Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

11/12/2024, 00:18

241211-alx6gswnbx 10

11/12/2024, 00:16

241211-akl2ts1ldr 3

11/12/2024, 00:14

241211-ajr7fswmd1 3

11/12/2024, 00:12

241211-ag75wswlhz 10

04/09/2024, 14:53

240904-r9kzhasdqr 10

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/12/2024, 00:18

General

  • Target

    39b52356da1f35c5bad343eea8880f4d8bdd6c0228a7a9b85e5f0117c6296287.exe

  • Size

    496KB

  • MD5

    6285ae9a1953232716b7817c6bce1ba6

  • SHA1

    8ea818cd4c61b6c53a5eea7f5ff19cdd9e60a8fb

  • SHA256

    39b52356da1f35c5bad343eea8880f4d8bdd6c0228a7a9b85e5f0117c6296287

  • SHA512

    2dbdebc96f92dfda7a146f3ade91af8b4ac66ab9dd9d51b5efb72a0b5cd789086b49cdb435e837a013d7a29e9a4a9c148ad5ece84e2129fad84c5944b9485581

  • SSDEEP

    12288:fPVEdXo7/apwbQB6R751Hlie+XhTalWP6lTcNeH1ug2nMnMqDXWxbnN:3VKu/jbp3lihmUiKwHs

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot1944842353:AAF4AUZAlM1Eseaom3hr9cg9ol6hzIat_qw/sendDocument

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Agenttesla family
  • AgentTesla payload 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\39b52356da1f35c5bad343eea8880f4d8bdd6c0228a7a9b85e5f0117c6296287.exe
    "C:\Users\Admin\AppData\Local\Temp\39b52356da1f35c5bad343eea8880f4d8bdd6c0228a7a9b85e5f0117c6296287.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:3996
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\aIsPxrpSE" /XML "C:\Users\Admin\AppData\Local\Temp\tmp949A.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:6048
    • C:\Users\Admin\AppData\Local\Temp\39b52356da1f35c5bad343eea8880f4d8bdd6c0228a7a9b85e5f0117c6296287.exe
      "C:\Users\Admin\AppData\Local\Temp\39b52356da1f35c5bad343eea8880f4d8bdd6c0228a7a9b85e5f0117c6296287.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:6068
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Checks SCSI registry key(s)
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:804
  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:388
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffd98bccc40,0x7ffd98bccc4c,0x7ffd98bccc58
      2⤵
        PID:2980
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1928,i,12558617149280910358,3557635068060775721,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1912 /prefetch:2
        2⤵
          PID:4256
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2072,i,12558617149280910358,3557635068060775721,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2172 /prefetch:3
          2⤵
            PID:1828
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2268,i,12558617149280910358,3557635068060775721,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2460 /prefetch:8
            2⤵
              PID:4348
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3184,i,12558617149280910358,3557635068060775721,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3192 /prefetch:1
              2⤵
                PID:1068
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3432,i,12558617149280910358,3557635068060775721,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3440 /prefetch:1
                2⤵
                  PID:2076
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3700,i,12558617149280910358,3557635068060775721,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4536 /prefetch:1
                  2⤵
                    PID:2856
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4760,i,12558617149280910358,3557635068060775721,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4772 /prefetch:1
                    2⤵
                      PID:4772
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3516,i,12558617149280910358,3557635068060775721,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5060 /prefetch:8
                      2⤵
                        PID:3180
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4708,i,12558617149280910358,3557635068060775721,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3484 /prefetch:8
                        2⤵
                          PID:3760
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5096,i,12558617149280910358,3557635068060775721,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4576 /prefetch:8
                          2⤵
                            PID:5076
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3408,i,12558617149280910358,3557635068060775721,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3484 /prefetch:8
                            2⤵
                              PID:3924
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5060,i,12558617149280910358,3557635068060775721,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5084 /prefetch:8
                              2⤵
                                PID:3848
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4920,i,12558617149280910358,3557635068060775721,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4896 /prefetch:8
                                2⤵
                                  PID:1480
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=3192,i,12558617149280910358,3557635068060775721,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4512 /prefetch:2
                                  2⤵
                                    PID:5408
                                • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                  "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                  1⤵
                                    PID:4144
                                  • C:\Windows\system32\svchost.exe
                                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                    1⤵
                                      PID:2240

