Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    135s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/05/2023, 16:35

General

  • Target

    $R6U8NP1.exe

  • Size

    156KB

  • MD5

    96bd65d6a85c40e7b16cb33d7e7fe7a6

  • SHA1

    6ba21897890fd6637aaf8e4f6f8d8704e531b0c4

  • SHA256

    fa8b150a06d2ccee4aee81ee84fda0e1269b8aed5efdb0f3c22f2d0b154e470a

  • SHA512

    0f848b2e9ee3d8ad0ed9dfe1ce629b030d3ca15c1f487d885983755434ecbd650a89ce97a56166a890622d27b472415aa889512cc0ec84e834ac2dc70ed427ad

  • SSDEEP

    1536:CXsOju8jOOUfu5HFjElAfzyneSMPuKbvzUllKGzFDOWgoxrq7JjMHUOVOFcKh:h0ucOOUolryn8HbzUl5DONZ7J4rV6r

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops Chrome extension 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Kills process with taskkill 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 34 IoCs
  • Suspicious use of FindShellTrayWindow 30 IoCs
  • Suspicious use of SendNotifyMessage 27 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\$R6U8NP1.exe
    "C:\Users\Admin\AppData\Local\Temp\$R6U8NP1.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:636
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" https://getfiles.wiki/welcome.php
      2⤵
      • Adds Run key to start application
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:5016
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffba01b9758,0x7ffba01b9768,0x7ffba01b9778
        3⤵
          PID:2652
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1812 --field-trial-handle=1828,i,3839306276160131884,13392561214489306563,131072 /prefetch:2
          3⤵
            PID:3912
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1828,i,3839306276160131884,13392561214489306563,131072 /prefetch:8
            3⤵
              PID:4028
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1376 --field-trial-handle=1828,i,3839306276160131884,13392561214489306563,131072 /prefetch:8
              3⤵
                PID:5060
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3136 --field-trial-handle=1828,i,3839306276160131884,13392561214489306563,131072 /prefetch:1
                3⤵
                  PID:452
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3128 --field-trial-handle=1828,i,3839306276160131884,13392561214489306563,131072 /prefetch:1
                  3⤵
                    PID:2164
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2988 --field-trial-handle=1828,i,3839306276160131884,13392561214489306563,131072 /prefetch:8
                    3⤵
                      PID:4632
                  • \??\c:\windows\SysWOW64\taskkill.exe
                    /IM chrome.exe
                    2⤵
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3020
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default" --no-startup-window --load-extension="C:\Users\Admin\AppData\Local\ServiceApp\apps-helper" --hide-crash-restore-bubble
                    2⤵
                    • Drops Chrome extension
                    • Enumerates system info in registry
                    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SendNotifyMessage
                    PID:3372
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffba01b9758,0x7ffba01b9768,0x7ffba01b9778
                      3⤵
                        PID:804
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1756 --field-trial-handle=1976,i,17119705859070884660,7369289244816938762,131072 /prefetch:2
                        3⤵
                          PID:3920
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1912 --field-trial-handle=1976,i,17119705859070884660,7369289244816938762,131072 /prefetch:8
                          3⤵
                            PID:3320
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2236 --field-trial-handle=1976,i,17119705859070884660,7369289244816938762,131072 /prefetch:8
                            3⤵
                              PID:2220
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2956 --field-trial-handle=1976,i,17119705859070884660,7369289244816938762,131072 /prefetch:8
                              3⤵
                                PID:4788
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3288 --field-trial-handle=1976,i,17119705859070884660,7369289244816938762,131072 /prefetch:1
                                3⤵
                                  PID:3240
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3804 --field-trial-handle=1976,i,17119705859070884660,7369289244816938762,131072 /prefetch:8
                                  3⤵
                                    PID:4672
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3972 --field-trial-handle=1976,i,17119705859070884660,7369289244816938762,131072 /prefetch:8
                                    3⤵
                                      PID:1944
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4284 --field-trial-handle=1976,i,17119705859070884660,7369289244816938762,131072 /prefetch:8
                                      3⤵
                                        PID:4684
                                    • \??\c:\windows\SysWOW64\taskkill.exe
                                      /F /IM chrome.exe /T
                                      2⤵
                                      • Kills process with taskkill
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:2476
                                  • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                    1⤵
                                      PID:3796
                                    • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                      1⤵
                                        PID:2204

