Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

09/05/2024, 05:59

240509-gpzxtade8s 3

09/05/2024, 05:39

240509-gcfneadb3w 1

Analysis

  • max time kernel
    105s
  • max time network
    206s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    09/05/2024, 05:39

General

  • Target

    https://www.sendspace.com/pro/dl/x1wf1p

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 50 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.sendspace.com/pro/dl/x1wf1p
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3004
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef67d9758,0x7fef67d9768,0x7fef67d9778
      2⤵
        PID:3024
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1172 --field-trial-handle=1364,i,6940959267387533597,17668621869361395215,131072 /prefetch:2
        2⤵
          PID:2712
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1504 --field-trial-handle=1364,i,6940959267387533597,17668621869361395215,131072 /prefetch:8
          2⤵
            PID:3016
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1404 --field-trial-handle=1364,i,6940959267387533597,17668621869361395215,131072 /prefetch:8
            2⤵
              PID:2572
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2292 --field-trial-handle=1364,i,6940959267387533597,17668621869361395215,131072 /prefetch:1
              2⤵
                PID:2784
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2308 --field-trial-handle=1364,i,6940959267387533597,17668621869361395215,131072 /prefetch:1
                2⤵
                  PID:2544
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1368 --field-trial-handle=1364,i,6940959267387533597,17668621869361395215,131072 /prefetch:2
                  2⤵
                    PID:1856
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3576 --field-trial-handle=1364,i,6940959267387533597,17668621869361395215,131072 /prefetch:8
                    2⤵
                      PID:1924
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3616 --field-trial-handle=1364,i,6940959267387533597,17668621869361395215,131072 /prefetch:8
                      2⤵
                        PID:1796
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=696 --field-trial-handle=1364,i,6940959267387533597,17668621869361395215,131072 /prefetch:1
                        2⤵
                          PID:2520
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4076 --field-trial-handle=1364,i,6940959267387533597,17668621869361395215,131072 /prefetch:8
                          2⤵
                            PID:2920
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4088 --field-trial-handle=1364,i,6940959267387533597,17668621869361395215,131072 /prefetch:8
                            2⤵
                              PID:2184
                            • C:\Program Files\Internet Explorer\iexplore.exe
                              "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Downloads\INVOICE-VBDSJ09HSJA.svg
                              2⤵
                                PID:2800
                                • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2800 CREDAT:275457 /prefetch:2
                                  3⤵
                                    PID:1896
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4080 --field-trial-handle=1364,i,6940959267387533597,17668621869361395215,131072 /prefetch:8
                                  2⤵
                                    PID:3988
                                • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                  "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                  1⤵
                                    PID:1708
                                  • C:\Program Files\7-Zip\7zG.exe
                                    "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\INVOICE-TBSACOPMSKAS\" -spe -an -ai#7zMap27082:102:7zEvent32692
                                    1⤵
                                    • Suspicious use of FindShellTrayWindow
                                    PID:1716
                                  • C:\Windows\system32\rundll32.exe
                                    "C:\Windows\system32\rundll32.exe" ndfapi.dll,NdfRunDllDiagnoseWithAnswerFile NetworkDiagnosticsSharing C:\Users\Admin\AppData\Local\Temp\NDFA1EA.tmp
                                    1⤵
                                      PID:552
                                      • C:\Windows\system32\msdt.exe
                                        -skip TRUE -path C:\Windows\diagnostics\system\networking -af C:\Users\Admin\AppData\Local\Temp\NDFA1EA.tmp -ep NetworkDiagnosticsSharing
                                        2⤵
                                        • Suspicious use of FindShellTrayWindow
                                        PID:1380
                                    • C:\Windows\System32\sdiagnhost.exe
                                      C:\Windows\System32\sdiagnhost.exe -Embedding
                                      1⤵
                                        PID:3596
                                      • C:\Windows\System32\sdiagnhost.exe
                                        C:\Windows\System32\sdiagnhost.exe -Embedding
                                        1⤵
                                          PID:3140
                                        • C:\Windows\system32\rundll32.exe
                                          "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Downloads\INVOICE-TBSACOPMSKAS\INVOICE-TBSACOPMSKAS.url
                                          1⤵
                                            PID:4020
                                            • C:\Windows\system32\NOTEPAD.EXE
                                              "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\INVOICE-TBSACOPMSKAS\INVOICE-TBSACOPMSKAS.url
                                              2⤵
                                                PID:4048
                                            • C:\Windows\system32\rundll32.exe
                                              "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Downloads\INVOICE-VBDSJ09HSJA.svg
                                              1⤵
                                                PID:1744
                                                • C:\Windows\system32\NOTEPAD.EXE
                                                  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\INVOICE-VBDSJ09HSJA.svg
                                                  2⤵
                                                    PID:1540

