Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    21/02/2024, 07:32

General

  • Target

    0abdfce62536624bbfc8b313265fcf067dde15c3ae820f70088eeebd932fbfa9.exe

  • Size

    570KB

  • MD5

    ba172fe67887f9e64b2a018e4b46ca76

  • SHA1

    63190409cd88478191b0311c0d2482a41b7b81db

  • SHA256

    0abdfce62536624bbfc8b313265fcf067dde15c3ae820f70088eeebd932fbfa9

  • SHA512

    6942fce34f6410e436b8a789431a8d45d7e06b9ad41e9d3f9820cb1aba1c5bd7e7bf0d24f1957420f7682655c253ee1d7acc3b0a3b1a79a26999c268346487ff

  • SSDEEP

    12288:SqgvflaO//G9Bq2Spgnu/X2CWJscuzwhdUvAROYyz8jm3hdzgyvkwhCZ7aXINMXy:yYOnGTq2SinsGCWJsjUhuvAR7yQQsiCE

Malware Config

Extracted

Family

socelars

C2

https://hdbywe.s3.us-west-2.amazonaws.com/dfgg320/

Signatures

  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

  • Socelars payload 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Drops file in Program Files directory 10 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Kills process with taskkill 1 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 34 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0abdfce62536624bbfc8b313265fcf067dde15c3ae820f70088eeebd932fbfa9.exe
    "C:\Users\Admin\AppData\Local\Temp\0abdfce62536624bbfc8b313265fcf067dde15c3ae820f70088eeebd932fbfa9.exe"
    1⤵
    • Drops file in Program Files directory
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:828
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c taskkill /f /im chrome.exe
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1068
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /f /im chrome.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2184
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      2⤵
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:1600
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7059758,0x7fef7059768,0x7fef7059778
        3⤵
          PID:544
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1120 --field-trial-handle=1216,i,12988750020265646953,15588519271572872551,131072 /prefetch:2
          3⤵
            PID:1288
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1508 --field-trial-handle=1216,i,12988750020265646953,15588519271572872551,131072 /prefetch:8
            3⤵
              PID:2144
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1600 --field-trial-handle=1216,i,12988750020265646953,15588519271572872551,131072 /prefetch:8
              3⤵
                PID:1980
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2236 --field-trial-handle=1216,i,12988750020265646953,15588519271572872551,131072 /prefetch:1
                3⤵
                  PID:1936
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2244 --field-trial-handle=1216,i,12988750020265646953,15588519271572872551,131072 /prefetch:1
                  3⤵
                    PID:2248
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2552 --field-trial-handle=1216,i,12988750020265646953,15588519271572872551,131072 /prefetch:1
                    3⤵
                      PID:2532
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1468 --field-trial-handle=1216,i,12988750020265646953,15588519271572872551,131072 /prefetch:2
                      3⤵
                        PID:1416
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3580 --field-trial-handle=1216,i,12988750020265646953,15588519271572872551,131072 /prefetch:1
                        3⤵
                          PID:2600
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4024 --field-trial-handle=1216,i,12988750020265646953,15588519271572872551,131072 /prefetch:8
                          3⤵
                            PID:2168
                      • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                        1⤵
                          PID:1856

                        Network

                        MITRE ATT&CK Enterprise v15

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\background.html

                          Filesize

                          786B

                          MD5

                          9ffe618d587a0685d80e9f8bb7d89d39

                          SHA1

                          8e9cae42c911027aafae56f9b1a16eb8dd7a739c

                          SHA256

                          a1064146f622fe68b94cd65a0e8f273b583449fbacfd6fd75fec1eaaf2ec8d6e

                          SHA512

                          a4e1f53d1e3bf0ff6893f188a510c6b3da37b99b52ddd560d4c90226cb14de6c9e311ee0a93192b1a26db2d76382eb2350dc30ab9db7cbd9ca0a80a507ea1a12

