Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    35s
  • max time network
    132s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    26/12/2024, 01:02

General

  • Target

    2024-12-26_53f9ebac4ea17afdf3753774a1427795_avoslocker_luca-stealer.exe

  • Size

    1.4MB

  • MD5

    53f9ebac4ea17afdf3753774a1427795

  • SHA1

    c83b5fe68db8b583569085304c274357e530bfb1

  • SHA256

    cc5533a5c8e6305e52431676f148f292fe276ed951d39ade86c143c9e47a9682

  • SHA512

    58af5d5d6a3e69d2a24701e579c48e75e24dcdc255427106cea8a01cc389f24228932be18d7b731e034f1c7563b4d721a8ff484686c293d04574ec2b7f4d59bd

  • SSDEEP

    24576:uTpE4t7hXTv1Rpgt1E7y2NfXG7E3VQ+gvLJegPeR1nMFAwic:ApdF1w+lBq4gPeRdMmvc

Malware Config

Signatures

  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

  • Socelars family
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Drops file in Program Files directory 10 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Kills process with taskkill 1 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 34 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-12-26_53f9ebac4ea17afdf3753774a1427795_avoslocker_luca-stealer.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-12-26_53f9ebac4ea17afdf3753774a1427795_avoslocker_luca-stealer.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2216
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c taskkill /f /im chrome.exe
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2564
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /f /im chrome.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2908
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      2⤵
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:1532
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef68a9758,0x7fef68a9768,0x7fef68a9778
        3⤵
          PID:2892
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1152 --field-trial-handle=1280,i,8682189308584768571,6146513914294697141,131072 /prefetch:2
          3⤵
            PID:2212
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1508 --field-trial-handle=1280,i,8682189308584768571,6146513914294697141,131072 /prefetch:8
            3⤵
              PID:1988
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1600 --field-trial-handle=1280,i,8682189308584768571,6146513914294697141,131072 /prefetch:8
              3⤵
                PID:2784
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2236 --field-trial-handle=1280,i,8682189308584768571,6146513914294697141,131072 /prefetch:1
                3⤵
                  PID:1044
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2260 --field-trial-handle=1280,i,8682189308584768571,6146513914294697141,131072 /prefetch:1
                  3⤵
                    PID:1292
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2572 --field-trial-handle=1280,i,8682189308584768571,6146513914294697141,131072 /prefetch:1
                    3⤵
                      PID:2320
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=3444 --field-trial-handle=1280,i,8682189308584768571,6146513914294697141,131072 /prefetch:2
                      3⤵
                        PID:2564
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=1352 --field-trial-handle=1280,i,8682189308584768571,6146513914294697141,131072 /prefetch:1
                        3⤵
                          PID:2932
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3868 --field-trial-handle=1280,i,8682189308584768571,6146513914294697141,131072 /prefetch:8
                          3⤵
                            PID:2896
                      • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                        1⤵
                          PID:936

                        Network

                        MITRE ATT&CK Enterprise v15

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Program Files\aieoplapobidheellikiicjfpamacpfd\background.html

                          Filesize

                          786B

                          MD5

                          9ffe618d587a0685d80e9f8bb7d89d39

                          SHA1

                          8e9cae42c911027aafae56f9b1a16eb8dd7a739c

                          SHA256

                          a1064146f622fe68b94cd65a0e8f273b583449fbacfd6fd75fec1eaaf2ec8d6e

                          SHA512

                          a4e1f53d1e3bf0ff6893f188a510c6b3da37b99b52ddd560d4c90226cb14de6c9e311ee0a93192b1a26db2d76382eb2350dc30ab9db7cbd9ca0a80a507ea1a12

                        • C:\Program Files\aieoplapobidheellikiicjfpamacpfd\icon.png

                          Filesize

                          6KB

                          MD5

                          c8d8c174df68910527edabe6b5278f06

                          SHA1

                          8ac53b3605fea693b59027b9b471202d150f266f

                          SHA256

                          9434dd7008059a60d6d5ced8c8a63ab5cae407e7152da98ca4dda408510f08f5

                          SHA512

                          d439e5124399d1901934319535b7156c0ca8d76b5aa4ddf1dd0b598d43582f6d23c16f96be74d3cd5fe764396da55ca51811d08695f356f12f7a8a71bcc7e45c