                                    Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                                      Filesize

                                      649B

                                      MD5

                                      2a6c140aeb3d8d8ec547ca903f10d8b9

                                      SHA1

                                      07151e6c47ca4318971f4a981296cb114c405834

                                      SHA256

                                      45fddd958ddce8870d3fe26791ff99a2521dbb081d7e3e7919f8222d32f6a926

                                      SHA512

                                      8e8a25ad4a38fe075fe0816e333bc75095ea9e687212bc61bb103a2fe3c0ee66dd9f7c366a4f2b73be66224035a553f3b8b03b0ac942fba3d7128ee04a9ff8f3

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005

                                      Filesize

                                      215KB

                                      MD5

                                      2be38925751dc3580e84c3af3a87f98d

                                      SHA1

                                      8a390d24e6588bef5da1d3db713784c11ca58921

                                      SHA256

                                      1412046f2516b688d644ff26b6c7ef2275b6c8f132eb809bd32e118208a4ec1b

                                      SHA512

                                      1341ffc84f16c1247eb0e9baacd26a70c6b9ee904bc2861e55b092263613c0f09072efd174b3e649a347ef3192ae92d7807cc4f5782f8fd07389703d75c4c4e2

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                      Filesize

                                      216B

                                      MD5

                                      0526e22284272403ae6bd724db923c4a

                                      SHA1

                                      6fa9ca2947e7e78e88187d2171fa466152f316b4

                                      SHA256

                                      ea05f0f02d0871e45839a909eee660cec4f2220a3f647f38fcd49a82d5890ee5

                                      SHA512

                                      631031057dc5a78308ca5a26b59a2576b36f922fccd52377cc9eadd787c22ea3276a2a24f4e58a5c03a49cd2d3b4f915c574769d21e5be53427020345ef1992f

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                      Filesize

                                      216B

                                      MD5

                                      9898e1aac7830d68fb237c1714590bc9

                                      SHA1

                                      b128de966170a7da354c0f73a166844497d40e30

                                      SHA256

                                      7ea8c6e556cb9e3213b2ec55b171ca7088dd4122efddc39df24ca60fb9fcdda2

                                      SHA512

                                      14aa6d935a6d04d105111029e4775938adff03b1fb9ce608534016914a21a624b4c7a54e8fe591492efe9996686bcabda6e8b596e25a27ab28916329c44d1e1c

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.84.1_0\_locales\en_CA\messages.json

                                      Filesize

                                      851B

                                      MD5

                                      07ffbe5f24ca348723ff8c6c488abfb8

                                      SHA1

                                      6dc2851e39b2ee38f88cf5c35a90171dbea5b690

                                      SHA256

                                      6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c

                                      SHA512

                                      7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.84.1_0\dasherSettingSchema.json

                                      Filesize

                                      854B

                                      MD5

                                      4ec1df2da46182103d2ffc3b92d20ca5

                                      SHA1

                                      fb9d1ba3710cf31a87165317c6edc110e98994ce

                                      SHA256

                                      6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

                                      SHA512

                                      939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                      Filesize

                                      2KB

                                      MD5

                                      c6da6297e6200bfcd56d077c46e62746

                                      SHA1

                                      3ed4339a97b2c19bf67749813e17db3d34bb332f

                                      SHA256

                                      61a8a0fd54bf30f40d4bd40ffa1b1a9e7c43822c2e220b6db907fb73cac069f1

                                      SHA512

                                      76815dc7399ba9dc34f6e1137b8921aedfa8a9114259768234ae78c7543fd31e14ef96325fc7a2c43a15baffa364e6eeef3ac64a741c6b492fd89397b8192b8e