                                      Network

                                      MITRE ATT&CK Enterprise v6

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

                                        Filesize

                                        40B

                                        MD5

                                        bab948aab646d615b0fbbb90b55433ab

                                        SHA1

                                        0ee46cc7db939e55dcc3a5cd17e2fb893ece7a34

                                        SHA256

                                        e02daa351bf7a75dc1b7e9b11c5d716b89f108058e70326f0a8b7b8ba489ce0e

                                        SHA512

                                        a1f82c1aba6d15216d2313673a200d1fd24f99577b06245f4e326df99ab0bd4c3c509b2ddab14753225b47f4c973ce5ac0e08c90c75430bc65c61c48a5969fed

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

                                        Filesize

                                        40B

                                        MD5

                                        bab948aab646d615b0fbbb90b55433ab

                                        SHA1

                                        0ee46cc7db939e55dcc3a5cd17e2fb893ece7a34

                                        SHA256

                                        e02daa351bf7a75dc1b7e9b11c5d716b89f108058e70326f0a8b7b8ba489ce0e

                                        SHA512

                                        a1f82c1aba6d15216d2313673a200d1fd24f99577b06245f4e326df99ab0bd4c3c509b2ddab14753225b47f4c973ce5ac0e08c90c75430bc65c61c48a5969fed

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_1

                                        Filesize

                                        264KB

                                        MD5

                                        25e17c22adae90dc4c065dc18d305855

                                        SHA1

                                        d9eaf31025d5f06f39dbeb8013436b3aa4d04c4e

                                        SHA256

                                        724a650f968d548c84f4ffb77859e7a6c85f034d41fe62563e8a542a572e793c

                                        SHA512

                                        25142050084984d79c5093934dca65f8117e3f83505156d2b85a0b77cfe0171f29ca9664b8825ba2a0cb28a07edc19302159f78d30fcdfe4b0f2dba69cf63e05

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1

                                        Filesize

                                        264KB

                                        MD5

                                        f50f89a0a91564d0b8a211f8921aa7de

                                        SHA1

                                        112403a17dd69d5b9018b8cede023cb3b54eab7d

                                        SHA256

                                        b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                        SHA512

                                        bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG

                                        Filesize

                                        317B

                                        MD5

                                        e3e8ce4f1776a751d7bec7665b637da5

                                        SHA1

                                        659a4aa7ff5a24b5aac83824ab2fae97d6466492

                                        SHA256

                                        670cdc618419a8f8691b21f125878203ecc9bcab63905493eee93a68bf920781

                                        SHA512

                                        de4a2ece52b208ebb166ec48f1ade77342ac75096e80b357433d248e132049f2412ef6a683dc9221b23381500653eaa30b34f0cf4b8dd79e55f9aaf669d4de7c

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir3372_239127041\CRX_INSTALL\images\autoscroll.png

                                        Filesize

                                        417B

                                        MD5

                                        487193017db6a4ddf0ef482f4c5ce4e2

                                        SHA1

                                        bfd80cd5519dc48c023b1115c7c8dd6baba5d9f8

                                        SHA256

                                        64db57cf7c73252ae1f72b148ada85783e545335abae6ae5d1be2ff0a16b9f18

                                        SHA512

                                        9ddd9b5f74f0cef2cecbf2456a98c6544174f8cbe5e859962c1801e844767fd4a2309c3280cbb229a491759c021d7aec1581f99d6cc235cc425997c4a191416e

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir3372_239127041\CRX_INSTALL\images\icon128.png

                                        Filesize

                                        4KB

                                        MD5

                                        84aee254094f927b13c467ac6dec8883

                                        SHA1

                                        172a9c928a0be09c28ad56e2cdefb04cb1e2c163

                                        SHA256

                                        8bf08a798dae4543cadd035284795e43d7e5cf36d16f53ff51f5539ffb5aacd1

                                        SHA512

                                        86e600be8d811a58501fd2028dc6f2f998c05de1a7200c55068b0b87c1ba9805786028a5de40fde78ffac0f1f576d2858340fd4ef43e01528b5647b0337d42a8

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir3372_239127041\CRX_INSTALL\images\icon16.png

