Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    07/02/2025, 16:05

General

  • Target

    TS12V_random.exe

  • Size

    1.7MB

  • MD5

    644722407b1d6461e338020e3ee16f70

  • SHA1

    f50986976ee9633d4824b9ec504a6907958654df

  • SHA256

    87369ce0fd38a391d2a4eb71b7de626fa00316ba27741cfda0ae250ff1a97953

  • SHA512

    bcfea437f1f20e8487eef4027fadbacebc04d29fbd0c426a1ea527dd3e582cdf986b772ce224d9f9908ec352d2fb917081af39e99fc94b92a4413b064b555fc4

  • SSDEEP

    49152:0YpUPt2Nd8HcHWGLdejziJKUYoIbSyrBUsUZb6B:FpMt2Nd8HcHpLiz6KUYoIWuasyb

Malware Config

Extracted

Family

stealc

Botnet

reno

C2

http://185.215.113.115

Attributes
  • url_path

    /c4becf79229cb002.php

Signatures

  • Stealc

    Stealc is an infostealer written in C++.

  • Stealc family
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Downloads MZ/PE file 6 IoCs
  • Uses browser remote debugging 2 TTPs 8 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 22 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TS12V_random.exe
    "C:\Users\Admin\AppData\Local\Temp\TS12V_random.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Downloads MZ/PE file
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:796
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
      2⤵
      • Uses browser remote debugging
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:3060
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6899758,0x7fef6899768,0x7fef6899778
        3⤵
          PID:2336
        • C:\Windows\system32\ctfmon.exe
          ctfmon.exe
          3⤵
            PID:2676
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1176 --field-trial-handle=1140,i,6181763781613107756,1812543727247335016,131072 /prefetch:2
            3⤵
              PID:2484
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1428 --field-trial-handle=1140,i,6181763781613107756,1812543727247335016,131072 /prefetch:8
              3⤵
                PID:2500
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1584 --field-trial-handle=1140,i,6181763781613107756,1812543727247335016,131072 /prefetch:8
                3⤵
                  PID:2560
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2132 --field-trial-handle=1140,i,6181763781613107756,1812543727247335016,131072 /prefetch:1
                  3⤵
                  • Uses browser remote debugging
                  PID:1676
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2336 --field-trial-handle=1140,i,6181763781613107756,1812543727247335016,131072 /prefetch:1
                  3⤵
                  • Uses browser remote debugging
                  PID:1840
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2440 --field-trial-handle=1140,i,6181763781613107756,1812543727247335016,131072 /prefetch:1
                  3⤵
                  • Uses browser remote debugging
                  PID:1648
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1188 --field-trial-handle=1140,i,6181763781613107756,1812543727247335016,131072 /prefetch:2
                  3⤵
                    PID:2332
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
                  2⤵
                  • Uses browser remote debugging
                  • Enumerates system info in registry
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of FindShellTrayWindow
                  PID:700
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6309758,0x7fef6309768,0x7fef6309778
                    3⤵
                      PID:1684
                    • C:\Windows\system32\ctfmon.exe
                      ctfmon.exe
                      3⤵
                        PID:2120
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1152 --field-trial-handle=1308,i,2699396670355364712,4049901473771407523,131072 /prefetch:2
                        3⤵
                          PID:2708
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1524 --field-trial-handle=1308,i,2699396670355364712,4049901473771407523,131072 /prefetch:8
                          3⤵
                            PID:764
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1608 --field-trial-handle=1308,i,2699396670355364712,4049901473771407523,131072 /prefetch:8
                            3⤵
                              PID:2832
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2128 --field-trial-handle=1308,i,2699396670355364712,4049901473771407523,131072 /prefetch:1
                              3⤵
                              • Uses browser remote debugging
                              PID:3024
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2512 --field-trial-handle=1308,i,2699396670355364712,4049901473771407523,131072 /prefetch:1
                              3⤵
                              • Uses browser remote debugging
                              PID:2724
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2520 --field-trial-handle=1308,i,2699396670355364712,4049901473771407523,131072 /prefetch:1
                              3⤵
                              • Uses browser remote debugging
                              PID:1640
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1336 --field-trial-handle=1308,i,2699396670355364712,4049901473771407523,131072 /prefetch:2
                              3⤵
                                PID:1576
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3780 --field-trial-handle=1308,i,2699396670355364712,4049901473771407523,131072 /prefetch:8
                                3⤵
                                  PID:1020
                            • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                              "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                              1⤵
                                PID:1988
                              • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                1⤵
                                  PID:2140