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                      Filesize

                                      2B

                                      MD5

                                      d751713988987e9331980363e24189ce

                                      SHA1

                                      97d170e1550eee4afc0af065b78cda302a97674c

                                      SHA256

                                      4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                      SHA512

                                      b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                      Filesize

                                      356B

                                      MD5

                                      05476f34616f94e6fd6d26bac4ecb5ea

                                      SHA1

                                      110ed01e884668cfb2f017827930c3ad2daaa3d1

                                      SHA256

                                      37229b19b65fada28095052368a386edb39467769b0679cfcec5e58fce65bc7c

                                      SHA512

                                      5b1241f58bb28cdbee3ee05e54a60c7875b3abdfabb8c71f8a288ac69513b471315a6d30e74feae970a510cf76c0754fd568bd182b6d1f8e88264f8633331430

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                      Filesize

                                      9KB

                                      MD5

                                      fe3f5b278bbcca078ed84c863c5f9a1e

                                      SHA1

                                      0b7921506fa0d8b85046d13461ec498c88072d50

                                      SHA256

                                      1d41647ec62b50a9827b37b38e22df061873a8ba782ab43ac1578c8bf3a0b57a

                                      SHA512

                                      5336ac78cf2905f01a1ae22c7ee67557ee4b75ef0874c514bd49fa6159b2f5b3e4e07a51e23b6653a8a8d1eda6c8989ee3308d7738670d008a04fa1a21d08679

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                      Filesize

                                      9KB

                                      MD5

                                      a93570f79351cdf4be7660c11845ac17

                                      SHA1

                                      7a9f08311877d8e6e0a16e0a5920bf2848a9cce6

                                      SHA256

                                      7a236c1d1d7d65318518a54330634f8816c6161ca0d1796fe9442703c6bf05c2

                                      SHA512

                                      fed59844d37ff5815861247e603af08f1a66ba4645963d992fa1ce60c41b7e57ffd96b20eaee69a6dce15a8efc5ec3d56c9db83f6b8f2aa13d979cff5971209a

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                      Filesize

                                      9KB

                                      MD5

                                      5aed343aed400c415a5e1808e0f69ae1

                                      SHA1

                                      4d6fbdbbc5151be3bb71e7b8b6f7fc1b6a716e49

                                      SHA256

                                      a814413e10305f83552ccabd3e86e4eb5c0c340b3c9a626cc82a3a1f4e0b2f5d

                                      SHA512

                                      2a3b23d8e0fc4fb48f3c04600d60a526393c1d174512700ee830551ba1ed474e6ac316d6db0f31abc546f822c73fcbd0a185d8853cc9482fb9a8dbbd40ff0056

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                      Filesize

                                      9KB

                                      MD5

                                      965ef1abdae9ebefc376945c12045f51

                                      SHA1

                                      c07120fa5c074ba950f2eb63fccab8a4c90185b5

                                      SHA256

                                      aa66520a5cfb1976f3f462fbcc5ced848bcc03c7e6e36b4c6cd45f75706036e3

                                      SHA512

                                      f5a89cc208053a2ddd8cf3de0f7aa0c6ed78389bcae5203540789add7434b3e159dab2a25f3a3bf16b57389aef1fab50825a7da073131b0a62307abca5bbc2fd

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                      Filesize

                                      9KB

                                      MD5

                                      5e36fda9f384ca45365913941bedd426

                                      SHA1

                                      999331a4883a3806e9543124a199af405a627bc3

                                      SHA256

                                      45b3242a096a047ba86d95298b23198b7a4199c31c649323068f28613b52a478

                                      SHA512

                                      481beca2acb87cc4226f68ed961cfe407042a24359ca50267d11dff3ac6db0259aa057ead3f5765e3c6ba91f574b5667f01fb8658e0775ff091538d2ed943cf1

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                      Filesize