                        • C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\aes.js

                          Filesize

                          13KB

                          MD5

                          4ff108e4584780dce15d610c142c3e62

                          SHA1

                          77e4519962e2f6a9fc93342137dbb31c33b76b04

                          SHA256

                          fc7e184beeda61bf6427938a84560f52348976bb55e807b224eb53930e97ef6a

                          SHA512

                          d6eee0fc02205a3422c16ad120cad8d871563d8fcd4bde924654eac5a37026726328f9a47240cf89ed6c9e93ba5f89c833e84e65eee7db2b4d7d1b4240deaef2

                        • C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\background.js

                          Filesize

                          19KB

                          MD5

                          cea0d9ffdcd82386b6da794e0b78a379

                          SHA1

                          a37c5fa83420bac0bf9f31497049eacb9733a3a6

                          SHA256

                          4e5145c2d93d15ff1d0a2ee85d32974ead740eca713e60d47ef79e7fda7b4738

                          SHA512

                          8f0f5fbd81c8b325933108ed9418da8e9ac0bdf1a4f83952399a8b931330500d7b667d0b1a8560bc11a84a8f9be1ab88b46c7abd89e3a95491370c71ba5ee887

                        • C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\content.js

                          Filesize

                          3KB

                          MD5

                          368dbd669e86a3e5d6f38cf0025a31fd

                          SHA1

                          93c6f457d876646713913f3fa59f44a9a373ff03

                          SHA256

                          40d6653a91bd77ecbd6e59151febb0d8b157b66706aab53d4c281bb1f2fe0cd6

                          SHA512

                          24881d53e334510748f51ce814c6e41c4de2094fd3acc1f250f8a73e26c64d5a74430b6c891fc03b28fb7bddfcf8b540edcf86498d2bb597e70c2b80b172ee7e

                        • C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\jquery-3.3.1.min.js

                          Filesize

                          84KB

                          MD5

                          a09e13ee94d51c524b7e2a728c7d4039

                          SHA1

                          0dc32db4aa9c5f03f3b38c47d883dbd4fed13aae

                          SHA256

                          160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef

                          SHA512

                          f8da8f95b6ed33542a88af19028e18ae3d9ce25350a06bfc3fbf433ed2b38fefa5e639cddfdac703fc6caa7f3313d974b92a3168276b3a016ceb28f27db0714a

                        • C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\mode-ecb.js

                          Filesize

                          604B

                          MD5

                          23231681d1c6f85fa32e725d6d63b19b

                          SHA1

                          f69315530b49ac743b0e012652a3a5efaed94f17

                          SHA256

                          03164b1ac43853fecdbf988ce900016fb174cf65b03e41c0a9a7bf3a95e8c26a

                          SHA512

                          36860113871707a08401f29ab2828545932e57a4ae99e727d8ca2a9f85518d3db3a4e5e4d46ac2b6ba09494fa9727c033d77c36c4bdc376ae048541222724bc2

                        • C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\pad-nopadding.js

                          Filesize

                          268B

                          MD5

                          0f26002ee3b4b4440e5949a969ea7503

                          SHA1

                          31fc518828fe4894e8077ec5686dce7b1ed281d7

                          SHA256

                          282308ebc3702c44129438f8299839ca4d392a0a09fdf0737f08ef1e4aff937d

                          SHA512

                          4290a1aee5601fcbf1eb2beec9b4924c30cd218e94ae099b87ba72c9a4fa077e39d218fc723b8465d259028a6961cc07c0cd6896aa2f67e83f833ca023a80b11

                        • C:\Program Files\aieoplapobidheellikiicjfpamacpfd\manifest.json

                          Filesize

                          1KB

                          MD5

                          6da6b303170ccfdca9d9e75abbfb59f3

                          SHA1

                          1a8070080f50a303f73eba253ba49c1e6d400df6

                          SHA256

                          66f5620e3bfe4692b14f62baad60e3269327327565ff8b2438e98ce8ed021333

                          SHA512

                          872957b63e8a0d10791877e5d204022c08c8e8101807d7ebe6fd537d812ad09e14d8555ccf53dc00525a22c02773aa45b8fa643c05247fb0ce6012382855a89a

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

                          Filesize

                          1KB

                          MD5

                          55540a230bdab55187a841cfe1aa1545

                          SHA1

                          363e4734f757bdeb89868efe94907774a327695e

                          SHA256

                          d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

                          SHA512

                          c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_B5D3A17E5BEDD2EDA793611A0A74E1E8