                                Network

                                MITRE ATT&CK Enterprise v15

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\ProgramData\GCGHIIDH

                                  Filesize

                                  92KB

                                  MD5

                                  d25129305db8695ad3e677e8db7bef87

                                  SHA1

                                  84a83f6079ca551fdaaa1235ed047f74695f7317

                                  SHA256

                                  a73a26a7d4285b615b198982c6e882c6742c6770ee81fb8869e88c60ad881bde

                                  SHA512

                                  5a769758b8c3ef7482ea0feab80e4595f73372934b01ea908a7b97c215966d1a6e15b8d5d0f6b8f6c7c71c334e01d06d08daf5faa69f2f5816ab957f55586efc

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

                                  Filesize

                                  40B

                                  MD5

                                  44691fdf709576c5467bd86b9d95cecb

                                  SHA1

                                  9c0e49c662f20cdd89217f1bb4b4ba701e659697

                                  SHA256

                                  bbeef7deae86cbdb634c26982101647e319bb03dce941d124f0ab0edc8a76de9

                                  SHA512

                                  e52fb7f7091ed7a21944c629081fa5069f47fc076911101e20fdcc183c35b7b460fbbfac56f1f91052b1d35a35e66ce2dafce70349ed34ca6f16ba1e1f1fabdf

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\000007.dbtmp

                                  Filesize

                                  16B

                                  MD5

                                  18e723571b00fb1694a3bad6c78e4054

                                  SHA1

                                  afcc0ef32d46fe59e0483f9a3c891d3034d12f32

                                  SHA256

                                  8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

                                  SHA512

                                  43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\000009.dbtmp

                                  Filesize

                                  16B

                                  MD5

                                  979c29c2917bed63ccf520ece1d18cda

                                  SHA1

                                  65cd81cdce0be04c74222b54d0881d3fdfe4736c

                                  SHA256

                                  b3524365a633ee6d1fa9953638d2867946c515218c497a5ec2dbef7dc44a7c53

                                  SHA512

                                  e38f694fd6ab9f678ae156528230d7a8bfb7b59a13b227f59f9c38ab5617db11ebb6be1276323a905d09c4066a3fe820cf58077ab48bf201f3c467a98516ee7a

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000010.dbtmp

                                  Filesize

                                  16B

                                  MD5

                                  60e3f691077715586b918375dd23c6b0

                                  SHA1

                                  476d3eab15649c40c6aebfb6ac2366db50283d1b

                                  SHA256

                                  e91d13722e31f9b06c5df3582cad1ea5b73547ce3dc08b12ed461f095aad48ee

                                  SHA512

                                  d1c146d27bbf19362d6571e2865bb472ce4fe43dc535305615d92d6a2366f98533747a8a70a578d1f00199f716a61ce39fac5cab9dd67e9c044bc49e7343130e

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Extension Scripts\LOG

                                  Filesize

                                  192B

                                  MD5

                                  58f72c28d50caae507f4e02c826f020a

                                  SHA1

                                  c58cb2a2db8b0405c780af97a064e029dfcfae84

                                  SHA256

                                  0ce73d8190e4eab9528bf4dc7ee051a2f6b49ecdd1aa9bf9a6ea9d6aa84b111d

                                  SHA512

                                  d65649f4aa4c21f538af4a11cdf70f33c2a8887782b0173f4d0dba9021706e24bba6041e83d370a1af06efb46558bdf5c4e78a858a5422c83d3812af29eeaace