                                                Network

                                                MITRE ATT&CK Enterprise v15

                                                Replay Monitor

                                                Loading Replay Monitor...

                                                Downloads

                                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

                                                  Filesize

                                                  68KB

                                                  MD5

                                                  29f65ba8e88c063813cc50a4ea544e93

                                                  SHA1

                                                  05a7040d5c127e68c25d81cc51271ffb8bef3568

                                                  SHA256

                                                  1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

                                                  SHA512

                                                  e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

                                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                  Filesize

                                                  344B

                                                  MD5

                                                  47feda74d37cd520dbace9e48efc6b99

                                                  SHA1

                                                  d0edb7f3df20eae2f590562096cff86050cb036c

                                                  SHA256

                                                  babf7cfed4e6e5d465a7da33a1d16ad28120010cae31c0cf92a0a1ffe21467ba

                                                  SHA512

                                                  3896371bb5eeb9bb703b13724843014c8952180f7ad737d3bdceac9744864c72b1fa29c2c6ea358d34f3e004d40c273ce597abb888052ebf8bd3ec1bd3bc5504

                                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                  Filesize

                                                  344B

                                                  MD5

                                                  a3200c23a0a4c3911ae256930c79c3c9

                                                  SHA1

                                                  6c2bc5efcf3c5cd47b39f75f134544e69a94f090

                                                  SHA256

                                                  6325312fbd7439b4969adca965163e72d7ebc372f2bb4bb0dbee1425dc84139a

                                                  SHA512

                                                  1ae7e9a18b946a117654ab385c0e44990a1cc31d1964f6ee1b7991768906e8b48180ca2543859258c2307c2f12482e8291c8f42eced1e4bf6706087cf7c24012

                                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                  Filesize

                                                  344B

                                                  MD5

                                                  9209e74fa5e0a91d3a49306ee3458a17

                                                  SHA1

                                                  0c6c6e56d54ee6ef1d30010f710f62b4a755f3ca

                                                  SHA256

                                                  8f4f6990ebda8fd1addf22d525fdfc26b31e972091118edf6486aaf178aad5a5

                                                  SHA512

                                                  5ea83195b569ffabc1de85178b8bd1da7c3d2a81223bff3cf2df7b75fae563e5dbd6eca8863b1270f4dee3c29c4ecb669358d2ce3c32fc0be028b6a58dd78040

                                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                  Filesize

                                                  344B

                                                  MD5

                                                  cf6e749325d94d211315e3ab0a0c3e98

                                                  SHA1

                                                  84ac40056099378071588552dbf61aa9f315e8ab

                                                  SHA256

                                                  f915ab391d9eb439771d1d6a8e945023a9e9b062f3478a618b6e6eeff8b4ad14

                                                  SHA512

                                                  ff1dc866ce746c63dbad1d01edbbb02152175171305def8e2f58eb217b771c1e9b4f37957906446a5e9a7d3ebdbcb3c5d6d05d14eca3957940ecda8324f75e78

