Chromium Credential Artefact Cluster
Detects a file containing a cluster of strings commonly associated with Chromium credential stealing malware. The strings include references to Chromium profile database files like 'Login Data', 'Network\Cookies', 'History', and 'Web Data', as well as 'Local State' (often used for encryption keys) and the Windows API function 'CryptUnprotectData', which is used to decrypt DPAPI-protected data.
YARA
