Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/12/2024, 20:35

General

  • Target

    JaffaCakes118_35766b49005d9d0de409bdcf237f3ba5.exe

  • Size

    1.4MB

  • MD5

    35766b49005d9d0de409bdcf237f3ba5

  • SHA1

    0a20107a5512f7d6625db2794b2db0b504a281a0

  • SHA256

    4bc4dff91705c7d4494daf2cade0d36f6242bcef6764d8487192fec9469b5299

  • SHA512

    cafebb21d033c5001aae24c7ffc921039692e3ba538c3efce101e51a9a3c3c940f86c97f40e99b8e6979f439c418160cf4889a6551a2fb80439b4818e5be014c

  • SSDEEP

    24576:ZxpXPaR2J33o3S7P5zuHHOF2ahfehMHsGKzOYf8EEvX3jZ10m:jpy+VDa8rtPvX3jZym

Malware Config

Signatures

  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

  • Socelars family
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops Chrome extension 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Kills process with taskkill 1 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_35766b49005d9d0de409bdcf237f3ba5.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_35766b49005d9d0de409bdcf237f3ba5.exe"
    1⤵
    • Drops Chrome extension
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1140
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c taskkill /f /im chrome.exe
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2184
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /f /im chrome.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3752
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      2⤵
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:4080
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffaa685cc40,0x7ffaa685cc4c,0x7ffaa685cc58
        3⤵
          PID:5016
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2052,i,8246350171580110194,13842685100993873042,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1900 /prefetch:2
          3⤵
            PID:2536
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1880,i,8246350171580110194,13842685100993873042,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2124 /prefetch:3
            3⤵
              PID:4184
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=1948,i,8246350171580110194,13842685100993873042,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2480 /prefetch:8
              3⤵
                PID:2632
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3132,i,8246350171580110194,13842685100993873042,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3140 /prefetch:1
                3⤵
                  PID:4936
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3372,i,8246350171580110194,13842685100993873042,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3392 /prefetch:1
                  3⤵
                    PID:4808
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4520,i,8246350171580110194,13842685100993873042,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4508 /prefetch:1
                    3⤵
                      PID:4020
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4752,i,8246350171580110194,13842685100993873042,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4784 /prefetch:8
                      3⤵
                        PID:3716
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4776,i,8246350171580110194,13842685100993873042,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4808 /prefetch:8
                        3⤵
                          PID:4728
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5024,i,8246350171580110194,13842685100993873042,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4800 /prefetch:8
                          3⤵
                            PID:3096
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4868,i,8246350171580110194,13842685100993873042,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4836 /prefetch:8
                            3⤵
                              PID:4460
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4748,i,8246350171580110194,13842685100993873042,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5108 /prefetch:8
                              3⤵
                                PID:1748
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4816,i,8246350171580110194,13842685100993873042,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5252 /prefetch:8
                                3⤵
                                  PID:4232
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5052,i,8246350171580110194,13842685100993873042,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5108 /prefetch:2
                                  3⤵
                                    PID:4800
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5356,i,8246350171580110194,13842685100993873042,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5104 /prefetch:8
                                    3⤵
                                    • Modifies registry class
                                    PID:3632
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5444,i,8246350171580110194,13842685100993873042,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4944 /prefetch:8
                                    3⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:5084
                              • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                1⤵
                                  PID:3896
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                  1⤵
                                    PID:4640

                                  Network

                                  MITRE ATT&CK Enterprise v15

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                                    Filesize

                                    649B

                                    MD5

                                    78ac6c16f79926572af620d413dba36a

                                    SHA1

                                    8a7848948c69d74544c9cd05cff3e62b9eaed50e

                                    SHA256

                                    ad6c9e379b917343ee9ad9aca42a69a7f14a8ba5bf72c735c5dba88520c93324

                                    SHA512

                                    ca3c559db0b614b4505f31ef7076bb45251b4a22773454eb3e12ddf644f82ac7bf85d4e9825e8b103bbb9cb9ca249205bda22f1bbd7e57c08cc8a01e4b2384dc

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.85.1_0\_locales\en\messages.json

                                    Filesize

                                    851B

                                    MD5

                                    07ffbe5f24ca348723ff8c6c488abfb8

                                    SHA1

                                    6dc2851e39b2ee38f88cf5c35a90171dbea5b690

                                    SHA256

                                    6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c

                                    SHA512

                                    7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.85.1_0\dasherSettingSchema.json

                                    Filesize

                                    854B

                                    MD5

                                    4ec1df2da46182103d2ffc3b92d20ca5

                                    SHA1

                                    fb9d1ba3710cf31a87165317c6edc110e98994ce

                                    SHA256

                                    6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

                                    SHA512

                                    939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                    Filesize