                                      9KB

                                      MD5

                                      4f72b80df3d3f5c2fb3411feddcc6ab0

                                      SHA1

                                      ff48a370714db3ef352629c943ecbc50262a1e22

                                      SHA256

                                      7cf92cc48aced0981f4789f3acd0a92302173f9af54a848f76c5da95973e3725

                                      SHA512

                                      ef76f4930aafd227616b48edbf8612702ca1733324b89125b26ed1f99c814d2983266264797965b9032d7934cbfa6f495a0d47f95eabe18f1046b0fa0d326515

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                      Filesize

                                      9KB

                                      MD5

                                      de7a781c1ca9f1299293c26c0d2def55

                                      SHA1

                                      b5f4a5afed6a879550d2fe72a4a7d0c74881c2f3

                                      SHA256

                                      28e52b4159ce65ef0ec809b76ec0fce0526aae2d081f80822b4015d3e854dafc

                                      SHA512

                                      53fb2f08e02bfbf2cc5cade10771b832a586d16fd1788fd2b4136b56e893d1aac33b4f75f6021183417ef078ab9eb9f032e47a508f4f996dd17d7c3bfd2d459e

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                      Filesize

                                      15KB

                                      MD5

                                      7b5a1b70b01321eeeee3930dee88182b

                                      SHA1

                                      21302841a5f3be29674dbd6940dfb85cf8869daa

                                      SHA256

                                      54505559b05e1d3184197de2018aea699bc55b19f1527dc5db977edae849a16b

                                      SHA512

                                      bb785742afd063a33c8b08934ee9603704e7270ab980a11cf1b39445c3ebc117b5d0c1162405f5cf7569ad14dc469ce092ecbed09602fb94319adce0757895c2

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

                                      Filesize

                                      72B

                                      MD5

                                      5db266fb97ce7b0680192b933c2282fa

                                      SHA1

                                      c0ea9f504faf4c452ed640961c30bd84cfdcc0bd

                                      SHA256

                                      c469f9e8ac60b55a5fec376856945c2366b147119ca8d29faeb20e6e0b142cf9

                                      SHA512

                                      b5f9904901055e2062b5360ff5cdffb1f99bffa5fe7c590707edc4bad9570a2c19622c593952d13110e46083bbc9ebe5cafa2eae7f2b95d1afd8f1027cfe5c9f

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                      Filesize

                                      230KB

                                      MD5

                                      43b904e5469293cd567a38854604f504

                                      SHA1

                                      a09de921c0723e61e8cd05816e9fdfb2a9479885

                                      SHA256

                                      de7a38934c9e619618c0936b3e8c5abe01d6cd58ea7cc68cf7b9fcc922aca509

                                      SHA512

                                      ada0aaaae9359853755f2fc3ad0b3feab637968e32c5320bb186cc34f15ed2e04d97084e8e4dbbdf820f488e160874e6264d2aa1b3253ba1bce7efc9285da78f

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                      Filesize

                                      230KB

                                      MD5

                                      8a9646c9043251c089b2c568a7d21b7c

                                      SHA1

                                      06e11264d84b8356fb3dbad73e43e5faac352db6

                                      SHA256

                                      51979960c7d613fb2b2241948cc5126cb7ed914b51d6e8145f4481d8229a8475

                                      SHA512

                                      1aad4a8f9cd3ca929c289ecc93100c7350b167ec0cac0ec5f321b0b3b391bfae02485bb87d27e756360e0db8c126664742fb9cc2ba16f2a564abbf0529463977

                                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\39b52356da1f35c5bad343eea8880f4d8bdd6c0228a7a9b85e5f0117c6296287.exe.log