                                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                  Filesize

                                                  344B

                                                  MD5

                                                  eaddeeeec3727636fd405f91b52a0e7a

                                                  SHA1

                                                  f9268f48b8689b2bfaa0401aab76c14af78c66b4

                                                  SHA256

                                                  10c6c937396cae143af5ac0108d06d25f30fd76a46c7e4c51b53c876b3ac8f2f

                                                  SHA512

                                                  d78048d5ee52692ba572ad5f2dff08937e7ed24664d8f292639ec36d47164692ce1289df8d4aceeff3d39d8c89d8619c7bb3b75b4b997c05336453f95ae8f94f

                                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                  Filesize

                                                  344B

                                                  MD5

                                                  5608880c1b15f57e7db3fa14c1013f9a

                                                  SHA1

                                                  65dff4f93fc749139e557fa430eb2eb969597b88

                                                  SHA256

                                                  24064edc600a34b8ca2411054602ee801b47e27e3cd70a7f095f0d4a1fc2f7b8

                                                  SHA512

                                                  2b9eb2a0b5b04da1abe86b03b1a8ccf989bf7d6b191b4d62c59a0154b55b0168481fce2407466bf525565fce3105f6b53070a5c7e4e56a79fe650cfdcb82af18

                                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                  Filesize

                                                  344B

                                                  MD5

                                                  07956a7669a9704ab52e4966d14fd20f

                                                  SHA1

                                                  443cdb27674cd2276b81a7165c871672d1ac9953

                                                  SHA256

                                                  bcae6125cfb75aac17507a5a2dddc17778dd18bb2c827c594d3cfe07f470d0e8

                                                  SHA512

                                                  b2f54513ac1e9ef7f6386218918f3a9b81abb6973164b94423875624e01d5b0830b6eafa95a7b77e9dd46966cd9d5adee0fae29b3beba7c86ed390c7fe6cea03

                                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                  Filesize

                                                  344B

                                                  MD5

                                                  d5c58fe5f713c0e6a4cec1c90c14cf48

                                                  SHA1

                                                  f8760cf68432d43a748f5649fb847020dc9a7acf

                                                  SHA256

                                                  0d70ea5c69b3c1d6e42cf2cd52d91809c194d0e03f613e3334e1d5cac5686889

                                                  SHA512

                                                  44f39ceec32fba96ae20394a60695f9fc088335992e3f0d80e9447478a84b807d4396572d5ee20214d3311db71f958262a694e9244948d2e7a62ecbbf66ce4ea

                                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                  Filesize

                                                  344B

                                                  MD5

                                                  03d28b110909d1f251971f0ed2fcdb85

                                                  SHA1

                                                  25e26636c01647272fba8ee7fd8a8cd9a14050f3

                                                  SHA256

                                                  8aa63b78269e70b03c567a0f1b736de6701ea3933d90cca54826fc7c44bbcdff

                                                  SHA512

                                                  ea91e3bdfe85bef979e07a0fbc2c90f6e5fbce9ca063f560a978c991d5c37f74c68f331238f3996ab3e5dceacd533894b6bf50e67c54d2279f14a7d2d9430a60

                                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                  Filesize

                                                  344B

                                                  MD5

                                                  41e050f59b37803ae81a04b39c78179d

                                                  SHA1

                                                  f91ef3bcbcb8e3445da02d0e5f8c5dbefdc39094

                                                  SHA256

                                                  14915f422567a9b25c3ca4960fb111cb1510e146e8a04aa889483ae95abfc0bf

                                                  SHA512

                                                  e65c71575289c7bd106827fd1c07dfec82956ae2b77d28f4c2291fbafec1c132aaedcfe4cb12c374890eeb760100dec94bb0533a0e018086aad7c1d60d54bf33

                                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                  Filesize

                                                  344B

                                                  MD5

                                                  a5753769653572f1176c9b6a88113fa3

                                                  SHA1

                                                  2c7dfad15566d3feb8c8e081e0ac2866082720d3

                                                  SHA256

                                                  8296d68d3a8eee8e36e489750a0e4ac914717ae452f0e891aa8a2d65713248c8

                                                  SHA512

                                                  666b3409b022547f3e58b34f039ae44cd645ac1f79149b2e767fbede2f155c5d2e7f5d5d379bb589698a49490f363795129d17c3c5574615ec63ccd4709b7772