                                    1KB

                                    MD5

                                    57b4217d48e4f27e070a134b70c01e9e

                                    SHA1

                                    abe4cb642dcf1cf84d8b7401f9dfb235d2268b5c

                                    SHA256

                                    a773ce14998684646253855b8d2549bd5da62611aa26e1248560e085cadf1ed2

                                    SHA512

                                    e98c6001eab925c55065c0afac16c7e0838c527788c80f8c98e5451406573c86fb277f5004f89ae8c0ad481fcff6405b3bf059858eb7a3e8a30dcf16f51f0236

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                    Filesize

                                    2B

                                    MD5

                                    d751713988987e9331980363e24189ce

                                    SHA1

                                    97d170e1550eee4afc0af065b78cda302a97674c

                                    SHA256

                                    4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                    SHA512

                                    b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                    Filesize

                                    356B

                                    MD5

                                    4fa7863ee41c81279b0ebe9194dffca0

                                    SHA1

                                    bcebd7a9918ab14d596192baae2e29c32b19583b

                                    SHA256

                                    f533ff2ea0f4686fb308518cdaa01135a6cdce7149e098b2fceb7244260667dc

                                    SHA512

                                    b076ec2d845a05ea01d0161ef0acacac1bc330c0edf94cbb4d9664f5ca10d6014f0184e3012ed8ad0b34ba47dba0b17dc569a531f1db2703df0da94753f7b7e3

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                    Filesize

                                    9KB

                                    MD5

                                    64004b7b8ccbb83899700b7634359ab5

                                    SHA1

                                    a207e0f12f389aed1d361855effed647c2130fab

                                    SHA256

                                    bad91bbb7a68a42c2d5bef1da34b083914972a13d5fe9feb45132a03af6cc85e

                                    SHA512

                                    03323d2690aff1a701dc5e08e1c2cdf1d35425dc74ecbad7ce576492e11720faab35eb006ce4d81a98a9f1d2ea7edcf9a45d2ec9a3b2985e0b2c10540849e8da

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                    Filesize

                                    9KB

                                    MD5

                                    919b8b4c1a97b4360cb69105ed123261

                                    SHA1

                                    b98f1fce37c8887ad67575c7b7ed7f3cea878e73

                                    SHA256

                                    38e4c5379645ca3e3e2725e163c5713fd7367e86f548577e48de811113ffd6b7

                                    SHA512

                                    471a6575c4cde1259f8d2ec0256dc4d2d0686243e4377056d308f18b2deaf96d4af63a0837b1739e6c4098e39f657e16fe15ddd8f34c42af2f4bf887e8d7efcd

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                    Filesize

                                    9KB

                                    MD5

                                    2e3bf80df368f4d38334fecc8eb7bbc4

                                    SHA1

                                    c2c85b36b95fc1f616298e7c8effc606de73c69a

                                    SHA256

                                    20f406bce268085514df938514e1d0fa722f1767ee4894f0fe66fd439beaa979

                                    SHA512

                                    de09ce546a3e37168e7912110a1f87ed1f49f709de0aab1c82f3771d843e91d1478b13adb3c48d482b329cc1cf38964760bf00b640be95b231d76306012f120a

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                    Filesize

                                    9KB

                                    MD5

                                    1b5d37969f3c9f76870b72e7d12e3230

                                    SHA1

                                    f255d9d121d9421b607443fcc76353376357087b

                                    SHA256

                                    e4eda0192e8fbd2f15969e2088c99decfbe9dfbd6dc27881bc588a095b5e0f99

                                    SHA512

                                    81583aa848b4c0366a6cb74c1e269b400c0b3022f3ddbbf67ca024ead1d5fb10eba64f74063995772262b34542fcab287d33ca7533829973f0012abf9cb13bda

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                    Filesize

                                    9KB

                                    MD5

                                    4a954220c9f3bb5613da63c01d307125

                                    SHA1

                                    3c9f5d2d6d635689f9a4637ac05318f4d4690c2d

                                    SHA256

                                    bd862f8ed883c95d358dc2a28c0cb32e4a5dd945ae500ce4bbc7b80536cbfb36

                                    SHA512

                                    a993e2b23dd047651b67ef002c5764e4a1be8044d8b9544a8022499d0b459e0a254a8dd737c30093b912773e99a0dc81559c729c255f68b6b06ceda05290382b

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                    Filesize

                                    9KB

                                    MD5

                                    8ac0abfd6ce8b3bb510760813aac322f

                                    SHA1

                                    729304ab5f4080fcd75cad909430abb1b8bbf0fe

                                    SHA256

                                    4d6c7d56778dce25d3895b6a7c5f83601ffd2c0c2dae3d602df363bd2fc06b6e

                                    SHA512

                                    30856f01838cc71f0ca6c2640c7e17498e3cc193ba5b1b2b9f27a2a4c38e68668d0dcea5590c2ab8b13c104a13ff6889bd9deff750e4dbd1d76e76e2dae2bb7f