                                        Filesize

                                        1KB

                                        MD5

                                        e5bf9f8cf705fabdd36d73d27d791fd4

                                        SHA1

                                        280fe67d010d0758db3878c1d4c3fb4b952eb714

                                        SHA256

                                        23f65937093bb2c47eef1574d48e8ffa69854f60976acadf9bac0eb6abfcea0a

                                        SHA512

                                        71504ae61f056fb55a5fc4e49adde7b0b452d8d11f1b12dc1bd3db61267e7d6a64a369c3dc4225d47f57cefa8c2778a20155b6ea60311af1d6cfe1a277ff59a5

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir3372_239127041\CRX_INSTALL\images\icon32.png

                                        Filesize

                                        2KB

                                        MD5

                                        8c237391d129c599650b96328f549f3b

                                        SHA1

                                        9edc6a98294a923fb2a7f314700321bb4a73e28f

                                        SHA256

                                        08f2f02f02de3c39a4298b5c1cc57df8e1bc81e6b373216e12acc477baccd184

                                        SHA512

                                        679f6a86551177f74587a0f9280cccd8171c3326a0673655c1c5cb3de3e8d72a360cd91b9e17d0b1dc983e530e67b898a4e844c6346d3fff682f69c52a527e1f

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir3372_239127041\CRX_INSTALL\images\icon48.png

                                        Filesize

                                        3KB

                                        MD5

                                        f77d088f3f9fc668e98fa263dbd2de59

                                        SHA1

                                        3dd44b6168fe7386f6787ef751414eac1f05deb5

                                        SHA256

                                        35efdccd3e917e0e1b09cc920e70ba628ed8d8ec082f1bd65e8cecf0794ac27d

                                        SHA512

                                        43e1737fc82b35ddf87fa0f61c34af660dabb3e21ab6b1abd23cadb16e10ec49322991ac922d353e5a3a10faa1f614b53b7c081f7c0927a64ea90c8a73a26c5e

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir3372_239127041\CRX_INSTALL\manifest.json

                                        Filesize

                                        1KB

                                        MD5

                                        a2be505af2be100dd0b979b695934570

                                        SHA1

                                        cd0422944077eb95be78a2c7c1ddfd3f9591a614

                                        SHA256

                                        ad076b6622ed038ccbec505b92f6650c7678631d2dfa44737dc3f59bb395f7d5

                                        SHA512

                                        9069256fb082598e7176609b75b04105773758c7db29047046dbc1b98d3bf092d821e17f819e8a2a422681aaf068bb4fbfab3a0a92296f54ba3309176f262d08

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir3372_239127041\CRX_INSTALL\src\background.js

                                        Filesize

                                        69B

                                        MD5

                                        475e046ecf4c35e24a90381a8ed27fd8

                                        SHA1

                                        fc7523ff96eab745fe020cdba4ebdcbbabae32a1

                                        SHA256

                                        901b8e290e00dea4df67e270f20a7e02cf37ee4dcd861ad2df9ed82c51011a75

                                        SHA512

                                        dc7e27620fa3b1f4e1c0a9a8e92d5a6c28f66300d29bc47c5679f47eb692c66c46c4de345c849ccdf48f26a60b152356e5a38e05e0a8b0a02957f6e56b5ceb91

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

                                        Filesize

                                        264KB

                                        MD5

                                        f50f89a0a91564d0b8a211f8921aa7de

                                        SHA1

                                        112403a17dd69d5b9018b8cede023cb3b54eab7d

                                        SHA256

                                        b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                        SHA512

                                        bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG

                                        Filesize

                                        329B

                                        MD5

                                        58e6a6c74ac92227d34d9e72361aae6c

                                        SHA1

                                        9f7b79777232944e8ab5166b2836aeafd3fa696c

                                        SHA256

                                        849cae82036bae389aef0e02d647b398a32af39a5073d835d62b9f9431bc68df

                                        SHA512

                                        082c8c2f4bcf06c890c8b0183f09fc20d8ca3d0d45787ee81812fae1a7063b972b1630d15841fc9cc5357d1baf28edd0ac8bd32ea1f91c1450dabdbf99e8834f

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                        Filesize