                                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                  Filesize

                                                  344B

                                                  MD5

                                                  3c9e1ad0456f1e4747e2801fc09bcd81

                                                  SHA1

                                                  00c7c1e234850e5c609a5fe68fad525d31dc88bc

                                                  SHA256

                                                  e3328f1c6918e42ed681e3f467b96aacc1622986fa4ed615f8c40f8796af42d0

                                                  SHA512

                                                  5ebe8cc0f8ee39f898a745c38a13c5033cc979b47b357e7b21c4c8839bfc12270ae30447a2573fed47f9300ae4b34cc473081afb4753afb88cb6e842de4ca49d

                                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                  Filesize

                                                  344B

                                                  MD5

                                                  4f21c08aeb1c1c4a146e414bad3e606b

                                                  SHA1

                                                  bd79952024c2d26663aa411aa8a07263f668bf17

                                                  SHA256

                                                  edbf27b2cd37ca57a7e14a0d8a4cd4ba0ac6147e66ff49e4c5323a5c3f2ebd2f

                                                  SHA512

                                                  3b0bec1b3a8d4ca8b956d1380531bccca612fc8bb9477f186fd904e10dd2f5b14187da9b4f9c9b2dcb9b7f456c2b137212eba756cb019a9ab9ef9fbe6f12e80a

                                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                  Filesize

                                                  344B

                                                  MD5

                                                  09a809ad24f0b31742efa36a91ac212b

                                                  SHA1

                                                  0b4bc5f49fc7c2607ede830f15165365d78a5ad1

                                                  SHA256

                                                  849b5b9575fc239ea7a06b6330b90472edaa632fd45537119e4892c051555e1b

                                                  SHA512

                                                  826817dfc70f2f2dbbea71ff3f7454086b0812a1adf91a3013bd02dfbc3942c21cae56446dd06fd6665467610a95225e05322f5c4a5d434cd308a3ccddaa0952

                                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                  Filesize

                                                  344B

                                                  MD5

                                                  c11a31caa8bc61bdfb70ac37c7893143

                                                  SHA1

                                                  2ea6fd0e2f4429caf95a86d98de8050ad58e92aa

                                                  SHA256

                                                  40cf9dd8567327cfe8c6380dc99b4a4a01b8f0688183d94efe4d6a9651145935

                                                  SHA512

                                                  fb1637ad71cd3da358d0a05b30c27046fe58c6a3580ff16e72fb80c8f82b496bb7bc03941320157e73cfefe12f38abfa58a02f891e936747a569e27a5b12338e

                                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                  Filesize

                                                  344B

                                                  MD5

                                                  977e05c033b9ccf17f755d7a2ddc067b

                                                  SHA1

                                                  8fa0d9cd0c038ded3a5aadfe181a845e03b0da37

                                                  SHA256

                                                  05b8ed38dae4fb5292f8dd57b9c8a911cc535ba64f3228b1c0e5062686d5e477

                                                  SHA512

                                                  f29adebd7b3baea3638441e1dbd6169f9f7ca567fdf9c803d2386f22af8228ff6d1822e4dfdbaecd15d040e2a504df2d1319685e26625969c4752d9a300163b3

                                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                  Filesize

                                                  344B

                                                  MD5

                                                  86655f4e6162d0e83a2dbd6eb52ac94f

                                                  SHA1

                                                  f8315956754b1717506d8e54c0231885ee2edf15

                                                  SHA256

                                                  855f39e2e13cbb6ea3aa9f936c7f3702f342f5d4ab7446742d0cda126d492752

                                                  SHA512

                                                  626a787d3932de3af907ac7bd0b26e6f0660d75706686cb2ff117357a0bf0488e200a5b973a33f72e6980c06e3d5558573bfc149b80139a1c48c2070c9e3f47d