                        • C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\icon.png

                          Filesize

                          6KB

                          MD5

                          362695f3dd9c02c83039898198484188

                          SHA1

                          85dcacc66a106feca7a94a42fc43e08c806a0322

                          SHA256

                          40cfea52dbc50a8a5c250c63d825dcaad3f76e9588f474b3e035b587c912f4ca

                          SHA512

                          a04dc31a6ffc3bb5d56ba0fb03ecf93a88adc7193a384313d2955701bd99441ddf507aa0ddfc61dfc94f10a7e571b3d6a35980e61b06f98dd9eee424dc594a6f

                        • C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\aes.js

                          Filesize

                          13KB

                          MD5

                          4ff108e4584780dce15d610c142c3e62

                          SHA1

                          77e4519962e2f6a9fc93342137dbb31c33b76b04

                          SHA256

                          fc7e184beeda61bf6427938a84560f52348976bb55e807b224eb53930e97ef6a

                          SHA512

                          d6eee0fc02205a3422c16ad120cad8d871563d8fcd4bde924654eac5a37026726328f9a47240cf89ed6c9e93ba5f89c833e84e65eee7db2b4d7d1b4240deaef2

                        • C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\background.js

                          Filesize

                          20KB

                          MD5

                          0682de30871f82a60d2073b666dc3056

                          SHA1

                          84b3107b5ff2fe2d434ded8bdaa846f5751a0ca3

                          SHA256

                          a65c16a05b6fecfc502dd8e119373d584d58df307f80ecb203fa504c25d96ed1

                          SHA512

                          8e5574185f417be68e8c24a33ebb3a917f106b61a0bd1667de9267c0f31c51928c86b9a0429165ceba94b8348bc79e018d72debf56708942582437ef2ccbda74

                        • C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\content.js

                          Filesize

                          3KB

                          MD5

                          c31f14d9b1b840e4b9c851cbe843fc8f

                          SHA1

                          205e3a99dc6c0af0e2f4450ebaa49ebde8e76bb4

                          SHA256

                          03601415885fd5d8967c407f7320d53f4c9ca2ec33bbe767d73a1589c5e36c54

                          SHA512

                          2c3d7ed5384712a0013a2ebbc526e762f257e32199651192742282a9641946b6aea6235d848b1e8cb3b0f916f85d3708a14717a69cbcf081145bc634d11d75aa

                        • C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\jquery-3.3.1.min.js

                          Filesize

                          84KB

                          MD5

                          a09e13ee94d51c524b7e2a728c7d4039

                          SHA1

                          0dc32db4aa9c5f03f3b38c47d883dbd4fed13aae

                          SHA256

                          160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef

                          SHA512

                          f8da8f95b6ed33542a88af19028e18ae3d9ce25350a06bfc3fbf433ed2b38fefa5e639cddfdac703fc6caa7f3313d974b92a3168276b3a016ceb28f27db0714a

                        • C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\mode-ecb.js

                          Filesize

                          604B

                          MD5

                          23231681d1c6f85fa32e725d6d63b19b

                          SHA1

                          f69315530b49ac743b0e012652a3a5efaed94f17

                          SHA256

                          03164b1ac43853fecdbf988ce900016fb174cf65b03e41c0a9a7bf3a95e8c26a

                          SHA512

                          36860113871707a08401f29ab2828545932e57a4ae99e727d8ca2a9f85518d3db3a4e5e4d46ac2b6ba09494fa9727c033d77c36c4bdc376ae048541222724bc2

                        • C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\pad-nopadding.js

                          Filesize

                          268B

                          MD5

                          0f26002ee3b4b4440e5949a969ea7503

                          SHA1

                          31fc518828fe4894e8077ec5686dce7b1ed281d7

                          SHA256

                          282308ebc3702c44129438f8299839ca4d392a0a09fdf0737f08ef1e4aff937d

                          SHA512

                          4290a1aee5601fcbf1eb2beec9b4924c30cd218e94ae099b87ba72c9a4fa077e39d218fc723b8465d259028a6961cc07c0cd6896aa2f67e83f833ca023a80b11