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Favicons

                                  Filesize

                                  20KB

                                  MD5

                                  3eea0768ded221c9a6a17752a09c969b

                                  SHA1

                                  d17d8086ed76ec503f06ddd0ac03d915aec5cdc7

                                  SHA256

                                  6923fd51e36b8fe40d6d3dd132941c5a693b02f6ae4d4d22b32b5fedd0e7b512

                                  SHA512

                                  fb5c51adf5a5095a81532e3634f48f5aedb56b7724221f1bf1ccb626cab40f87a3b07a66158179e460f1d0e14eeb48f0283b5df6471dd7a6297af6e8f3efb1f9

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\History

                                  Filesize

                                  148KB

                                  MD5

                                  90a1d4b55edf36fa8b4cc6974ed7d4c4

                                  SHA1

                                  aba1b8d0e05421e7df5982899f626211c3c4b5c1

                                  SHA256

                                  7cf3e9e8619904e72ea6608cc43e9b6c9f8aa2af02476f60c2b3daf33075981c

                                  SHA512

                                  ea0838be754e1258c230111900c5937d2b0788f90bbf7c5f82b2ceda7868e50afb86c301f313267eaa912778da45755560b5434885521bf915967a7863922ae2

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Site Characteristics Database\000003.log

                                  Filesize

                                  40B

                                  MD5

                                  148079685e25097536785f4536af014b

                                  SHA1

                                  c5ff5b1b69487a9dd4d244d11bbafa91708c1a41

                                  SHA256

                                  f096bc366a931fba656bdcd77b24af15a5f29fc53281a727c79f82c608ecfab8

                                  SHA512

                                  c2556034ea51abfbc172eb62ff11f5ac45c317f84f39d4b9e3ddbd0190da6ef7fa03fe63631b97ab806430442974a07f8e81b5f7dc52d9f2fcdc669adca8d91f

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Site Characteristics Database\LOG

                                  Filesize

                                  204B

                                  MD5

                                  3962dada2d0804d1327fea6661c8f0eb

                                  SHA1

                                  b2d3aa5013337fa8178cec4c8e31cbc102654948

                                  SHA256

                                  598653dddb9f4de0ba606e8da9e10a74c4f85546fd791878ce0be6601b59dcf4

                                  SHA512

                                  556e533a0a65326c6076f7a45c93b16c77ed1666f9a2c6dafad655e9f4f0c04cb92c46dc9874534de2a8d570f6eea17967801f99114db1b5adc6687d4f76757c

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Sync Data\LevelDB\000002.dbtmp

                                  Filesize

                                  16B

                                  MD5

                                  206702161f94c5cd39fadd03f4014d98

                                  SHA1

                                  bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                  SHA256

                                  1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                  SHA512

                                  0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Sync Data\LevelDB\CURRENT

                                  Filesize

                                  16B

                                  MD5

                                  46295cac801e5d4857d09837238a6394

                                  SHA1

                                  44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                  SHA256

                                  0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                  SHA512

                                  8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Sync Data\LevelDB\LOG

                                  Filesize

                                  192B

                                  MD5

                                  182880ac877ef0dcacb02d9af0d7e03c

                                  SHA1

                                  026e0d8deec353b1cbb6afd39ac7af08df2d926a

                                  SHA256

                                  b22a327eae27b5629b07eabbb4c4095738495e0ed9e1f65c845f6879ac454703

                                  SHA512

                                  8b655efc7898e835e33921cd3756609f190db84c7cf831f07a2ab730802f4a1a08c2f60d6ed853b17751ed7bf9277031bb5fb5e0d559a722c5e255b887bd60db

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Sync Data\LevelDB\MANIFEST-000001

                                  Filesize

                                  41B

                                  MD5

                                  5af87dfd673ba2115e2fcf5cfdb727ab

                                  SHA1

                                  d5b5bbf396dc291274584ef71f444f420b6056f1

                                  SHA256

                                  f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                                  SHA512

