discordrat | 60f1773412433537eb8d178603df50ed19b70e53bcfccac1265e55af704de749

Analysis

max time kernel
47s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05-03-2024 12:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NigaMafia's Boss.exe
Size

78KB
MD5

21885f673ab1e5656712d1946e139a95
SHA1

af4b0886b99640a98fde66638a08e21fe6acda52
SHA256

60f1773412433537eb8d178603df50ed19b70e53bcfccac1265e55af704de749
SHA512

324c0cf0e7cd6d378f32d7e539ffd2f25afe5a487f0d1bedc864e58b0f7c3d66f00dd87aa53c915d745694dc2c1a324e97803a5c42276894b32eff17c6d6979c
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+TPIC:5Zv5PDwbjNrmAE+LIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTIwNzMzNzU2MDQ2MDc2MzE3Ng.GN_Yaj.0dKAdTpvE5EiY68CCdI2lKg80pcq5NJa3CMGIE
server_id
1182383459306586163

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
10	discord.com
11	discord.com
12	discord.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2520	chrome.exe
2520	chrome.exe

Suspicious use of AdjustPrivilegeToken 58 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2520	chrome.exe
Token: SeShutdownPrivilege	2520	chrome.exe
Token: SeShutdownPrivilege	2520	chrome.exe
Token: SeShutdownPrivilege	2520	chrome.exe
Token: SeShutdownPrivilege	2520	chrome.exe
Token: SeShutdownPrivilege	2520	chrome.exe
Token: SeShutdownPrivilege	2520	chrome.exe
Token: SeShutdownPrivilege	2520	chrome.exe
Token: SeShutdownPrivilege	2520	chrome.exe
Token: SeShutdownPrivilege	2520	chrome.exe
Token: SeShutdownPrivilege	2520	chrome.exe
Token: SeShutdownPrivilege	2520	chrome.exe
Token: SeShutdownPrivilege	2520	chrome.exe
Token: SeShutdownPrivilege	2520	chrome.exe
Token: SeShutdownPrivilege	2520	chrome.exe
Token: SeShutdownPrivilege	2520	chrome.exe
Token: SeShutdownPrivilege	2520	chrome.exe
Token: SeShutdownPrivilege	2520	chrome.exe
Token: SeShutdownPrivilege	2520	chrome.exe
Token: SeShutdownPrivilege	2520	chrome.exe
Token: SeShutdownPrivilege	2520	chrome.exe
Token: SeShutdownPrivilege	2520	chrome.exe
Token: SeShutdownPrivilege	2520	chrome.exe
Token: SeShutdownPrivilege	2520	chrome.exe
Token: SeShutdownPrivilege	2520	chrome.exe
Token: SeShutdownPrivilege	2520	chrome.exe
Token: SeShutdownPrivilege	2520	chrome.exe
Token: SeShutdownPrivilege	2520	chrome.exe
Token: SeShutdownPrivilege	2520	chrome.exe
Token: SeShutdownPrivilege	2520	chrome.exe
Token: SeShutdownPrivilege	2520	chrome.exe
Token: SeShutdownPrivilege	2520	chrome.exe
Token: SeShutdownPrivilege	2520	chrome.exe
Token: SeShutdownPrivilege	2520	chrome.exe
Token: SeShutdownPrivilege	2520	chrome.exe
Token: SeShutdownPrivilege	2520	chrome.exe
Token: SeShutdownPrivilege	2520	chrome.exe
Token: SeShutdownPrivilege	2520	chrome.exe
Token: SeShutdownPrivilege	2520	chrome.exe
Token: SeShutdownPrivilege	2520	chrome.exe
Token: SeShutdownPrivilege	2520	chrome.exe
Token: SeShutdownPrivilege	2520	chrome.exe
Token: SeShutdownPrivilege	2520	chrome.exe
Token: SeShutdownPrivilege	2520	chrome.exe
Token: SeShutdownPrivilege	2520	chrome.exe
Token: SeShutdownPrivilege	2520	chrome.exe
Token: SeShutdownPrivilege	2520	chrome.exe
Token: SeShutdownPrivilege	2520	chrome.exe
Token: SeShutdownPrivilege	2520	chrome.exe
Token: SeShutdownPrivilege	2520	chrome.exe
Token: SeShutdownPrivilege	2520	chrome.exe
Token: SeShutdownPrivilege	2520	chrome.exe
Token: SeShutdownPrivilege	2520	chrome.exe
Token: SeShutdownPrivilege	2520	chrome.exe
Token: SeShutdownPrivilege	2520	chrome.exe
Token: SeShutdownPrivilege	2520	chrome.exe
Token: SeShutdownPrivilege	2520	chrome.exe
Token: SeShutdownPrivilege	2520	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2520	chrome.exe
2520	chrome.exe
2520	chrome.exe
2520	chrome.exe
2520	chrome.exe
2520	chrome.exe
2520	chrome.exe
2520	chrome.exe
2520	chrome.exe
2520	chrome.exe
2520	chrome.exe
2520	chrome.exe
2520	chrome.exe
2520	chrome.exe
2520	chrome.exe
2520	chrome.exe
2520	chrome.exe
2520	chrome.exe
2520	chrome.exe
2520	chrome.exe
2520	chrome.exe
2520	chrome.exe
2520	chrome.exe
2520	chrome.exe
2520	chrome.exe
2520	chrome.exe
2520	chrome.exe
