Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    269s
  • max time network
    265s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-es
  • resource tags

    arch:x64arch:x86image:win11-20241007-eslocale:es-esos:windows11-21h2-x64systemwindows
  • submitted
    13/11/2024, 05:47

General

  • Target

    software v1.24 loader.exe

  • Size

    3.6MB

  • MD5

    75b67e3ddf960879f0bfe4db7f2e61b0

  • SHA1

    323759fbb5a65c89351f8b0ac35c5e8c9e344b0c

  • SHA256

    37d10c32a5efe52fc00b976723dfd1eb1a1851e9cbbde5e49d6ba6d3e1848f89

  • SHA512

    17f3858651831973b733931ebc9c19f3b8356107af7328d90cc30373a294b8c17237f64ad04c0c906cc2b5519b390c23941397cadb347621c261f9b63d695c56

  • SSDEEP

    49152:0QusxfsjLFBjCUYamvmf6L7ePUZ94p/D3WoPt5Yg0O7Qzp:5pp

Malware Config

Extracted

Family

meduza

C2

109.107.181.162

Attributes
  • anti_dbg

    true

  • anti_vm

    true

  • build_name

    420

  • extensions

    none

  • grabber_max_size

    1.048576e+06

  • links

    none

  • port

    15666

  • self_destruct

    true

Signatures

  • Meduza

    Meduza is a crypto wallet and info stealer written in C++.

  • Meduza Stealer payload 45 IoCs
  • Meduza family
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 5 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 4 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\software v1.24 loader.exe
    "C:\Users\Admin\AppData\Local\Temp\software v1.24 loader.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3424
    • C:\Users\Admin\AppData\Local\Temp\software v1.24 loader.exe
      "C:\Users\Admin\AppData\Local\Temp\software v1.24 loader.exe"
      2⤵
      • Accesses Microsoft Outlook profiles
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • outlook_office_path
      • outlook_win_path
      PID:4344
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\software v1.24 loader.exe"
        3⤵
        • System Network Configuration Discovery: Internet Connection Discovery
        • Suspicious use of WriteProcessMemory
        PID:4972
        • C:\Windows\system32\PING.EXE
          ping 1.1.1.1 -n 1 -w 3000
          4⤵
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:3848
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:1728
    • C:\Windows\system32\BackgroundTransferHost.exe
      "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
      1⤵
      • Modifies registry class
      PID:4696
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Downloads\SaveSync.odt"
      1⤵
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:3968
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      1⤵
      • Drops file in Windows directory
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:708
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xe8,0x108,0x7ffa29bccc40,0x7ffa29bccc4c,0x7ffa29bccc58
        2⤵
          PID:2824
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1808,i,11054626466039728400,5738077598823382487,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1804 /prefetch:2
          2⤵
            PID:3836
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2108,i,11054626466039728400,5738077598823382487,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2120 /prefetch:3
            2⤵
              PID:4508
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2196,i,11054626466039728400,5738077598823382487,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2212 /prefetch:8
              2⤵
                PID:3428
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3108,i,11054626466039728400,5738077598823382487,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3272 /prefetch:1
                2⤵
                  PID:3492
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3176,i,11054626466039728400,5738077598823382487,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3300 /prefetch:1
                  2⤵
                    PID:4140
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3592,i,11054626466039728400,5738077598823382487,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4520 /prefetch:1
                    2⤵
                      PID:2928
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4424,i,11054626466039728400,5738077598823382487,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4420 /prefetch:8
                      2⤵
                        PID:4748
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4436,i,11054626466039728400,5738077598823382487,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4732 /prefetch:8
                        2⤵
                          PID:1332
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4892,i,11054626466039728400,5738077598823382487,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4396 /prefetch:8
                          2⤵
                            PID:3004
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4948,i,11054626466039728400,5738077598823382487,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4900 /prefetch:8
                            2⤵
                              PID:4720
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4968,i,11054626466039728400,5738077598823382487,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5068 /prefetch:8
                              2⤵
                                PID:4724
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5004,i,11054626466039728400,5738077598823382487,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5080 /prefetch:8
                                2⤵
                                  PID:1504
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4976,i,11054626466039728400,5738077598823382487,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5040 /prefetch:8
                                  2⤵
                                    PID:2256
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4972,i,11054626466039728400,5738077598823382487,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4440 /prefetch:8
                                    2⤵
                                      PID:4688
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5008,i,11054626466039728400,5738077598823382487,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4304 /prefetch:2
                                      2⤵
                                        PID:3880
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=5104,i,11054626466039728400,5738077598823382487,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5144 /prefetch:1
                                        2⤵
                                          PID:2264
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=3216,i,11054626466039728400,5738077598823382487,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5108 /prefetch:1
                                          2⤵
                                            PID:2020
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=4724,i,11054626466039728400,5738077598823382487,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4292 /prefetch:1
                                            2⤵
                                              PID:4676
                                          • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                            "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                            1⤵
                                              PID:1804
                                            • C:\Windows\system32\svchost.exe
                                              C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                              1⤵
                                                PID:4712