                                  de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Visited Links

                                  Filesize

                                  128KB

                                  MD5

                                  33a59f4d7f7be624f3cdc090170ca769

                                  SHA1

                                  ac103f290f07971edf1182cf9e45943f51c9df69

                                  SHA256

                                  63300c76ab4a65fcd193d38a14b9d004e9829db2fcebd432949b3960eacbf87e

                                  SHA512

                                  c2298c531a67d4125019574c20ce9d909d29237ec6b18f216982a5555d253fda81f72937743869b80d06a3fff8496eccd2a37a44ab55c215838731799bbbeba8

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version

                                  Filesize

                                  14B

                                  MD5

                                  9eae63c7a967fc314dd311d9f46a45b7

                                  SHA1

                                  caba9c2c93acfe0b9ceb9ab19b992b0fc19c71cf

                                  SHA256

                                  4288925b0cf871c7458c22c46936efb0e903802feb991a0e1803be94ca6c251d

                                  SHA512

                                  bed924bff236bf5b6ce1df1db82e86c935e5830a20d9d24697efd82ca331e30604db8d04b0d692ec8541ec6deb2225bcc7d805b79f2db5726642198ecf6348b8

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

                                  Filesize

                                  264KB

                                  MD5

                                  f50f89a0a91564d0b8a211f8921aa7de

                                  SHA1

                                  112403a17dd69d5b9018b8cede023cb3b54eab7d

                                  SHA256

                                  b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                  SHA512

                                  bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Affiliation Database

                                  Filesize

                                  32KB

                                  MD5

                                  69e3a8ecda716584cbd765e6a3ab429e

                                  SHA1

                                  f0897f3fa98f6e4863b84f007092ab843a645803

                                  SHA256

                                  e0c9f1494a417f356b611ec769b975a4552c4065b0bc2181954fcbb4b3dfa487

                                  SHA512

                                  bb78069c17196da2ce8546046d2c9d9f3796f39b9868b749ecada89445da7a03c9b54a00fcf34a23eb0514c871e026ac368795d2891bbf37e1dc5046c29beaaa

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Code Cache\js\index

                                  Filesize

                                  24B

                                  MD5

                                  54cb446f628b2ea4a5bce5769910512e

                                  SHA1

                                  c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

                                  SHA256

                                  fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

                                  SHA512

                                  8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Code Cache\js\index-dir\temp-index

                                  Filesize

                                  48B

                                  MD5

                                  c98961a7acd23fb50e0bbc451343486d

                                  SHA1

                                  6f8b9dd244018058396a4aa1f9fc4ffd82b58e8e

                                  SHA256

                                  fe73eaac891318cc1f7a9eefd082bc2675a668d5bd7fc905024af93c9fb1eda3

                                  SHA512

                                  3a5b7fcbd7790b8e892575a51f47a7fd423308d51d4922f292435ea56571f1c46e3bf269e871ecd165cc611f81c18c45dbd266152e0045c9db4c750185e94a76

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Code Cache\wasm\index-dir\the-real-index

                                  Filesize

                                  48B

                                  MD5

                                  6ccf076d6a32d033a7ebfcd7349f466b

                                  SHA1

                                  0dd6b216e8123c1181b98505558bc2cdfe64ed22

                                  SHA256

                                  8bd2bc69bb8faef3e17b79f1a54ab5ab3549804cf1c65b51111762e6b581dbe3

                                  SHA512

                                  ae3ce54dbcebdd80417342e2bfac9766bcc8b6910d92c54948ee8963b782dc02b860910f120dc2f581d215b917f5206593f887b0fe2aba0e0d1018b967cc858a

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Extension Scripts\000003.log

                                  Filesize

                                  76B

                                  MD5

                                  cc4a8cff19abf3dd35d63cff1503aa5f

                                  SHA1

                                  52af41b0d9c78afcc8e308db846c2b52a636be38

                                  SHA256

                                  cc5dacf370f324b77b50dddf5d995fd3c7b7a587cb2f55ac9f24c929d0cd531a

                                  SHA512

                                  0e9559cda992aa2174a7465745884f73b96755008384d21a0685941acf099c89c8203b13551de72a87b8e23cdaae3fa513bc700b38e1bf3b9026955d97920320