2520	chrome.exe
2520	chrome.exe
2520	chrome.exe
2520	chrome.exe
2520	chrome.exe
2520	chrome.exe
2520	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2520	chrome.exe
2520	chrome.exe
2520	chrome.exe
2520	chrome.exe
2520	chrome.exe
2520	chrome.exe
2520	chrome.exe
2520	chrome.exe
2520	chrome.exe
2520	chrome.exe
2520	chrome.exe
2520	chrome.exe
2520	chrome.exe
2520	chrome.exe
2520	chrome.exe
2520	chrome.exe
2520	chrome.exe
2520	chrome.exe
2520	chrome.exe
2520	chrome.exe
2520	chrome.exe
2520	chrome.exe
2520	chrome.exe
2520	chrome.exe
2520	chrome.exe
2520	chrome.exe
2520	chrome.exe
2520	chrome.exe
2520	chrome.exe
2520	chrome.exe
2520	chrome.exe
2520	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 2008	1756	NigaMafia's Boss.exe	28
PID 1756 wrote to memory of 2008	1756	NigaMafia's Boss.exe	28
PID 1756 wrote to memory of 2008	1756	NigaMafia's Boss.exe	28
PID 2520 wrote to memory of 2864	2520	chrome.exe	32
PID 2520 wrote to memory of 2864	2520	chrome.exe	32
PID 2520 wrote to memory of 2864	2520	chrome.exe	32
PID 2520 wrote to memory of 820	2520	chrome.exe	34
PID 2520 wrote to memory of 820	2520	chrome.exe	34
PID 2520 wrote to memory of 820	2520	chrome.exe	34
PID 2520 wrote to memory of 820	2520	chrome.exe	34
PID 2520 wrote to memory of 820	2520	chrome.exe	34
PID 2520 wrote to memory of 820	2520	chrome.exe	34
PID 2520 wrote to memory of 820	2520	chrome.exe	34
PID 2520 wrote to memory of 820	2520	chrome.exe	34
PID 2520 wrote to memory of 820	2520	chrome.exe	34
PID 2520 wrote to memory of 820	2520	chrome.exe	34
PID 2520 wrote to memory of 820	2520	chrome.exe	34
PID 2520 wrote to memory of 820	2520	chrome.exe	34
PID 2520 wrote to memory of 820	2520	chrome.exe	34
PID 2520 wrote to memory of 820	2520	chrome.exe	34
PID 2520 wrote to memory of 820	2520	chrome.exe	34
PID 2520 wrote to memory of 820	2520	chrome.exe	34
PID 2520 wrote to memory of 820	2520	chrome.exe	34
PID 2520 wrote to memory of 820	2520	chrome.exe	34
PID 2520 wrote to memory of 820	2520	chrome.exe	34
PID 2520 wrote to memory of 820	2520	chrome.exe	34
PID 2520 wrote to memory of 820	2520	chrome.exe	34
PID 2520 wrote to memory of 820	2520	chrome.exe	34
PID 2520 wrote to memory of 820	2520	chrome.exe	34
PID 2520 wrote to memory of 820	2520	chrome.exe	34
PID 2520 wrote to memory of 820	2520	chrome.exe	34
PID 2520 wrote to memory of 820	2520	chrome.exe	34
PID 2520 wrote to memory of 820	2520	chrome.exe	34
PID 2520 wrote to memory of 820	2520	chrome.exe	34
PID 2520 wrote to memory of 820	2520	chrome.exe	34
PID 2520 wrote to memory of 820	2520	chrome.exe	34
PID 2520 wrote to memory of 820	2520	chrome.exe	34
PID 2520 wrote to memory of 820	2520	chrome.exe	34
PID 2520 wrote to memory of 820	2520	chrome.exe	34
PID 2520 wrote to memory of 820	2520	chrome.exe	34
PID 2520 wrote to memory of 820	2520	chrome.exe	34
PID 2520 wrote to memory of 820	2520	chrome.exe	34
PID 2520 wrote to memory of 820	2520	chrome.exe	34
PID 2520 wrote to memory of 820	2520	chrome.exe	34
PID 2520 wrote to memory of 820	2520	chrome.exe	34
PID 2520 wrote to memory of 340	2520	chrome.exe	35
PID 2520 wrote to memory of 340	2520	chrome.exe	35
PID 2520 wrote to memory of 340	2520	chrome.exe	35
PID 2520 wrote to memory of 2364	2520	chrome.exe	36
PID 2520 wrote to memory of 2364	2520	chrome.exe	36
PID 2520 wrote to memory of 2364	2520	chrome.exe	36
PID 2520 wrote to memory of 2364	2520	chrome.exe	36
PID 2520 wrote to memory of 2364	2520	chrome.exe	36
PID 2520 wrote to memory of 2364	2520	chrome.exe	36
PID 2520 wrote to memory of 2364	2520	chrome.exe	36
PID 2520 wrote to memory of 2364	2520	chrome.exe	36
PID 2520 wrote to memory of 2364	2520	chrome.exe	36
PID 2520 wrote to memory of 2364	2520	chrome.exe	36
PID 2520 wrote to memory of 2364	2520	chrome.exe	36
PID 2520 wrote to memory of 2364	2520	chrome.exe	36
PID 2520 wrote to memory of 2364	2520	chrome.exe	36
PID 2520 wrote to memory of 2364	2520	chrome.exe	36
PID 2520 wrote to memory of 2364	2520	chrome.exe	36
PID 2520 wrote to memory of 2364	2520	chrome.exe	36