                        • C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\manifest.json

                          Filesize

                          1KB

                          MD5

                          05bfb082915ee2b59a7f32fa3cc79432

                          SHA1

                          c1acd799ae271bcdde50f30082d25af31c1208c3

                          SHA256

                          04392a223cc358bc79fcd306504e8e834d6febbff0f3496f2eb8451797d28aa1

                          SHA512

                          6feea1c8112ac33d117aef3f272b1cc42ec24731c51886ed6f8bc2257b91e4d80089e8ca7ce292cc2f39100a7f662bcc5c37e5622a786f8dc8ea46b8127152f3

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

                          Filesize

                          1KB

                          MD5

                          55540a230bdab55187a841cfe1aa1545

                          SHA1

                          363e4734f757bdeb89868efe94907774a327695e

                          SHA256

                          d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

                          SHA512

                          c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

                          Filesize

                          230B

                          MD5

                          1fab22ae05f43cc64951a9c8a61c2618

                          SHA1

                          2cc96e81f441f7ded080762bef67a54daf83f370

                          SHA256

                          8bb4ed3b9446e2f22583f3f7196ea298b8798950154079f27f7d00eee7f797f8

                          SHA512

                          c3c9df222c34fe23fb7cffe44f6305d53b8108afa26ed2a861e2a8c38e6a0d46cc7576b8690c49dd394e368b192d14add49b90d16cfceaa063516e12637a883b

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                          Filesize

                          344B

                          MD5

                          7d6ca22dc7ae37699a7eff15b3be4a53

                          SHA1

                          61764095d7676f55a078a047a56d36735d0359b8

                          SHA256

                          1a9f8b3340cf1d2fb4b9d3324723d5910670356463c2a48ec7da6e3531b011a3

                          SHA512

                          0b6df091cd2924e141cd269ce45130940cafc084e4f2db488a8376976756c01dba242ad510abbd3c47e3980b6755c10886cadbe6ba548a47b71ea9f249affe09

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                          Filesize

                          344B

                          MD5

                          a5651e86fd8b162dc180738de15541df

                          SHA1

                          3f93eac73ee07cb7bde5db7733ab0ce7ecb3c000

                          SHA256

                          d834399b675981a9eb0b1038b8ced82a4a6f093e0967592527bf7124c3ed1305

                          SHA512

                          2e4c7fa7947f2616a9c5b3710e8330d1fa03a9e8d7656d2b2a88e071e68b2e27c4d5623705d571e2e3c271f387242366301ef35a129fd01430d478c779e992d0

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                          Filesize

                          344B

                          MD5

                          85ccdc4ba11f1618929f5c62f15c3d24

                          SHA1

                          20522831bdd3d9b822a6aff5cc78b395138ebb66

                          SHA256

                          4628e62d77d44c55b0dcc01bdfb35d0c0b82dc24b714ba41f3e6170d8cf56e90

                          SHA512

                          1b96d32ee8591d74455e8b3e42d69276c33ce06f07a62b72bb79147171f50efaefc8b8651aa5469d207127897f5fb5c79021a087f307b523d642d69dd01fbfbf

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                          Filesize

                          344B

                          MD5

                          1e5f6a1cd0407e4fc22be35d6683b7f8

                          SHA1

                          9c39a731254491ddfbbc00fddfad87bf8c8d1abc

                          SHA256

                          692654d3f401dc56cb6f9a0e3d13007ca5160fc2f69737212bf80c0c7ebbb900

                          SHA512

                          5f5d1c1fe5f17d0d58aded3f67ed27c159393c2f23e80331a9ec19bafe4cc80d34d4b0d1913df8d380e1a74b1b4ac878295029488ebe82a37bffc36df006ecb6

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                          Filesize