                                              Network

                                              MITRE ATT&CK Enterprise v15

                                              Replay Monitor

                                              Loading Replay Monitor...

                                              Downloads

                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                                                Filesize

                                                649B

                                                MD5

                                                fd570f8c096f57946f9ec0e76a31cd86

                                                SHA1

                                                f3ee396e19c15f33d203f0fcb85097b5442e0314

                                                SHA256

                                                311c10b506c95faa8bff6b62d5ad45c94c21099bcdb46cc328b08e49e558ef4e

                                                SHA512

                                                47b985dcd9d33ce53924ac632ed011ad26ae204507a4fe6bcb87e1363690b9869772fe4ce75e08ee235489a31574cabff28b710bdce5e5b195f25dafc01e15f5

                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001c

                                                Filesize

                                                18KB

                                                MD5

                                                b3bdcd933e8d4a8f40dc258581546f9e

                                                SHA1

                                                1f419143ad236ea655cd8d782a242f6f598535e7

                                                SHA256

                                                d7230fa107956a874d3a8a5ae62bdde50f541f3330c667b760a77ee4b9f14adc

                                                SHA512

                                                41e28246d473f89ad43d95bae5039735b09fdcc154b9f74b553f9949ca6cb6eae415f9fe080cf97754dc264170be37d2dc59e5eda6205cd13b79a856230cd451

                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.83.1_0\_locales\en_CA\messages.json

                                                Filesize

                                                851B

                                                MD5

                                                07ffbe5f24ca348723ff8c6c488abfb8

                                                SHA1

                                                6dc2851e39b2ee38f88cf5c35a90171dbea5b690

                                                SHA256

                                                6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c

                                                SHA512

                                                7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.83.1_0\dasherSettingSchema.json

                                                Filesize

                                                854B

                                                MD5

                                                4ec1df2da46182103d2ffc3b92d20ca5

                                                SHA1

                                                fb9d1ba3710cf31a87165317c6edc110e98994ce

                                                SHA256

                                                6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

                                                SHA512

                                                939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                                Filesize

                                                2B

                                                MD5

                                                d751713988987e9331980363e24189ce

                                                SHA1

                                                97d170e1550eee4afc0af065b78cda302a97674c

                                                SHA256

                                                4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                SHA512

                                                b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                Filesize

                                                356B

                                                MD5

                                                15214b585a6daf6a4406c71f2ce18ff2

                                                SHA1

                                                b7e1e6aed82751d5992cb718c7ba3cc99bccd3b0

                                                SHA256

                                                d9dbbda24b5d543346e22b04194687caf90cb7dd2cab36207e1dd4ceb6912765

                                                SHA512

                                                a969b26dcf2cee756de22078f14843b2a03b1a50a5b53dbe069e77b183cc66e1ab0e57546015ed480e909c6401b336a139df96ee923d1319b537e4596472aa53