                                      Filesize

                                      1KB

                                      MD5

                                      8ec831f3e3a3f77e4a7b9cd32b48384c

                                      SHA1

                                      d83f09fd87c5bd86e045873c231c14836e76a05c

                                      SHA256

                                      7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982

                                      SHA512

                                      26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3

                                    • C:\Users\Admin\AppData\Local\Temp\f7608a33-74a1-4a8a-a511-3bc02365d53c.tmp

                                      Filesize

                                      135KB

                                      MD5

                                      3f6f93c3dccd4a91c4eb25c7f6feb1c1

                                      SHA1

                                      9b73f46adfa1f4464929b408407e73d4535c6827

                                      SHA256

                                      19f05352cb4c6e231c1c000b6c8b7e9edcc1e8082caf46fff16b239d32aa7c9e

                                      SHA512

                                      d488fa67e3a29d0147e9eaf2eabc74d9a255f8470cf79a4aea60e3b3b5e48a3fcbc4fc3e9ce58dff8d7d0caa8ae749295f221e1fe1ba5d20deb2d97544a12ba4

                                    • C:\Users\Admin\AppData\Local\Temp\scoped_dir388_1181621770\CRX_INSTALL\_locales\en_CA\messages.json

                                      Filesize

                                      711B

                                      MD5

                                      558659936250e03cc14b60ebf648aa09

                                      SHA1

                                      32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825

                                      SHA256

                                      2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b

                                      SHA512

                                      1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

                                    • memory/804-19-0x000001F0EAE10000-0x000001F0EAE11000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/804-20-0x000001F0EAE10000-0x000001F0EAE11000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/804-18-0x000001F0EAE10000-0x000001F0EAE11000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/804-17-0x000001F0EAE10000-0x000001F0EAE11000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/804-21-0x000001F0EAE10000-0x000001F0EAE11000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/804-22-0x000001F0EAE10000-0x000001F0EAE11000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/804-23-0x000001F0EAE10000-0x000001F0EAE11000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/804-12-0x000001F0EAE10000-0x000001F0EAE11000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/804-13-0x000001F0EAE10000-0x000001F0EAE11000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/804-11-0x000001F0EAE10000-0x000001F0EAE11000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/3996-48-0x0000000005890000-0x000000000592C000-memory.dmp

                                      Filesize

                                      624KB

                                    • memory/3996-8-0x000000000B310000-0x000000000B31E000-memory.dmp

                                      Filesize

                                      56KB

                                    • memory/3996-49-0x00000000090D0000-0x0000000009130000-memory.dmp

                                      Filesize

                                      384KB

                                    • memory/3996-508-0x00000000749F0000-0x00000000751A0000-memory.dmp

                                      Filesize

                                      7.7MB

                                    • memory/3996-0-0x00000000749FE000-0x00000000749FF000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/3996-10-0x00000000749F0000-0x00000000751A0000-memory.dmp

                                      Filesize

                                      7.7MB

                                    • memory/3996-9-0x00000000749FE000-0x00000000749FF000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/3996-1-0x0000000000E70000-0x0000000000EF2000-memory.dmp

                                      Filesize

                                      520KB

                                    • memory/3996-2-0x0000000008270000-0x0000000008814000-memory.dmp

                                      Filesize

                                      5.6MB

                                    • memory/3996-3-0x0000000007DA0000-0x0000000007E32000-memory.dmp

                                      Filesize

                                      584KB

                                    • memory/3996-7-0x00000000749F0000-0x00000000751A0000-memory.dmp

                                      Filesize

                                      7.7MB

                                    • memory/3996-6-0x00000000749F0000-0x00000000751A0000-memory.dmp

                                      Filesize

                                      7.7MB

                                    • memory/3996-5-0x0000000005370000-0x000000000537A000-memory.dmp

                                      Filesize

                                      40KB

                                    • memory/3996-4-0x00000000749F0000-0x00000000751A0000-memory.dmp

                                      Filesize

                                      7.7MB

                                    • memory/6068-505-0x0000000000400000-0x000000000043C000-memory.dmp

                                      Filesize

                                      240KB

                                    • memory/6068-535-0x0000000005D50000-0x0000000005DB6000-memory.dmp

                                      Filesize

                                      408KB

                                    • memory/6068-534-0x0000000005100000-0x0000000005118000-memory.dmp

                                      Filesize

                                      96KB