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                    Filesize

                                    9KB

                                    MD5

                                    ba450a247f659c4392e872b26e2b8151

                                    SHA1

                                    c81c5978fd6177f94487c533b340af31a3683f37

                                    SHA256

                                    9f346db6dabdb8c5eb7bfd185923056f0b7b298738a7bbdd65c6de878a7eaa7d

                                    SHA512

                                    fbd5c6db31ab0598862976d2b7822d91f5291add0d44a5ab0eb6372fbad1800bd9e9bba0729a35aeeab7080b4f93c0a5031eb7abe1e5f67d2227045f0c9e63ef

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                    Filesize

                                    19KB

                                    MD5

                                    6e3ddb0b1df959babd2cd6e536f50177

                                    SHA1

                                    142e5b27190df95bf04880c1d9b563c981a4122a

                                    SHA256

                                    e95f6a0c74d66d1f009afedcde107e7be6b0e4173a6b22b1ba86d6712da27c18

                                    SHA512

                                    8dcd7ea6bc91ae3165bc1d851c842b8bb7a21f7bd75099b004f7b2b864f09df13728577d6c39afb5d8de8f10dbe23a238734a22d03a0beb5e8b8a9b2e32f0981

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                    Filesize

                                    18KB

                                    MD5

                                    b71adb82734646d6c25dcd1c22f33f72

                                    SHA1

                                    6e0bdc45513498bd4c91826afd2f68f83ce70493

                                    SHA256

                                    c6f69153e0fced57b7277dfb8e4aeea8e61a599cf94c24cb19007992469707d7

                                    SHA512

                                    ef135ad13bd94fd04052c05b75daba8b90c347fcaa67abd8ccb9d308f77cd850ca1395a8fbc160cc27b858a930e25672fd229c13d38d1fa485512cd6a696e953

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

                                    Filesize

                                    72B

                                    MD5

                                    bb1e15f375293c5cf7bf80cf540f7ffb

                                    SHA1

                                    2a724346e2ffc110eefb14693833fa5b2348cdb9

                                    SHA256

                                    5f08954c6bf6c916b847bb981a54209dd00141ad58bf3bc7214c0041008ce07f

                                    SHA512

                                    494fa81342c5134dfc21a8df9f8567f464668521416347c4f1e7e2e2ee3ce2d0aa678bf82f9a6c15de1f3392296eda123432f989e34d159f58c5652a2c66cbff

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                    Filesize

                                    231KB

                                    MD5

                                    c6211e44c40feb05e18e7b992b6be9c3

                                    SHA1

                                    8957a262db7fb500323de1deb9ceaea7754e7331

                                    SHA256

                                    060099a59bed998493f75c976c82ae5b2d17f4d79379a1059c8a678405233811

                                    SHA512

                                    c13805e348939c9d31d1b422587f5c19dbb1220e28a51b2035e18be451bd77152fb6f8c088accbb3280224dfffef85fc82b21f112ea9ab46372ecdefc9a04a20

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                    Filesize

                                    231KB

                                    MD5

                                    0a1215f662edd7b7ce71299453a8eb73

                                    SHA1

                                    601199ffe7f99b133a7c30fc9e21933af3cb4784

                                    SHA256

                                    68632b18f28816cfc0c7248c720911d3f8cc2ec2cf4b2269a61007180d50da31

                                    SHA512

                                    cf32a35f0ffd29d3b3c289657b202d1f57625de7f39e32d639a35f80eb2f78f24084ca7f0fb531244e6ddea89acf795c90d10776d7fff2c009de36f78008b09f

                                  • C:\Users\Admin\AppData\Local\Temp\scoped_dir4080_1992219209\1b16a17a-8722-4393-a651-1552e8d2d414.tmp

                                    Filesize

                                    150KB

                                    MD5

                                    14937b985303ecce4196154a24fc369a

                                    SHA1

                                    ecfe89e11a8d08ce0c8745ff5735d5edad683730

                                    SHA256

                                    71006a5311819fef45c659428944897184880bcdb571bf68c52b3d6ee97682ff

                                    SHA512

                                    1d03c75e4d2cd57eee7b0e93e2de293b41f280c415fb2446ac234fc5afd11fe2f2fcc8ab9843db0847c2ce6bd7df7213fcf249ea71896fbf6c0696e3f5aee46c

                                  • C:\Users\Admin\AppData\Local\Temp\scoped_dir4080_1992219209\CRX_INSTALL\_locales\en\messages.json

                                    Filesize

                                    711B

                                    MD5

                                    558659936250e03cc14b60ebf648aa09

                                    SHA1

                                    32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825

                                    SHA256

                                    2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b

                                    SHA512

                                    1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727