                          Filesize

                          1KB

                          MD5

                          65b215422d82151bd2fb8002999ade27

                          SHA1

                          50716392ffbeb6034711a2361baa7aa7b45f20cd

                          SHA256

                          2346f9dcace5adbb9ceaa1877b3a8db00784ce97698abde089ec07050d3deaa1

                          SHA512

                          924975a36dc71b87017349dc3bbb3f4245d0d0ac048bcee0b0993956e5818608546d892e477bc911e1a7b6064ada233ce4926d0f3db82de6fadc0034650b6c46

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62

                          Filesize

                          2KB

                          MD5

                          b791015f89ae119b3ea0db11a4ad4b65

                          SHA1

                          98ecec2cf8cc522749cfe452c0767f734f595ff2

                          SHA256

                          fba83a7d4869cdefe0c35bd840794b8df843a4594d9b524a54978e4e44c49292

                          SHA512

                          1f370bc3f0ecfb8dd2a7c8e61c2d3dbdbb32736538793ce6d9731fb43347a6f95afe1c5355b0b6a943e8f784a63424b8322f27dc66dc28b7d7a04668f70bc9fc

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894

                          Filesize

                          1KB

                          MD5

                          6228ee7c5cf70a6adddfb3e8f43ce1b7

                          SHA1

                          8bbdab7d01ed00ba981aaa23f39d71a34f4074cf

                          SHA256

                          bc86e708fb708233888a4c168cb31074059eaa86fd437f111a09640cc296308e

                          SHA512

                          c815f3e525c6c3cc2cbfe92101b2b24c1c70e06ef0c1bd8db671f1359f977d61adbba091fe724aca31d8350fdc3cf588a177682231ef817c8097dd0fce3f30b0

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

                          Filesize

                          230B

                          MD5

                          6cf2b18ac55645ca13cefed83b6a1964

                          SHA1

                          8c6107738342b2a5fd1ca4dcd23870facfaa2d0e

                          SHA256

                          3bf321d93ce1d95c6dc61ebba140889db16c5c96f637beefd097d8f2e5457d75

                          SHA512

                          8840cb372765828fed93f437266a978655274fd8e194cd4fa2d0ebe1daa80312b510c8beb2effbc5046b17d258fa9e935e5f7ea14fc5e773b1492c4c5db2901d

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_B5D3A17E5BEDD2EDA793611A0A74E1E8

                          Filesize

                          438B

                          MD5

                          a29e5d3e371fc9942e4316742ea7275c

                          SHA1

                          24c42aea5959249bf50c3292bc8a372ea00a509b

                          SHA256

                          577577aae518a6f8e2991106778a59d593172422708cb1275b2ca920f8366266

                          SHA512

                          d83eea039083ef917013d3a1a58077d05c3dad966fd0784d306747e4401a4f45dba40b0a7b02ed4ce7c3c4eb82407ec8da38c50b60a80a304b138443d5afbe7f

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                          Filesize

                          342B

                          MD5

                          ba66cb3b5caca4596b3e5a0f856a3d52

                          SHA1

                          1638cd1a71484d1611bce1cd7686c339cd31f568

                          SHA256

                          797f67e0b1f148d3752ae4d4aebf8b20527de592bb106a52cef86f5470dfb8e7

                          SHA512

                          a589a4455ed1aad7d497e160241a35cdc36149f5483d1e0fe07d7e6411d07e5d75084fcdf10fca1adeaf331739cbe66515702f9645f062a5fb67f690b61be9d2

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                          Filesize

                          342B

                          MD5

                          bf576d5e2ad22d4fce71da0437fdb6a4

                          SHA1

                          85861f13bc62a0b491566913f1bf48a52de2f37a

                          SHA256

                          51a9d631f100eee6899a9791015ee322e73dc31ac63e02200c5cb94d7fb04c7d

                          SHA512

                          90c4b70886266b95624cd3554b8de99b8af3f8cacf3cb460ab876368d72d4589221167c842db5c195ff6d749e168c55ecdae8b8aef4f33f49ae7d9a333c36f02

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                          Filesize

                          342B

                          MD5

                          957a4fbd6d86960dda909e5f8b69d889

                          SHA1

                          9ce2fb8fda0d680ff5fd28c865d0a97905b0bb28

                          SHA256

                          d53fb5220599b7fbb96974c8e6df010aea43ea81bd4f19ec5842fe8c02dcaa3b

                          SHA512

                          b92aef5cdfe38efa9a51f07b8c7578127602fe824138e69aa2cae93373211ff7ac5130a9de9a8c511562a36c1dbe2bff1bf597dd66eada438176993ce98c366d

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                          Filesize