                          344B

                          MD5

                          5147d54ba41681614a2c30af1ee5955a

                          SHA1

                          e07c3abbdb243521dd3c7d1eb8272d0c920c1c53

                          SHA256

                          2f1a4dfd830e69abe256e9c1f616cde689b3bc9523775a0561d5056460690b24

                          SHA512

                          595be016667988652aa80010b965249086884cfd23e7c7dc5750e62c6c185cd52db700ec627d808b153a11e65385e7f288d2cc610383c8f531ca0f876e45477f

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                          Filesize

                          344B

                          MD5

                          e00ece21524165954b196fe82da3d3ea

                          SHA1

                          7444c4bc8b2e95e4741907c21d08e7b28876ffba

                          SHA256

                          60fe6539a4429fa0eb4b78ef4aadac9462d81e0c452aee3966fb2d72f9e49845

                          SHA512

                          e14fc6f73f9b75a4fc9e3e98f5e0f51595e556b68a3369cb7e566e59c13f4fd3c7493eae431feb906f2684e3a453333d8ce8e698842475e52790cbfce58ab814

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                          Filesize

                          344B

                          MD5

                          c094542e37fd4dc318aabbd13f4a935b

                          SHA1

                          e9f355228682cd40dd84d3cc4047b5f626d660da

                          SHA256

                          c00a851724e03f88d7487aa73bbcc52690bd3328356e79fa189a4af9b9236b25

                          SHA512

                          e8678b9be3d9b4171b737b1e00ebdf16ce056ed76b32a97f6523d38accaef1015d95bf97f86b734da83aea39fa0d929b0b977b982825c994bcb60ec4577bc08d

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

                          Filesize

                          264KB

                          MD5

                          f50f89a0a91564d0b8a211f8921aa7de

                          SHA1

                          112403a17dd69d5b9018b8cede023cb3b54eab7d

                          SHA256

                          b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                          SHA512

                          bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                          Filesize

                          1KB

                          MD5

                          3fac0822263e973f8fc844b8e632b3ef

                          SHA1

                          a79939b836b04dd113f1b4643d592ed13cd27da6

                          SHA256

                          37c25089bc5b2c1c1134c8d468bd6ee720551bd4613cc7bb9cdfec0612cdbec5

                          SHA512

                          8ad158853ae84976f5eae228265c6f2b160073645fa680102538f8553c7d04ac414ba17d3b379541f32f9f2e1d393f566221593848b20f57237b0e46a0e41d3e

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                          Filesize

                          846B

                          MD5

                          bf1676ceaac2aaa20631f55ec6f3cdeb

                          SHA1

                          bf14040d472c96565d25eac543ce80a0b9ed3a2a

                          SHA256

                          6b24ebd626b1a5396761eae970f87ffb0d9308003bbf205f4f1fe70e202edc14

                          SHA512

                          dd45e2df1fb43eb54d3ad101946ae0722dfb0634c19ebcf0d5b7a864e4b0b60f64defd114c5bd3ac14d08b01a36a80fad4d7dbc7ff2594d53cd314282b21ddbe

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                          Filesize

                          852B

                          MD5

                          deecdb9d62e1a2934011359bb31015bd

                          SHA1

                          6ed894952fb585bd81243415a2f46f2dc2928b9a

                          SHA256

                          7e89b7d0ea202dda250bec2fc20be715090e9f1d874aa05b5e13dbcc9917bcc9

                          SHA512

                          d9d5a2f54f08743fe56d44e24c3fc7067520379c401cec46a9068a23b7ea305653632241bdb108545a24babe2e82289ce9cf32de27128bbdde571dd20751e90b

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                          Filesize

                          844B

                          MD5

                          312a13a0104c6b4a15a2e5b0334031e3

                          SHA1

                          91f0781df0bf97291914ce73ff03fc294b9f5ad9

                          SHA256

                          a83b800c529dddede58f81871e14a07e35f868d1dd4ec3d795bacdd405375878

                          SHA512

                          9240393a3fdd82a166764931cd542b706ffc6672a9c2dc694f19f0c504de1070d5e18aa863f0987fdb0e7a700f0c106be49973135993ac8eceff705eab58d724