                                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                  Filesize

                                                  344B

                                                  MD5

                                                  773cd0aa4355e6812cb43f634bcc88fd

                                                  SHA1

                                                  12c034a3abf9f063e8d16d6406d3398aa7be531d

                                                  SHA256

                                                  574065fb47350958e994c40436596579d99dc552de99bf91cec44ba7887e07d8

                                                  SHA512

                                                  f39cb028d744a848247a3f2cb98c5011a931f72a4c489b1b8ef9de3df578d898db831de5af75856e6806f3d2aace3494350ac78df0d60846e3fd481e6a7bc991

                                                • C:\Users\Admin\AppData\Local\ElevatedDiagnostics\460911090\2024050905.000\NetworkDiagnostics.0.debugreport.xml

                                                  Filesize

                                                  65KB

                                                  MD5

                                                  351278912a3502c5ba5057eff2fa3b37

                                                  SHA1

                                                  959660a40d71a82bb0df1ce1cb9ebcf4f4f52c7e

                                                  SHA256

                                                  05c6a36839cb98b7d114462f69aae7fc6c6eb30c6629bb5f620e1663180b34ca

                                                  SHA512

                                                  08dc9cd934e1cf07e55cc5dee465c310d75ae4855bfa80069609bea3632d4d3ca9b2881e7f95979e8863863528f6e1437ec642816e19dd5eb0d3c0592c06561b

                                                • C:\Users\Admin\AppData\Local\ElevatedDiagnostics\460911090\2024050905.000\NetworkDiagnostics.1.debugreport.xml

                                                  Filesize

                                                  6KB

                                                  MD5

                                                  f31d472a3fae4107bfdf873a44d53394

                                                  SHA1

                                                  5d7a02486d21d1bc819029db2c41dba83b150553

                                                  SHA256

                                                  fa826769aac3753710cd7c83c06b9b3378fca426a97f84ee97703ac99f56688c

                                                  SHA512

                                                  84939a33f9f33acb5eab94fd966a6ea7b5c1666aef822668d5bf21887c243d1a73aada8ccf5c99c52d09af62d4f6b0a57031027de58cdac64906413899306b4f

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\9310cf84-ac66-4823-af2b-ad257933bd29.tmp

                                                  Filesize

                                                  5KB

                                                  MD5

                                                  e93dc64a9f4c66e0ee0fcbd690493f2c

                                                  SHA1

                                                  06574505e09c323672ce40f073a0e647f59d97ab

                                                  SHA256

                                                  31c4f13ea257891c30cfb384483d9f934a87d09f9ea1f9599e0ca9ce54701ce6

                                                  SHA512

                                                  883650306b18f54972bd4b1e5102e372a2d77e002ab50ed73b69a3f97c75d2a9a0ceb5c166cefd83ef26ee7671e4fdf15fa6418683ece6fbf9035c14db808bd9

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp

                                                  Filesize

                                                  16B

                                                  MD5

                                                  aefd77f47fb84fae5ea194496b44c67a

                                                  SHA1

                                                  dcfbb6a5b8d05662c4858664f81693bb7f803b82

                                                  SHA256

                                                  4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

                                                  SHA512

                                                  b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

                                                  Filesize

                                                  264KB

                                                  MD5

                                                  f50f89a0a91564d0b8a211f8921aa7de

                                                  SHA1

                                                  112403a17dd69d5b9018b8cede023cb3b54eab7d

                                                  SHA256

                                                  b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                                  SHA512

                                                  bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                  Filesize

                                                  5KB

                                                  MD5

                                                  5308a7115d8ab38eb725b9e9778030bf

                                                  SHA1

                                                  4670e54f71cd260c6f44db48bcdbe4f8dd999ea0

                                                  SHA256

                                                  0a006f7662b1e274be072dde6df6ef190181b2948a4a65cc6bfe282fd3da7ea4

                                                  SHA512

                                                  c916b68beec144414a3c3958a90994b7caf177c2321b23396f8913859e76ee81ff9603402f459111f84bebc389bb3bc7e90d7ced11e4f970b7cfd55e0d461bc9