                          342B

                          MD5

                          615f14e1f4763f3e8eaf8ed2e54b746b

                          SHA1

                          3a69fc30cf9a82fcfc0bb4fa6d479392f055648d

                          SHA256

                          0c44fcb818872aeb62f597a04fcbae69868aaaf0a47160ee45c92aefa2f84215

                          SHA512

                          e38c6a566af5b77c3cfa47a388a61eea20086187f6ec0f76c631fc1cc3c3c3f8defbd7671e842d19faa7652e53297d500557ab8e92e1abb1f9a2184272b3e14b

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                          Filesize

                          342B

                          MD5

                          cc3220bbd819ab9a61fb683e7ebbef5f

                          SHA1

                          e3eaf58a3b0673ac2337c80c0e9b60ebc5493bc2

                          SHA256

                          089adab91f2848ba3d29ba78075c32c3d08d3fb37541579e3532e2061ab513b5

                          SHA512

                          78bc836784620b67fe1d3c978454f5acef178cf98a78d6141f9e833468f1e6026525978f45194f1201f2d97befe539b6c1c4393077340b84af48203c05531b58

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                          Filesize

                          342B

                          MD5

                          608162d9272bdf274c596c440e4a6c47

                          SHA1

                          e4ebc1e477c551d5bb8d082fe22f7c4b7716b0a1

                          SHA256

                          751f83df022cc53ae2e6d02676e4cc29ed82211badd1d7f41fd7eb2954a26c8e

                          SHA512

                          49d7a999b2c4f90b22c0e7bf7f7e5914902d54eed96a544dac7ee69d8ad584868e58814f212d2e4b21747a577275c7614cbe74324826436cc9e30df169f0b78f

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                          Filesize

                          342B

                          MD5

                          62a2c8ed5d616d7ee8bb989ba6e5ce71

                          SHA1

                          2ca224eebe2925c31f99456d49bf6e0c0859b96b

                          SHA256

                          6ea0495bd4752ad739dc85df3aa6233990d3fce6a8dc56107523ca2ec0c9c94f

                          SHA512

                          3b15cd42dacde5effbf12693409fd5c3b2716da7c0658f0a4ec9d0128b2db56e069bc469e30d724a5f63f4bb5b94054bc9eae98db9f645c8ede63ed577bf6cbb

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62

                          Filesize

                          458B

                          MD5

                          8655dba77096ce12a74b917d4f449546

                          SHA1

                          36f5c623e3c635e8b74aa4f092d1c72634faa2cb

                          SHA256

                          67fd007084f1284804c279e6907fc2df4386662a33c81e1c2b862262ac9fb08e

                          SHA512

                          37b2c9ef41bdf09dd54fe048dd2e4069b88632c4957ec9d37b987abc3d2e95b7e4d474c65a8b3b3cbde9e9e5c304494a1a8459e2e813ab7f829087a931add098

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894

                          Filesize

                          432B

                          MD5

                          3d3274485887033b6f5ba3d74f8511d1

                          SHA1

                          6ae223c9e387eb7233c2911bc52a2c0983e222f2

                          SHA256

                          a07e7a0f10e4cce5d48c5c8b7f1d56cb810feb2c20f41f58b291878fb2c41f65

                          SHA512

                          9a73508e9dc8afb4e1152f54282e472ab56179ea6ecd6fd2eaed158420c59bad4318d7f79a94a90218ab583c5d4b0981236eb17d69532fa9bcddcdc1ce1d9823

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp

                          Filesize

                          16B

                          MD5

                          aefd77f47fb84fae5ea194496b44c67a

                          SHA1

                          dcfbb6a5b8d05662c4858664f81693bb7f803b82

                          SHA256

                          4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

                          SHA512

                          b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

                          Filesize

                          264KB

                          MD5

                          f50f89a0a91564d0b8a211f8921aa7de

                          SHA1

                          112403a17dd69d5b9018b8cede023cb3b54eab7d

                          SHA256

                          b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                          SHA512

                          bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                          Filesize

                          1KB

                          MD5

                          b42b17ad6d97b528d82a52ea2e52819a

                          SHA1

                          dd1f98fcd72357a0afee1db61a847284df1e6c89

                          SHA256

                          3925d79ce1920a419b09cf8fdb33d98e577f131c106ceae4b62166d23844d380

                          SHA512

                          4eb1a0d87d9b97f72e89b9585666505fd50bb88ead59a7bc28464f69801fcea46ef611253714205cf692b2b77a644d1ef900fc713c56ee07a3b98ae8da668683

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                          Filesize