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          4KB

                          MD5

                          feef70b372fcfabcb128adf8ccba6bc3

                          SHA1

                          b8d3bec69155b5fc0f30571763e416e7cefe49e5

                          SHA256

                          e5dd2f14ae89d648a6a9bcfcb6b4cb787dd1f6d08359a98d8eedd436a3f28d55

                          SHA512

                          12ed81907eca646ca9fc7d0a6c8afe640251ef0ad4bd4b9325ba1e411949b77f1cdcba0a8ae510725a431e582e1b0de3113e53dac33231e942a791d7c6640da5

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          4KB

                          MD5

                          6a7112538a526255cf8e95fb4ed28432

                          SHA1

                          ecd1c3b106a221410208579e29d7387e1f61402c

                          SHA256

                          1e281c8db65a95fd21e3447d54c6d69a43729664331d4aeb72b4dc12643108fa

                          SHA512

                          0eb8584becbba069da910aa9f7b6c707fb7b31a92ca540159ca56bdde0d975ebca9feba04c5d199bf74a46cd39f765c7d6bc42bdd42b31fb16c4a0357bbcc982

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                          Filesize

                          11KB

                          MD5

                          16dc25e8c416d62106b86801ce01aa38

                          SHA1

                          419fbe98ffdaae4a7569a7c2df4fafd7f7f03cef

                          SHA256

                          fa6c464a4cb687ef7ec96448ccb102d2cd61e3cd010b6daee161f4256778aaa4

                          SHA512

                          502ad1bed0fc3a369116ec4d7fb79b77eeb8c652084c5e2078e37fe412de05d058e248b97cafaebab8ded94917cbc22b53f8aa8a7729eef6311738a8c2d95fbf

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                          Filesize

                          11KB

                          MD5

                          40f4aa5393629f9ca562dd360b888e39

                          SHA1

                          48ecabf17733832e27969da9804e85ffdaf839c0

                          SHA256

                          4e364a56552924b1278aac6ec7a8f5eef90785553e1ffe94b3544c53c11ed124

                          SHA512

                          57a70483c3cc60a2ef035499ad7c6b92d599e313ebc0a7177e540248ff1432861f53b06fab6977fc8f7fa5447585bbb127ddc2f468b36c396f1a0a863efda3ad

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\CURRENT

                          Filesize

                          16B

                          MD5

                          18e723571b00fb1694a3bad6c78e4054

                          SHA1

                          afcc0ef32d46fe59e0483f9a3c891d3034d12f32

                          SHA256

                          8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

                          SHA512

                          43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nndannfdnoaiphfcbbpgkhodebpoiocf\CURRENT~RFf765744.TMP

                          Filesize

                          16B

                          MD5

                          46295cac801e5d4857d09837238a6394

                          SHA1

                          44e0fa1b517dbf802b18faf0785eeea6ac51594b

                          SHA256

                          0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                          SHA512

                          8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                        • C:\Users\Admin\AppData\Local\Temp\Cab34F7.tmp

                          Filesize

                          65KB

                          MD5

                          ac05d27423a85adc1622c714f2cb6184

                          SHA1

                          b0fe2b1abddb97837ea0195be70ab2ff14d43198

                          SHA256

                          c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

                          SHA512

                          6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

                        • C:\Users\Admin\AppData\Local\Temp\Tar3548.tmp

                          Filesize

                          171KB

                          MD5

                          9c0c641c06238516f27941aa1166d427

                          SHA1

                          64cd549fb8cf014fcd9312aa7a5b023847b6c977

                          SHA256

                          4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

                          SHA512

                          936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

                        • memory/828-133-0x0000000000400000-0x0000000000584000-memory.dmp

                          Filesize

                          1.5MB

                        • memory/828-0-0x0000000000400000-0x0000000000584000-memory.dmp

                          Filesize

                          1.5MB