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                  Filesize

                                                  5KB

                                                  MD5

                                                  cd9ab0d007ec791575549f1a31423c25

                                                  SHA1

                                                  fcf05a948410e03eda59c17175e5200665cf8e10

                                                  SHA256

                                                  a6bfa9298d66f3d5b245135a4f7acbaa2a88fd258d4d11536c64da41aee3e78b

                                                  SHA512

                                                  3738feed03951b0fdfbf391f4bf72701a0c0d6dcd7f8831c6580a94da19c374df86265af5906cee4b391480fe0f553b1ba6649cdcfb948d314d11fb20c40a148

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp

                                                  Filesize

                                                  16B

                                                  MD5

                                                  18e723571b00fb1694a3bad6c78e4054

                                                  SHA1

                                                  afcc0ef32d46fe59e0483f9a3c891d3034d12f32

                                                  SHA256

                                                  8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

                                                  SHA512

                                                  43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                  Filesize

                                                  129KB

                                                  MD5

                                                  98b6148b171df897cbe9a5b008b78aa4

                                                  SHA1

                                                  a1f0437e923c1a9a29f81713acc952002b5fa802

                                                  SHA256

                                                  1b217be5dd9786eb5aa3a9a1b00dc3a2fe2489153c31bccd36bc9478ce310276

                                                  SHA512

                                                  4a44208756101fc3bf05f3c9ff850fad8f398af7e694c7761e47e1ec323082b30e7b71c3e414721e5ec58c9f7b40eddb6014942d3036c6aa04168dd007f0ace2

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

                                                  Filesize

                                                  84KB

                                                  MD5

                                                  ad0e7c336e5d24b340ffae67b2686188

                                                  SHA1

                                                  67f42ecfddbf7355767d1dd1d9190a96427a1632

                                                  SHA256

                                                  602b104d194503670d34e92add33e6e1573dd8d07319a187852c4cdf78a40064

                                                  SHA512

                                                  93393df0f809feaf616944c69e8aebde090a25eda81d16b74acc651ca84c62b7ffdbea558d86d37e981bfa3fdf9037d704ec09be9c3453cd7cd3fbac5978f717

                                                • C:\Users\Admin\AppData\Local\Temp\Tar1AF7.tmp

                                                  Filesize

                                                  177KB

                                                  MD5

                                                  435a9ac180383f9fa094131b173a2f7b

                                                  SHA1

                                                  76944ea657a9db94f9a4bef38f88c46ed4166983

                                                  SHA256

                                                  67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

                                                  SHA512

                                                  1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

                                                • C:\Users\Admin\Downloads\INVOICE-TBSACOPMSKAS.zip

                                                  Filesize

                                                  278B

                                                  MD5

                                                  b99e578155a742b900cf0d7890fb8850

                                                  SHA1

                                                  c49d5cb9b1cb718b305b5cdfcd1436a65a07221a

                                                  SHA256

                                                  16f4b5ef8402b9eb8b0d074d5251930eba897b9e2bd50c187509dbabb6124903

                                                  SHA512

                                                  7d2cf4f0970928aed92f9decba5b6a0b0f938122cd29bb20e05f32562d5838ac825b10928a0a802bc8cfe49c724e5712dc5337d4b6172fef036a00344a2f8d29

                                                • C:\Users\Admin\Downloads\INVOICE-TBSACOPMSKAS\INVOICE-TBSACOPMSKAS.url

                                                  Filesize

                                                  149B

                                                  MD5

                                                  a24d9a27e90f312716c1b043563acbe2

                                                  SHA1

                                                  469084d448acef98df310716aea90a8cbd7524c6

                                                  SHA256

                                                  bb3a6fb019866692164261ca3df1c910831939107cbb14e2ca6c897d164b8a3e

                                                  SHA512

                                                  8f97eb3c1dd5515c2b62b26e2e8fec58542ffcd10bc7d63c0d8dfd1557457b9405509f3be582788024dc113bc6ef20a1e421b44b32a1a790be7f31e9f1070f0b