                          854B

                          MD5

                          bbce2653ec82f9f7fe530e3f9d9dc094

                          SHA1

                          62630cd55c403cf17418b170fc8252ff8e87bebe

                          SHA256

                          3a14af02f185c3549d223745a89050ccc2a2b16401ee18de32956426b23397de

                          SHA512

                          aa397917878ca24ada114b2c9d8958ec98f205417ba5cadac7881d895d059e3e394d7a4895742fe6fcf43c288c2b3d45b16a10eea429c192ca7a7cd1e72c967c

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                          Filesize

                          854B

                          MD5

                          4454c4022292f9b54efcf63e08c93624

                          SHA1

                          e771f5bd7181625f7ea231d3e339612d5492aa55

                          SHA256

                          8481a917b62aca71e76a25398745230a072aa94d5c41f9ab6979d570e18b5281

                          SHA512

                          f92a53a457f048aaa42eb169d95f4ef76ca899dc3ec19e762151291c3a63ed33686f10d3c1bb8952c4d93770a4083e5c4ee032200c7141d00d043b4eb264de14

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                          Filesize

                          854B

                          MD5

                          2006fa5db3c3d7d58e9ebb3ae6825ca9

                          SHA1

                          c97720c0562215939d8abcb9a8ac1223462a5f66

                          SHA256

                          d6184c33141a12a1bd330092fee01cb6fe8a3b5c993eed128474db5798028aed

                          SHA512

                          d67c5b4512e3c6de788a136b1e1624855aa6672f69c163e61c7887de3b6dff0b47bddf196c220e193618bc8a1400d334da03d6ce58c5a0f301d5e72f0507347d

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          5KB

                          MD5

                          76381e25ba122224f9bacecd3a9bccc1

                          SHA1

                          2c1344fb82eeb03f962e24d886ec132547c4e7ad

                          SHA256

                          b1edbc2bc08cc24ed7cf791b449bbb7d38bfebc602e52714a9a461c6be7fa197

                          SHA512

                          cedf8f615f03f6a7ff15183c3f0eefb37161621bb095f93355c6e0329cdbb3e8cc27dad0afc545fa7889d471d29f97b24eeeddf99132dc7b4608739c7c2bf36c

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          5KB

                          MD5

                          5e65c4b2e71051855f9ce8180435a65a

                          SHA1

                          57aa4163a01a619699be3e9d58c6b0bdb57803c1

                          SHA256

                          d4f5a601bc6214b28eb1613fc63d2544bf946048936ecec3b6457529b8cf24ab

                          SHA512

                          d87c1ddda0afdefbf593f7ced90ded789c695a732016a15448fed2f0f6e3153322480c3b92709852344fdd7b9a1dae1848cea39de7abb69e496444192fa00f3c

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                          Filesize

                          11KB

                          MD5

                          1e38f2c53f919616abcfc7642c5e6768

                          SHA1

                          042fb99a83c5dc4a053fc8cdfa91a5a6540d92a3

                          SHA256

                          62e091d82f56723d80054f3b9ba49f9556ed2327f4b63da37bdacafa9179ef3d

                          SHA512

                          829f6bd78ac65ec6d15b752f55ccff39116bcb63e0a493ab30ea565ec58b22af97ed113609ca7953d8776b32c20855c6e5eea3b188fb76d3f1e97598cc80f823

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

                          Filesize

                          16B

                          MD5

                          18e723571b00fb1694a3bad6c78e4054

                          SHA1

                          afcc0ef32d46fe59e0483f9a3c891d3034d12f32

                          SHA256

                          8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

                          SHA512

                          43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\aieoplapobidheellikiicjfpamacpfd\CURRENT~RFf77712a.TMP

                          Filesize

                          16B

                          MD5

                          46295cac801e5d4857d09837238a6394

                          SHA1

                          44e0fa1b517dbf802b18faf0785eeea6ac51594b

                          SHA256

                          0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                          SHA512

                          8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                        • C:\Users\Admin\AppData\Local\Temp\Cab71D6.tmp

                          Filesize

                          70KB

                          MD5

                          49aebf8cbd62d92ac215b2923fb1b9f5

                          SHA1

                          1723be06719828dda65ad804298d0431f6aff976

                          SHA256

                          b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

                          SHA512

                          bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

                        • C:\Users\Admin\AppData\Local\Temp\Tar7256.tmp

                          Filesize

                          181KB

                          MD5

                          4ea6026cf93ec6338144661bf1202cd1

                          SHA1

                          a1dec9044f750ad887935a01430bf49322fbdcb7

                          SHA256

                          8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

                          SHA512

                          6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b