                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                Filesize

                                                691B

                                                MD5

                                                8bea48940725328474ce06ebe10a2f3c

                                                SHA1

                                                6b55218c570975211116b41e6d6f9436384222bc

                                                SHA256

                                                690cc0683159e84e68924f3796f098b325a0d3009e0aab564eb18e07a89d5b43

                                                SHA512

                                                9f351bc79a3400a5fa420e99bf87660a2645b99905dc15054964193f29ffcdbf51f5714b1f6256849ac9495db7f1032a55ab7d5f4d28c48323035b122a56e69f

                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                Filesize

                                                356B

                                                MD5

                                                fd6d3de5544df126e2ca8542bd383489

                                                SHA1

                                                a46ec9af6ba52dced9cdb3f78683bdf105adb31d

                                                SHA256

                                                4f24f894a7d9613b9a50644e199fb3b66e6ed747cc10ec039b6e2f493d0b8588

                                                SHA512

                                                dfcf34a11a890432eea1750d33140e38201734fbdf1231951b8c44bb838cafa181469ba7b98c525fae4dd089efcd2f6a8e434aa1603f41a9f8b16a43115b28d9

                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                Filesize

                                                10KB

                                                MD5

                                                1b6f59af680300a55e3b77b2fc7813f1

                                                SHA1

                                                85caa58247b8792b007deed00434d22d184171b4

                                                SHA256

                                                ab92594eb3e668367265cfb7f6623b587e223231c04f2e4bf329f9ea6f34f43d

                                                SHA512

                                                747fdad310d43ad470d8fb6fe6918074ba2a4839e1f94322e537d89422688d87fddf1861af7e73b9a54cca74eea1aa91b6cbe5374463e175baedc1fb64136475

                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                Filesize

                                                10KB

                                                MD5

                                                014ff7e8009e8dd5b84bdbe9ee6c0a75

                                                SHA1

                                                ffdc7af34922ea45abbf094452c211535580e83c

                                                SHA256

                                                83eb410164e727dc183113f45c28e59b3926bb6d2affe5c819d718df312c433e

                                                SHA512

                                                78e946112c866f5f798b2e8d0dcdbfabb19aded69c5f9fb34094a570f407acb812ebbf6488e8467995aa3ac32a6b62fcb5fe344f34bbd73dfce5e401bbf4da3a

                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                Filesize

                                                10KB

                                                MD5

                                                f03a229134ba8a6aa225728679d80149

                                                SHA1

                                                aa5b3157f5b494ad9526ccb9905d13b1abfb6d2d

                                                SHA256

                                                377641ae8522933c1d9e2fc71bff7c77066b9b4885a050c0c82020d86481c0da

                                                SHA512

                                                6b20a6a37962ef92d81bbc75c69c715e3422e539972c99430504181f4b8abacec49df3fca44776e56a15a2144160439d1e559cfdd19fd9174196e1bbc4344475

                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                Filesize

                                                9KB

                                                MD5

                                                211812428a42a9228562bd18a7cf1e06

                                                SHA1

                                                1e227d9263a4ae371851801de220760c7997636a

                                                SHA256

                                                0042a8f961cd55312798c8d3de61d7be86ea6fca7cb6b73c5e7786b34e5401f6

                                                SHA512

                                                175ec492d36ede0e1e90fc0f143bcd69f219ece8de01d4839698c4198c4c49e1e8e06a0ad2bd84d08f34ce336be46e92742947672231a14ee31f78a5cb3e8b92

                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                Filesize

                                                9KB

                                                MD5

                                                8ae5182e29732e8ec4cb37ba472066e5

                                                SHA1

                                                e1ca652d695af9517b800d4da88baf1bf2ba47f1

                                                SHA256

                                                a1af5b35a3e6ec8b6cf0c5a32127b59b7c7c4c7e9bc9ab95869d110a7bbc3625

                                                SHA512

                                                f411743677dc2cde62d46a2c7f3ca0f070fe1eff42e7bbff94a21cc46f00d225481d8711c937471bfb3dec52253a5e80d249f503f0723bf5b4ff162666861ec7