                                                • C:\Users\Admin\Downloads\INVOICE-VBDSJ09HSJA.svg

                                                  Filesize

                                                  1KB

                                                  MD5

                                                  c17bd6c58592d3b13f76acb6970c80e1

                                                  SHA1

                                                  051d65f29593c51312cc817218b48bead50652db

                                                  SHA256

                                                  98582e229fcb702fe2593db6acdb0e9481efcf8fab541ccf96ecb034b58a540d

                                                  SHA512

                                                  2953063f58b0930b282ab8beedbca1332a68481d6701a56b79cc914aaac4d035f675649aa7c5eb527568e7415328f2f8e076f2b3cf1ce651e026d5635178388a

                                                • C:\Windows\TEMP\SDIAG_0a14216f-30ac-47bb-a86d-f5ba0bf0ed36\NetworkDiagnosticsTroubleshoot.ps1

                                                  Filesize

                                                  23KB

                                                  MD5

                                                  1d192ce36953dbb7dc7ee0d04c57ad8d

                                                  SHA1

                                                  7008e759cb47bf74a4ea4cd911de158ef00ace84

                                                  SHA256

                                                  935a231924ae5d4a017b0c99d4a5f3904ef280cea4b3f727d365283e26e8a756

                                                  SHA512

                                                  e864ac74e9425a6c7f1be2bbc87df9423408e16429cb61fa1de8875356226293aa07558b2fafdd5d0597254474204f5ba181f4e96c2bc754f1f414748f80a129

                                                • C:\Windows\TEMP\SDIAG_0a14216f-30ac-47bb-a86d-f5ba0bf0ed36\StartDPSService.ps1

                                                  Filesize

                                                  567B

                                                  MD5

                                                  a660422059d953c6d681b53a6977100e

                                                  SHA1

                                                  0c95dd05514d062354c0eecc9ae8d437123305bb

                                                  SHA256

                                                  d19677234127c38a52aec23686775a8eb3f4e3a406f4a11804d97602d6c31813

                                                  SHA512

                                                  26f8cf9ac95ff649ecc2ed349bc6c7c3a04b188594d5c3289af8f2768ab59672bc95ffefcc83ed3ffa44edd0afeb16a4c2490e633a89fce7965843674d94b523

                                                • C:\Windows\TEMP\SDIAG_0a14216f-30ac-47bb-a86d-f5ba0bf0ed36\UtilityFunctions.ps1

                                                  Filesize

                                                  52KB

                                                  MD5

                                                  2f7c3db0c268cf1cf506fe6e8aecb8a0

                                                  SHA1

                                                  fb35af6b329d60b0ec92e24230eafc8e12b0a9f9

                                                  SHA256

                                                  886a625f71e0c35e5722423ed3aa0f5bff8d120356578ab81a64de2ab73d47f3

                                                  SHA512

                                                  322f2b1404a59ee86c492b58d56b8a6ed6ebc9b844a8c38b7bb0b0675234a3d5cfc9f1d08c38c218070e60ce949aa5322de7a2f87f952e8e653d0ca34ff0de45

                                                • C:\Windows\TEMP\SDIAG_0a14216f-30ac-47bb-a86d-f5ba0bf0ed36\UtilitySetConstants.ps1

                                                  Filesize

                                                  2KB

                                                  MD5

                                                  0c75ae5e75c3e181d13768909c8240ba

                                                  SHA1

                                                  288403fc4bedaacebccf4f74d3073f082ef70eb9

                                                  SHA256

                                                  de5c231c645d3ae1e13694284997721509f5de64ee5c96c966cdfda9e294db3f

                                                  SHA512

                                                  8fc944515f41a837c61a6c4e5181ca273607a89e48fbf86cf8eb8db837aed095aa04fc3043029c3b5cb3710d59abfd86f086ac198200f634bfb1a5dd0823406b