                                        628B

                                        MD5

                                        6658e1cfdb3e355af9e9b9a82e1a45a7

                                        SHA1

                                        3f91ad8ff7022badcf83f7eb5b605df8f78b3d66

                                        SHA256

                                        16d5e24fa6dbae4f230bcd257bf390a54417865483c048e244d65b63d9e1a7ee

                                        SHA512

                                        d8c4d583f15b3aefcf5f5a83a48af0fe96169482baa2e4fd8549e47ca4045d03a50927079d8e50a0be2862cfecd03c667637ca05d5a0a4caae2cfe8685b3423d

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                        Filesize

                                        628B

                                        MD5

                                        6658e1cfdb3e355af9e9b9a82e1a45a7

                                        SHA1

                                        3f91ad8ff7022badcf83f7eb5b605df8f78b3d66

                                        SHA256

                                        16d5e24fa6dbae4f230bcd257bf390a54417865483c048e244d65b63d9e1a7ee

                                        SHA512

                                        d8c4d583f15b3aefcf5f5a83a48af0fe96169482baa2e4fd8549e47ca4045d03a50927079d8e50a0be2862cfecd03c667637ca05d5a0a4caae2cfe8685b3423d

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                        Filesize

                                        4KB

                                        MD5

                                        edfec7e48c988e00801b5c0adb36d80c

                                        SHA1

                                        14e64167cdd16b87dcb1a4f4d6d7a372f480f9ea

                                        SHA256

                                        8cb8a165a33728da1fa771ededfa8f4f150b3b20e498b02e3d034dedc3830776

                                        SHA512

                                        4e5a322290da3f356461d273fd9ac9df5696e0eee5ce943fb1de7bb99ecfe3bb8f560aa68e92891daa467c17aa705c2710da55ff94a25cfcc780f65bc4890f93

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                        Filesize

                                        4KB

                                        MD5

                                        edfec7e48c988e00801b5c0adb36d80c

                                        SHA1

                                        14e64167cdd16b87dcb1a4f4d6d7a372f480f9ea

                                        SHA256

                                        8cb8a165a33728da1fa771ededfa8f4f150b3b20e498b02e3d034dedc3830776

                                        SHA512

                                        4e5a322290da3f356461d273fd9ac9df5696e0eee5ce943fb1de7bb99ecfe3bb8f560aa68e92891daa467c17aa705c2710da55ff94a25cfcc780f65bc4890f93

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                        Filesize

                                        4KB

                                        MD5

                                        fff3c6ff5e782d6d4b2fefdb30b52c13

                                        SHA1

                                        5e28554f3cc18c5f042b41b4ac69d1cacb142012

                                        SHA256

                                        a867842ec1728d1f352a9593e3ef389c018d24a8e92c57a37d16e58d0ddb1ccc

                                        SHA512

                                        7e550f58918644143c2cca913483b69944e89f6d3ee90224d2ad2325de72d58e398f37c8d1c334344e17f36b4140cf52b43a096d17e355a21f5415a0c7c17ea0

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                        Filesize

                                        13KB

                                        MD5

                                        d70cb4afe979d0ad817d924bac35a7dc

                                        SHA1

                                        d7611d87898edf623256d97fa8c96188b39b3ff3

                                        SHA256

                                        8095da4e15d28409e387441a3ca39f9dfd08a0d92da1c4eea5ec44ac48edd7a7

                                        SHA512

                                        d6208684444bf078cb52ed2823a207688366df1b33440742bd9ecbb4510f644e0374f6c2aa8e09fcdf1cbc36bc12ec5fed7a0c059e135995d55bfac7b6319fb3

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG

                                        Filesize

                                        345B

                                        MD5

                                        1224c8f800de4ab63b3baa14a3b9a5bb

                                        SHA1

                                        73e981c53391538ecd18c13ca7861b1584face1b

                                        SHA256

                                        8a03aaef9cd806dc6d3b4150c5eab5a76af7b5de8475a8de06fea89895b41b6c

                                        SHA512

                                        5a3ad9d421cd5c4515c8bf7ea865354c3341f3bc8dd4ffc0b41368cec5b232bd0f23c615ba186d2ec0695502ce965ebf37b24ac7481e8e390bf97e54029cc829