                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                                Filesize

                                                15KB

                                                MD5

                                                5770160d33156be7a35190d3e172556b

                                                SHA1

                                                a047ab268880c99fb95ee347722dd1a7a7e830e0

                                                SHA256

                                                76866e268c1160940369853704843b88f3004799b8336562e0e8d91b62c3f94f

                                                SHA512

                                                afd5fa8724092c72470e11cfa53883f7271bfb37336e2ee539a259454f6daa7297cc2fdd799df538cc6809ac14492d891f252fdc31a6d172a889f91d37ab3133

                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

                                                Filesize

                                                72B

                                                MD5

                                                216f93f8747a8d4c63d5716ab0ae4f24

                                                SHA1

                                                a014cbb38d60f0419013be59f42391c1114da92d

                                                SHA256

                                                e5708b73bcb4e2ebd8737fd70cd0b6792b8c3c809a5093c5d628ef439b2d8027

                                                SHA512

                                                ff96b53f8deacbeeb5f35a27a736dc4e6cea5a5d676166c17b06103a81438ed514a5100edbf60250f7629ce7a47f2f3e880cc846b951431ec17cd10b7bbb22d7

                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                Filesize

                                                233KB

                                                MD5

                                                62d7b5c6a41f933056abb519e33fcf43

                                                SHA1

                                                1aaaddbffdd25cd1a9b5b2206d3eed81b92b6c23

                                                SHA256

                                                ee4fe811d9b6311c441b6b48232f6939d8949423320f823a8e30990a54ca0052

                                                SHA512

                                                2dd8d8922987890934d75166f5d3c9dc334a655b09c9ef86d72dc83d770148db05e1cb0908a802ea2a7f8ec2bcca6e53f3b3d236078d6c47845562cbd90ce083

                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                Filesize

                                                233KB

                                                MD5

                                                e0724350c2cfc91fb9743252b97f0c5b

                                                SHA1

                                                0c48924f46520c540a273e9f4cc93f74f0ef2bd9

                                                SHA256

                                                af9f159f992645fa72a98c71d436686492bd332b29fdfabad0fc44d46d53fb13

                                                SHA512

                                                63d8f448f44f5dfad177baafb80cfc451b3be8a3a6606b91915341fd961a98385d1871beecdfefffb072f65b8be8655ccdd6950e9246e357827568858e0e1e09

                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                Filesize

                                                233KB

                                                MD5

                                                191620d2d306a946c5fc0916cb41eaa8

                                                SHA1

                                                2cf9848a7375019524125908c3005a347f7aeefa

                                                SHA256

                                                2a2d2d7a6dcead677ace1c7f7677b4a7cc84c9b98543d41134f88ab5bbfb0265

                                                SHA512

                                                986de1e0f94f7e565a2a829e7c19e4ea93d09f355837091079697d97efbc8b21ab9d843c293123b2d4b05981d09f04eed4236a8635154769da4dc609e78ae3bd

                                              • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\17e2c5a0-9d04-4094-a4e3-ff182a50020a.down_data

                                                Filesize

                                                126KB

                                                MD5

                                                0a110bd321f114ff8727674eee2a490f

                                                SHA1

                                                ed3eed0bc086ef1df640064d483e20487182a215

                                                SHA256

                                                f1f611b30db0431160b742fb7b8a5ae609a7acbd3724810d92e186c65c14c268

                                                SHA512

                                                3c08d7c95e5bb0fbdf87cce4fbf7cb10db1f2d5df8cc3e8c214ae064d1e0a0bbcdb1d599605a04dd0ab8c0c3fe5401e5a75ee8620d219e4e0da0810693bef728