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Extension Scripts\LOG

                                  Filesize

                                  193B

                                  MD5

                                  2720c572262171032c10f925ed3170fa

                                  SHA1

                                  f45f5e34ac01271788b9b4a5633a2ba710819d95

                                  SHA256

                                  87cc7548fa1d91535ed3ad7f139ff868dbcc857b8b5143323c5ff003b7306a43

                                  SHA512

                                  3b9542753cf82d15a8c58e3d9061266019a64f000c5edc8744ff8e91d3c3d9aa8666cc5b697f003381fb7a0a05ceb9329c7bfb647bcf44c1923ff9cf258d98d9

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Extension State\000003.log

                                  Filesize

                                  228B

                                  MD5

                                  af1d95e1f9eb485393273b25446e1ae5

                                  SHA1

                                  1d762c96b1c38ba6a849a5b76d12fac636b8d780

                                  SHA256

                                  48d535bb330519c00d150578734c6cecb056c4b5cdd2a45c70590bc896d27d9f

                                  SHA512

                                  826d207edd55401e1c13249350814adbb3ab00a135c46b8da8bb7267751c70580f183982cccbc1e47bf3e3f433f20ba1d2f2afd601fcb67b635c0e7429558165

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Extension State\LOG

                                  Filesize

                                  191B

                                  MD5

                                  73c3d609704eec8963797145fe8cfba6

                                  SHA1

                                  9482d803f513483496a4356faea3b2a78ddcd366

                                  SHA256

                                  12da4b05fa8a9e63f2f2d521b4d3096ecbae61b97fd0d20f68357c7131b11099

                                  SHA512

                                  2d6fb2fae80ad36b717ca5de00fa497434139a13a9be6d04671bfd73d1a2ad87a50a76e832cfe904951de330910cf28cb12992248edb185cf39ebe7b535a0483

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Login Data

                                  Filesize

                                  46KB

                                  MD5

                                  02d2c46697e3714e49f46b680b9a6b83

                                  SHA1

                                  84f98b56d49f01e9b6b76a4e21accf64fd319140

                                  SHA256

                                  522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

                                  SHA512

                                  60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Site Characteristics Database\LOG

                                  Filesize

                                  205B

                                  MD5

                                  4823482b77fdd822bdd637b289a43804

                                  SHA1

                                  392fe414beba6d93430c78f2eacbf08546e060c1

                                  SHA256

                                  b78870b46d31fed73d0d984c3eff460c500614a79666ac6672e24bfd2c09f70c

                                  SHA512

                                  e509c6bcfb2b2ad2ab9471436eca1ad96ef29534452924f22b80d815fa65861ce774b322355f058b4686a08724088b60c53605224ef01d5f7c8fda9a8e6ab9b6

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Site Characteristics Database\MANIFEST-000002

                                  Filesize

                                  50B

                                  MD5

                                  22bf0e81636b1b45051b138f48b3d148

                                  SHA1

                                  56755d203579ab356e5620ce7e85519ad69d614a

                                  SHA256

                                  e292f241daafc3df90f3e2d339c61c6e2787a0d0739aac764e1ea9bb8544ee97

                                  SHA512

                                  a4cf1f5c74e0df85dda8750be9070e24e19b8be15c6f22f0c234ef8423ef9ca3db22ba9ef777d64c33e8fd49fada6fcca26c1a14ba18e8472370533a1c65d8d0

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Sync Data\LevelDB\000003.log

                                  Filesize

                                  46B

                                  MD5

                                  90881c9c26f29fca29815a08ba858544

                                  SHA1

                                  06fee974987b91d82c2839a4bb12991fa99e1bdd

                                  SHA256

                                  a2ca52e34b6138624ac2dd20349cde28482143b837db40a7f0fbda023077c26a

                                  SHA512

                                  15f7f8197b4fc46c4c5c2570fb1f6dd73cb125f9ee53dfa67f5a0d944543c5347bdab5cce95e91dd6c948c9023e23c7f9d76cff990e623178c92f8d49150a625

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Sync Data\LevelDB\000004.dbtmp