                                                • C:\Windows\TEMP\SDIAG_0a14216f-30ac-47bb-a86d-f5ba0bf0ed36\en-US\LocalizationData.psd1

                                                  Filesize

                                                  5KB

                                                  MD5

                                                  dc9be0fdf9a4e01693cfb7d8a0d49054

                                                  SHA1

                                                  74730fd9c9bd4537fd9a353fe4eafce9fcc105e6

                                                  SHA256

                                                  944186cd57d6adc23a9c28fc271ed92dd56efd6f3bb7c9826f7208ea1a1db440

                                                  SHA512

                                                  92ad96fa6b221882a481b36ff2b7114539eb65be46ee9e3139e45b72da80aac49174155483cba6254b10fff31f0119f07cbc529b1b69c45234c7bb61766aad66

                                                • C:\Windows\Temp\SDIAG_0a14216f-30ac-47bb-a86d-f5ba0bf0ed36\DiagPackage.dll

                                                  Filesize

                                                  478KB

                                                  MD5

                                                  4dae3266ab0bdb38766836008bf2c408

                                                  SHA1

                                                  1748737e777752491b2a147b7e5360eda4276364

                                                  SHA256

                                                  d2ff079b3f9a577f22856d1be0217376f140fcf156e3adf27ebe6149c9fd225a

                                                  SHA512

                                                  91fb8abd1832d785cd5a20da42c5143cd87a8ef49196c06cfb57a7a8de607f39543e8a36be9207842a992769b1c3c55d557519e59063f1f263b499f01887b01b

                                                • C:\Windows\Temp\SDIAG_0a14216f-30ac-47bb-a86d-f5ba0bf0ed36\en-US\DiagPackage.dll.mui

                                                  Filesize

                                                  13KB

                                                  MD5

                                                  1ccc67c44ae56a3b45cc256374e75ee1

                                                  SHA1

                                                  bbfc04c4b0220ae38fa3f3e2ea52b7370436ed1f

                                                  SHA256

                                                  030191d10ffb98cecd3f09ebdc606c768aaf566872f718303592fff06ba51367

                                                  SHA512

                                                  b67241f4ad582e50a32f0ecf53c11796aef9e5b125c4be02511e310b85bdfa3796579bbf3f0c8fe5f106a5591ec85e66d89e062b792ea38ca29cb3b03802f6c6

                                                • C:\Windows\Temp\SDIAG_b150c39d-cf00-4258-940e-5b832133554b\DiagPackage.diagpkg

                                                  Filesize

                                                  152KB

                                                  MD5

                                                  c9fb87fa3460fae6d5d599236cfd77e2

                                                  SHA1

                                                  a5bf8241156e8a9d6f34d70d467a9b5055e087e7

                                                  SHA256

                                                  cde728c08a4e50a02fcff35c90ee2b3b33ab24c8b858f180b6a67bfa94def35f

                                                  SHA512

                                                  f4f0cb1b1c823dcd91f6cfe8d473c41343ebf7ed0e43690eecc290e37cee10c20a03612440f1169eef08cc8059aaa23580aa76dd86c1704c4569e8139f9781b3

                                                • C:\Windows\Temp\SDIAG_b150c39d-cf00-4258-940e-5b832133554b\result\results.xsl

                                                  Filesize

                                                  47KB

                                                  MD5

                                                  310e1da2344ba6ca96666fb639840ea9

                                                  SHA1

                                                  e8694edf9ee68782aa1de05470b884cc1a0e1ded

                                                  SHA256

                                                  67401342192babc27e62d4c1e0940409cc3f2bd28f77399e71d245eae8d3f63c

                                                  SHA512

                                                  62ab361ffea1f0b6ff1cc76c74b8e20c2499d72f3eb0c010d47dba7e6d723f9948dba3397ea26241a1a995cffce2a68cd0aaa1bb8d917dd8f4c8f3729fa6d244

                                                • memory/1380-515-0x0000000000460000-0x0000000000461000-memory.dmp

                                                  Filesize

                                                  4KB