                                              • C:\Users\Admin\AppData\Local\Temp\TCDFF0B.tmp\sist02.xsl

                                                Filesize

                                                245KB

                                                MD5

                                                f883b260a8d67082ea895c14bf56dd56

                                                SHA1

                                                7954565c1f243d46ad3b1e2f1baf3281451fc14b

                                                SHA256

                                                ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353

                                                SHA512

                                                d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e

                                              • C:\Users\Admin\AppData\Local\Temp\scoped_dir708_879059386\75f7095f-0ca8-43b6-a17b-1c62006a24bb.tmp

                                                Filesize

                                                132KB

                                                MD5

                                                da75bb05d10acc967eecaac040d3d733

                                                SHA1

                                                95c08e067df713af8992db113f7e9aec84f17181

                                                SHA256

                                                33ae9b8f06dc777bb1a65a6ba6c3f2a01b25cd1afc291426b46d1df27ea6e7e2

                                                SHA512

                                                56533de53872f023809a20d1ea8532cdc2260d40b05c5a7012c8e61576ff092f006a197f759c92c6b8c429eeec4bb542073b491ddcfd5b22cd4ecbe1a8a7c6ef

                                              • C:\Users\Admin\AppData\Local\Temp\scoped_dir708_879059386\CRX_INSTALL\_locales\en_CA\messages.json