C:\Users\Admin\AppData\Local\Temp\NigaMafia's Boss.exe
"C:\Users\Admin\AppData\Local\Temp\NigaMafia's Boss.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1756 -s 596
  2⤵
  PID:2008

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef51d9758,0x7fef51d9768,0x7fef51d9778
  2⤵
  PID:2864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1204 --field-trial-handle=1220,i,11366857557714029018,18006093693338726729,131072 /prefetch:2
  2⤵
  PID:820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1536 --field-trial-handle=1220,i,11366857557714029018,18006093693338726729,131072 /prefetch:8
  2⤵
  PID:340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1632 --field-trial-handle=1220,i,11366857557714029018,18006093693338726729,131072 /prefetch:8
  2⤵
  PID:2364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2208 --field-trial-handle=1220,i,11366857557714029018,18006093693338726729,131072 /prefetch:1
  2⤵
  PID:348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2216 --field-trial-handle=1220,i,11366857557714029018,18006093693338726729,131072 /prefetch:1
  2⤵
  PID:2320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1292 --field-trial-handle=1220,i,11366857557714029018,18006093693338726729,131072 /prefetch:2
  2⤵
  PID:2164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1452 --field-trial-handle=1220,i,11366857557714029018,18006093693338726729,131072 /prefetch:1
  2⤵
  PID:1956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3704 --field-trial-handle=1220,i,11366857557714029018,18006093693338726729,131072 /prefetch:8
  2⤵
  PID:1936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4012 --field-trial-handle=1220,i,11366857557714029018,18006093693338726729,131072 /prefetch:1
  2⤵
  PID:1440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2564 --field-trial-handle=1220,i,11366857557714029018,18006093693338726729,131072 /prefetch:8
  2⤵
  PID:2428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=2280 --field-trial-handle=1220,i,11366857557714029018,18006093693338726729,131072 /prefetch:1
  2⤵
  PID:1668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=1728 --field-trial-handle=1220,i,11366857557714029018,18006093693338726729,131072 /prefetch:1
  2⤵
  PID:3024

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fff94e1fd385171b4ca9a4397d37cb5b

SHA1
57c22a57677fc3c66a65eb6da94b6c98885e19bd

SHA256
63cff9d06aa23ab999683476352e0cdcc5f1c52142d6ad4f10172148f5c20f1e

SHA512
ee7a770d2db482f0f6067165b3b11d627e0b58420c62d47980927eef80e03b32f0edbe7338378b22b7b00263d614f41fe853c18d67582519b5c2a2d8d5d4da88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fdbbc8d0ed83a543755eccac3a5ea99c