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG

                                        Filesize

                                        321B

                                        MD5

                                        491835c072f2d1135920f7bc43565bb8

                                        SHA1

                                        c86a8023c9314be2d2d1fcadb5043a19d07f1f89

                                        SHA256

                                        60b8723d697078093dd1f93d3bb18aae4b0d79ca690467381bc731a93302960d

                                        SHA512

                                        346186805c021c244ee2075fec5147f4b6f51325641fcb45edd754c217d50afb5e7ba57bb62cf5c4015b5d264814e725476710c0b9a7973c95029f4337414d1b

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\d8a05c21-5e1b-422d-951c-bd655198811d.tmp

                                        Filesize

                                        1B

                                        MD5

                                        5058f1af8388633f609cadb75a75dc9d

                                        SHA1

                                        3a52ce780950d4d969792a2559cd519d7ee8c727

                                        SHA256

                                        cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

                                        SHA512

                                        0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log

                                        Filesize

                                        57B

                                        MD5

                                        41c7d1373de8e7bd508c548a70910e51

                                        SHA1

                                        f919499049571c75c7eb73fdaaa5198e6dd641b6

                                        SHA256

                                        99c59cbe7db56d56a286485635e4467004641c6275e708887dd35728eb05109a

                                        SHA512

                                        c30cb4ea2478fd816b4a160626b08cb63d2b9dc50eab694607d44d05117e6af8dd707bf4e14cf001cf69007a654ade55149a61ed07f9de6a9a2edcb51afa0773

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG

                                        Filesize

                                        317B

                                        MD5

                                        cd976a5bf9f16d073a39ce3c19e0e4bd

                                        SHA1

                                        1573bbd76450fd95b8591ac064f4d2c201c7ffef

                                        SHA256

                                        e417e8f3644f422958e123de53e4ec6c02f2c6cf8f9341d98349129bdf90adcb

                                        SHA512

                                        5de07f99760e2ab3eb793e4d4b38f5f76f3f59106938fe93eb49ab515ef396d18324b44f8c9abb08f73f403905836ef3928b3cc500b3f690653b6d517b55bdb7

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000003.log

                                        Filesize

                                        252B

                                        MD5

                                        548b88009c391c755cf4489e91db2076

                                        SHA1

                                        8e85c6dd4adb412ec357a78cc3717edc19bba1f4

                                        SHA256

                                        09924217836b8263b510fd56557c93a527a493d9661b7df2c353a85684cdcb87

                                        SHA512

                                        730e5dda9d2664c21f5915dcf6d654b93d7dfce6e1d31926209cc7957e44854f0b5562dbe449be435ff8e29c04cb93344f06377ceecc31ea9259869478c3dc75

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG

                                        Filesize

                                        335B

                                        MD5

                                        a64d2992f1e7056d93ca1890f68a994d

                                        SHA1

                                        2a8d81f8a561758108e68f79996dc5083196aad2

                                        SHA256

                                        b71d11f8f28219ba315e7feb4d2df8fcbbf4ade2a7bdb4048f877fbc6b21eda5

                                        SHA512

                                        84975e77bc2229fdd8406446d4e1bfc89d644ea22a76bfbdff204f1911d394be57af72e97859e6b407bc373c146bca4c5dd8f85bb3ccf1ec928f6adf447cefe6

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_1

                                        Filesize

                                        264KB

                                        MD5

                                        f50f89a0a91564d0b8a211f8921aa7de

                                        SHA1

                                        112403a17dd69d5b9018b8cede023cb3b54eab7d

                                        SHA256

                                        b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                        SHA512

                                        bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_1

                                        Filesize

                                        264KB

                                        MD5

                                        f50f89a0a91564d0b8a211f8921aa7de

                                        SHA1

                                        112403a17dd69d5b9018b8cede023cb3b54eab7d

                                        SHA256

                                        b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                        SHA512

                                        bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version

                                        Filesize

                                        14B

                                        MD5

                                        9eae63c7a967fc314dd311d9f46a45b7

                                        SHA1

                                        caba9c2c93acfe0b9ceb9ab19b992b0fc19c71cf

                                        SHA256

                                        4288925b0cf871c7458c22c46936efb0e903802feb991a0e1803be94ca6c251d

                                        SHA512

                                        bed924bff236bf5b6ce1df1db82e86c935e5830a20d9d24697efd82ca331e30604db8d04b0d692ec8541ec6deb2225bcc7d805b79f2db5726642198ecf6348b8

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                        Filesize