                                                Filesize

                                                711B

                                                MD5

                                                558659936250e03cc14b60ebf648aa09

                                                SHA1

                                                32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825

                                                SHA256

                                                2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b

                                                SHA512

                                                1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

                                              • memory/4344-35-0x0000000140000000-0x00000001401FA000-memory.dmp

                                                Filesize

                                                2.0MB

                                              • memory/4344-54-0x0000000140000000-0x00000001401FA000-memory.dmp

                                                Filesize

                                                2.0MB

                                              • memory/4344-49-0x0000000140000000-0x00000001401FA000-memory.dmp

                                                Filesize

                                                2.0MB

                                              • memory/4344-47-0x0000000140000000-0x00000001401FA000-memory.dmp

                                                Filesize

                                                2.0MB

                                              • memory/4344-46-0x0000000140000000-0x00000001401FA000-memory.dmp

                                                Filesize

                                                2.0MB

                                              • memory/4344-66-0x0000000140000000-0x00000001401FA000-memory.dmp

                                                Filesize

                                                2.0MB

                                              • memory/4344-43-0x0000000140000000-0x00000001401FA000-memory.dmp

                                                Filesize

                                                2.0MB

                                              • memory/4344-42-0x0000000140000000-0x00000001401FA000-memory.dmp

                                                Filesize

                                                2.0MB

                                              • memory/4344-55-0x0000000140000000-0x00000001401FA000-memory.dmp

                                                Filesize

                                                2.0MB

                                              • memory/4344-34-0x0000000140000000-0x00000001401FA000-memory.dmp

                                                Filesize

                                                2.0MB

                                              • memory/4344-39-0x0000000140000000-0x00000001401FA000-memory.dmp

                                                Filesize

                                                2.0MB

                                              • memory/4344-33-0x0000000140000000-0x00000001401FA000-memory.dmp

                                                Filesize

                                                2.0MB

                                              • memory/4344-64-0x0000000140000000-0x00000001401FA000-memory.dmp

                                                Filesize

                                                2.0MB

                                              • memory/4344-92-0x0000000140000000-0x00000001401FA000-memory.dmp

                                                Filesize

                                                2.0MB

                                              • memory/4344-87-0x0000000140000000-0x00000001401FA000-memory.dmp

                                                Filesize

                                                2.0MB

                                              • memory/4344-84-0x0000000140000000-0x00000001401FA000-memory.dmp

                                                Filesize

                                                2.0MB

                                              • memory/4344-78-0x0000000140000000-0x00000001401FA000-memory.dmp

                                                Filesize

                                                2.0MB

                                              • memory/4344-77-0x0000000140000000-0x00000001401FA000-memory.dmp

                                                Filesize

                                                2.0MB

                                              • memory/4344-74-0x0000000140000000-0x00000001401FA000-memory.dmp

                                                Filesize

                                                2.0MB

                                              • memory/4344-72-0x0000000140000000-0x00000001401FA000-memory.dmp

                                                Filesize

                                                2.0MB

                                              • memory/4344-71-0x0000000140000000-0x00000001401FA000-memory.dmp

                                                Filesize

                                                2.0MB

                                              • memory/4344-95-0x0000000140000000-0x00000001401FA000-memory.dmp

                                                Filesize

                                                2.0MB

                                              • memory/4344-96-0x0000000140000000-0x00000001401FA000-memory.dmp

                                                Filesize

                                                2.0MB

                                              • memory/4344-52-0x0000000140000000-0x00000001401FA000-memory.dmp

                                                Filesize

                                                2.0MB

                                              • memory/4344-58-0x0000000140000000-0x00000001401FA000-memory.dmp

                                                Filesize

                                                2.0MB

                                              • memory/4344-59-0x0000000140000000-0x00000001401FA000-memory.dmp

                                                Filesize

                                                2.0MB

                                              • memory/4344-41-0x0000000140000000-0x00000001401FA000-memory.dmp

                                                Filesize

                                                2.0MB

                                              • memory/4344-40-0x0000000140000000-0x00000001401FA000-memory.dmp

                                                Filesize

                                                2.0MB

                                              • memory/4344-36-0x0000000140000000-0x00000001401FA000-memory.dmp

                                                Filesize

                                                2.0MB

                                              • memory/4344-1-0x0000000140000000-0x00000001401FA000-memory.dmp

                                                Filesize

                                                2.0MB

                                              • memory/4344-32-0x0000000140000000-0x00000001401FA000-memory.dmp

                                                Filesize

                                                2.0MB

                                              • memory/4344-29-0x0000000140000000-0x00000001401FA000-memory.dmp

                                                Filesize

                                                2.0MB

                                              • memory/4344-28-0x0000000140000000-0x00000001401FA000-memory.dmp

                                                Filesize

                                                2.0MB

                                              • memory/4344-0-0x0000000140000000-0x00000001401FA000-memory.dmp

                                                Filesize

                                                2.0MB

                                              • memory/4344-3-0x00000000C0120000-0x00000000C0121000-memory.dmp

                                                Filesize

                                                4KB

                                              • memory/4344-2-0x0000000140000000-0x00000001401FA000-memory.dmp

                                                Filesize

                                                2.0MB

                                              • memory/4344-5-0x0000000140000000-0x00000001401FA000-memory.dmp

                                                Filesize

                                                2.0MB

                                              • memory/4344-14-0x0000000140000000-0x00000001401FA000-memory.dmp

                                                Filesize

                                                2.0MB

                                              • memory/4344-15-0x0000000140000000-0x00000001401FA000-memory.dmp

                                                Filesize

                                                2.0MB

                                              • memory/4344-18-0x0000000140000000-0x00000001401FA000-memory.dmp

                                                Filesize

                                                2.0MB

                                              • memory/4344-19-0x0000000140000000-0x00000001401FA000-memory.dmp

                                                Filesize

                                                2.0MB

                                              • memory/4344-7-0x0000000140000000-0x00000001401FA000-memory.dmp

                                                Filesize

                                                2.0MB

                                              • memory/4344-13-0x0000000140000000-0x00000001401FA000-memory.dmp

                                                Filesize

                                                2.0MB

                                              • memory/4344-8-0x0000000140000000-0x00000001401FA000-memory.dmp

                                                Filesize

                                                2.0MB

                                              • memory/4344-11-0x0000000140000000-0x00000001401FA000-memory.dmp

                                                Filesize

                                                2.0MB

                                              • memory/4344-6-0x0000000140000000-0x00000001401FA000-memory.dmp

                                                Filesize

                                                2.0MB