| SHA256 | b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec |
| SHA512 | bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58 |