                                        71KB

                                        MD5

                                        15e5147f89438a27c4edc0dd9f56c75f

                                        SHA1

                                        64df3cbeffb70ac7531ece338989941972b8e93d

                                        SHA256

                                        50f37e15729797df15df058bfac419b6beb54250245d5d1d2f6c1540eca182ad

                                        SHA512

                                        4bba653302272d4c2ed30dbb87f7728a77701e5ac9a25a8092565eebfa25fec47a34111d9d35e6410672180af7e0413958ee39bd1752413ab7ace2a3befa7d3f

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                        Filesize

                                        71KB

                                        MD5

                                        15e5147f89438a27c4edc0dd9f56c75f

                                        SHA1

                                        64df3cbeffb70ac7531ece338989941972b8e93d

                                        SHA256

                                        50f37e15729797df15df058bfac419b6beb54250245d5d1d2f6c1540eca182ad

                                        SHA512

                                        4bba653302272d4c2ed30dbb87f7728a77701e5ac9a25a8092565eebfa25fec47a34111d9d35e6410672180af7e0413958ee39bd1752413ab7ace2a3befa7d3f

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                        Filesize

                                        148KB

                                        MD5

                                        e1079bde9ae642d04334930ae4133359

                                        SHA1

                                        6544e8125c6a3a3ed7ffd97dc69fc41300abad06

                                        SHA256

                                        b886b4f387570f046f8b14ee7947a45c0a63de798c87b4e6e549b53cf6a1c812

                                        SHA512

                                        4b5c63e541fd5dfd5ad2e00f296f4234ff5d440c9878f0fba35ac1a342c2f68ad5f853f416af7273eea74c088ed42300bf244d83f0546d4ed0684d1a9e337e2a

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

                                        Filesize

                                        264KB

                                        MD5

                                        f50f89a0a91564d0b8a211f8921aa7de

                                        SHA1

                                        112403a17dd69d5b9018b8cede023cb3b54eab7d

                                        SHA256

                                        b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                        SHA512

                                        bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations

                                        Filesize

                                        86B

                                        MD5

                                        961e3604f228b0d10541ebf921500c86

                                        SHA1

                                        6e00570d9f78d9cfebe67d4da5efe546543949a7

                                        SHA256

                                        f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed

                                        SHA512

                                        535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ee58a301-8128-473d-af12-f8482d8ee38e.tmp

                                        Filesize

                                        71KB

                                        MD5

                                        15e5147f89438a27c4edc0dd9f56c75f

                                        SHA1

                                        64df3cbeffb70ac7531ece338989941972b8e93d

                                        SHA256

                                        50f37e15729797df15df058bfac419b6beb54250245d5d1d2f6c1540eca182ad

                                        SHA512

                                        4bba653302272d4c2ed30dbb87f7728a77701e5ac9a25a8092565eebfa25fec47a34111d9d35e6410672180af7e0413958ee39bd1752413ab7ace2a3befa7d3f

                                      • C:\Users\Admin\AppData\Local\ServiceApp\apps-helper\apps.crx

                                        Filesize

                                        45KB

                                        MD5

                                        d28022bee7b1c61dd1c065a85a8f15ca

                                        SHA1

                                        bb6510937cd735c8dee1f6f8e36c5ea2011ea4e7

                                        SHA256

                                        092f386c78aef402225279c45d519ea6abfb2ce07a735bb1288529c20b1f5db9

                                        SHA512

                                        0215880912ba0907a0d9326c5b63e00ab860278f2f22f2560136a2dc4babf6e5a99764f59d05e8228fabce6f1b2a8e4ff2fda64d353cfdf4b9de07ed3bb7628d

                                      • C:\Users\Admin\AppData\Local\ServiceApp\apps-helper\manifest.json

                                        Filesize

                                        273B

                                        MD5

                                        99f8d6aa35e67db20b5f6e3fc54101ce

                                        SHA1

                                        37e09293aa7cdb8fae7754aaae3e8bd2591a2f29

                                        SHA256

                                        cc1c1c7aa14ac707f66629095b8e117109660c13511f26d6eeda1e9fdc363ab2

                                        SHA512

                                        57562dbe3c33139b98ff244cdcc233c9689823a11032d42b9b179eda53831481422d69a62691eebff34c0ae85c36cbe7f8b16599d89919bab759cfd38af27797