                                  Filesize

                                  16B

                                  MD5

                                  6752a1d65b201c13b62ea44016eb221f

                                  SHA1

                                  58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                  SHA256

                                  0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                  SHA512

                                  9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Sync Data\LevelDB\LOG

                                  Filesize

                                  193B

                                  MD5

                                  6c01028bc3b782e9b33ba0668d766730

                                  SHA1

                                  9d6446837cde2d1505b669e4b92dc9cb329397b3

                                  SHA256

                                  c77a1b56e36a7c6622d0889ee1d9f8a61b7227ffbb43ca0b21fe3fe70100d544

                                  SHA512

                                  65ced199785b88eab9c249764f5cf3f5bd7e0a036239eb85a832646de104b04dea5c91126defa2a9f88589973f607ae5a618654edd80d1089db132ad6366a8b1

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Visited Links

                                  Filesize

                                  128KB

                                  MD5

                                  acd44bec454245998a78163ea173b6d0

                                  SHA1

                                  458f52ffeb03b8dc1a60251610705ed01d29eddc

                                  SHA256

                                  99d89fc26db88fec7981bf7c15dfd822c5166f2f61dd127969f1bb209552456d

                                  SHA512

                                  a9e82e2aa83fead13583ba47cf76f7ebe20b0fa7d7c6efb24a5d724a7a2132927ea177617f5686e66bbcaacaf37e4c01d0afdbc64c657a5cd238ff0e9f97be8a

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\shared_proto_db\metadata\LOG

                                  Filesize

                                  200B

                                  MD5

                                  e1ae7deb846068f7e5537fda69b493f9

                                  SHA1

                                  a200dff2d99de52cca23d4d86a8ec9289a7d5aae

                                  SHA256

                                  231864c0d5c079c3529c5579d45c351ec3434cf4a2402d0cb1077ed26895c4b1

                                  SHA512

                                  f47f41951642bd5bfb2bd866b950f2d1450d58529a76a5d7d5d4a64440a92db8b8ce355d90351c9a5a17905f3e3cd68cc135547453e27c07922e6892ec069c1f

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations

                                  Filesize

                                  86B

                                  MD5

                                  f732dbed9289177d15e236d0f8f2ddd3

                                  SHA1

                                  53f822af51b014bc3d4b575865d9c3ef0e4debde

                                  SHA256

                                  2741df9ee9e9d9883397078f94480e9bc1d9c76996eec5cfe4e77929337cbe93

                                  SHA512

                                  b64e5021f32e26c752fcba15a139815894309b25644e74ceca46a9aa97070bca3b77ded569a9bfd694193d035ba75b61a8d6262c8e6d5c4d76b452b38f5150a4

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                                  Filesize

                                  2B

                                  MD5

                                  99914b932bd37a50b983c5e7c90ae93b

                                  SHA1

                                  bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                  SHA256

                                  44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                  SHA512

                                  27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

                                • memory/796-0-0x0000000000F00000-0x0000000001595000-memory.dmp

                                  Filesize

                                  6.6MB

                                • memory/796-241-0x0000000000F00000-0x0000000001595000-memory.dmp

                                  Filesize

                                  6.6MB

                                • memory/796-243-0x0000000000F00000-0x0000000001595000-memory.dmp

                                  Filesize

                                  6.6MB

                                • memory/796-4-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                                  Filesize

                                  972KB

                                • memory/796-244-0x0000000000F00000-0x0000000001595000-memory.dmp

                                  Filesize

                                  6.6MB

                                • memory/796-3-0x0000000000F00000-0x0000000001595000-memory.dmp

                                  Filesize

                                  6.6MB

                                • memory/796-2-0x0000000000F01000-0x0000000000F18000-memory.dmp

                                  Filesize

                                  92KB

                                • memory/796-1-0x00000000772A0000-0x00000000772A2000-memory.dmp

                                  Filesize

                                  8KB

                                • memory/796-484-0x0000000000F00000-0x0000000001595000-memory.dmp

                                  Filesize

                                  6.6MB

                                • memory/796-511-0x0000000000F00000-0x0000000001595000-memory.dmp

                                  Filesize

                                  6.6MB