                                      • C:\Users\Admin\AppData\Local\ServiceApp\apps-helper\service.js

                                        Filesize

                                        320B

                                        MD5

                                        0d67e04a068cb7f660c077c00d42bf0e

                                        SHA1

                                        d07b8d3d9300b18eecf5b8d179e1a004811885aa

                                        SHA256

                                        0626d33f723c33ed98f9e8c1a78b43510e6dbd196ef91fc0be2633ba73b91649

                                        SHA512

                                        2626de8dff9df4d983437cdcb86aafa4a3a3a894aa1572a33c160d480cf8830aecb230be407f57a5cde45133a436e52926ed8612fc6d6245f50fe918f2baca84

                                      • C:\Users\Admin\AppData\Local\Temp\scoped_dir3372_1651880468\CRX_INSTALL\manifest.json

                                        Filesize

                                        1KB

                                        MD5

                                        9353c270da2dd4836e229cb9ad049fee

                                        SHA1

                                        4fd8e822e85d43ad69692b8185dad64a0da44313

                                        SHA256

                                        4f5a041e6ee123988f6c49904f3dc862c5ab284f55309d8050c5dc2d3d37356c

                                        SHA512

                                        78a38649d45bdbc893fb70e21a66c0e4996752ac910959c1732f4162eeafdff27a68987083e3cbffb91bb9da90e1951642c7387896f46ed684e1814efb00abcb

                                      • C:\Users\Admin\AppData\Local\Temp\scoped_dir3372_1651880468\CRX_INSTALL\src\content.css

                                        Filesize

                                        947B

                                        MD5

                                        fc4d5e1d4d7f3d66a6f5c65abe693fc2

                                        SHA1

                                        8f4fe7ead18db219b8843e005eadb82b7c379971

                                        SHA256

                                        eede9ac5c201aee389bc558407a076360c28f58f6c7eaecc3f7f7c8bbaaf211d

                                        SHA512

                                        db9ad81ede04ae345d0cf5b8970003db6cd8301c25942f76fcedb9af92342e7a988d87b4b7c4fe77cd46afff0a07c780c4677e22f1f518ba2a4d38841b22459e

                                      • C:\Users\Admin\AppData\Local\Temp\scoped_dir3372_1651880468\CRX_INSTALL\src\content.js

                                        Filesize

                                        3KB

                                        MD5

                                        f595e32e27d035c2995cb90a99151a48

                                        SHA1

                                        0ef51b8ea20b398f6459e607c69f0300ab2810d8

                                        SHA256

                                        a70edb3f4706ec8986c899ba01c2544b704a1047213c5eae28a614b739807b69

                                        SHA512

                                        f286a3e0ca84c2d365cef15b7e2f45bda47ed34704d6c04dccf55036f008a3af1b7d23ca43ee6b0cd871cfa11a1981f608538e8f3c26dd43f2f02d4a0397bd0c

                                      • C:\Users\Admin\AppData\Local\Temp\scoped_dir3372_1651880468\CRX_INSTALL\src\jquery-3.5.1.min.js

                                        Filesize

                                        87KB

                                        MD5

                                        dc5e7f18c8d36ac1d3d4753a87c98d0a

                                        SHA1

                                        c8e1c8b386dc5b7a9184c763c88d19a346eb3342

                                        SHA256

                                        f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

                                        SHA512

                                        6cb4f4426f559c06190df97229c05a436820d21498350ac9f118a5625758435171418a022ed523bae46e668f9f8ea871feab6aff58ad2740b67a30f196d65516

                                      • C:\Users\Admin\AppData\Local\Temp\scoped_dir3372_1651880468\apps.crx

                                        Filesize

                                        45KB

                                        MD5

                                        d28022bee7b1c61dd1c065a85a8f15ca

                                        SHA1

                                        bb6510937cd735c8dee1f6f8e36c5ea2011ea4e7

                                        SHA256

                                        092f386c78aef402225279c45d519ea6abfb2ce07a735bb1288529c20b1f5db9

                                        SHA512

                                        0215880912ba0907a0d9326c5b63e00ab860278f2f22f2560136a2dc4babf6e5a99764f59d05e8228fabce6f1b2a8e4ff2fda64d353cfdf4b9de07ed3bb7628d