SHA1
9a262972f10141b28ea45cabf0a63d4b866baf6e

SHA256
1df12c2c549dd6701b7bed46ddaa6d4748de69f2d6bcfefc4a5f279e3ca3ce38

SHA512
51bb21fe5b69ac25d31911291c61c5f3d25d0b84fcfee5496584b485c88210cda52a38813328ea45d198c7a985af02dffe795fbd9755d9a674871b42c21765aa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
987B

MD5
3a71637acd647c1dbe1f230537253b26

SHA1
f6bef700b1bb16e1c3d867aab7c768b22e1240bf

SHA256
f45c7871690689e0ecf78646319447ab7c12118b3df8c5735b182610f3e31cff

SHA512
a90e22f40b1863bcabca96a1d6668ff738213e3a62c815cbea22af42ff59d0b9fd7add0de58cbb769e40db0c8ad077ba0efa277f915dad277389e4c7064ab8e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
d333ce42e0ea2e57a1cb60f95c4f93b3

SHA1
0db7b8d93aac10183c53a489dde9d0a660d4533e

SHA256
8988a2d1f058a017efa432a336f1e869fc5138439d907342d5c5a803610c58c1

SHA512
bb55985ef2fb143c630707334dfffb813272b06a747b5f5a5468183cb011cbfcd35bfe21ae5c95ff6a75fde53fffff0ef50aa24338441b41a4972fc10aef8dbb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1016B

MD5
b9b5537ff2608aaa16ddd7a9f78368ab

SHA1
4e44c1365a0f3fb16106cd31409e77b36c936323

SHA256
b26b515b1b0331b3abbd4bbe0e941201dd3ac1170edb2d10a669d3aa33319b6e

SHA512
2e47d8b4fd6bceb5387876025a3fa053045109f39543091ed1c510f587278bef56c6bd4913334a447fc449babada4d8b88f1e41199ad6b19fbd901ce207b7c76

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
9656d7d6be1bba3ec45fbddf37ec4778

SHA1
e80c531b008b06fc523d7020fc9561651176ae6a

SHA256
1063e56850c98f0f80abf501fc0f511448bee4ddfe78f1d47b29b4a6299e6549

SHA512
770f58cb317f3b47a0ace8f59b4eb0788ee8aa3a530bf6e87fee381b99f675454152a0140d0acba26032f021ec479ee87234c91cca7e4b373bef980593c3a8a1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
526B

MD5
f507a15533f5746d6eadf81a7cb71baf

SHA1
7ff83584fa37cc7b5409f7023997e0d8c78e601c

SHA256
9ecce3f5ac68de797045f833cfc060ea596ad03d646ca3f16536f54168808b4f

SHA512
e508fcbf5e7bc7057deac15e393b55da0774507482053128d936333734ebb5760aeaa939fe648d20ddbb516749318b3737a9bf86d1f9cb4f77c5c481ecb07b4d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
ad6a06f3fc35e838531793bb684ec3dd

SHA1
c585600054a9f98e268c236dfca83851138e295f

SHA256
7f59e4dd6f8aff72aab9c7163f526623a2a090972447fa2dcb83c34f0038dd16

SHA512
d4508374c88cfe6ee122bbed8ed69cc12b6c03dd486a501e002958f7fbdbed109fb9dce45f7d2d8763976809d70745253f2ab40a5da57df83a8e3a6973d33662

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
527a1275e56dbc6cdf9ac4d6cacf4b58

SHA1
f433c6e7c5da346f3316828b3606b98b0abd6cf1

SHA256
12785d7bb124861fed5670c983ac87b476cfd63527b790698c13d611677c63bc

SHA512
17a0e2c260b6e44c16dc4b03ebb8651d6db4a6c4e3aa16e3b71e8982a48d135794592bbce5908402df2a64348dda7d97f099f5c6b2c4c545a804adc13af81c90

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
caebe6e1717d680ee91ac3bb1c3e2a35

SHA1
0893bf368c5b768bca3dad5b11c9bae5c7fc9d22

SHA256
410a999574c5ef6997280e58b9600f19124b9b8433baa44d14e65e51cbf90a3e

SHA512
bd8481c6e35a7d05759b5a3d4b342a07ac89d7e734f7dfc29e80fafa8a1111fdaa15a85ad62ab309e086c225e33990c5922d1f5da6d08b4028d0bf7e30c2097a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
4b7768efea76f3690aacc5845e5058ef

SHA1
812429f0fee50a3d40bccdb32d89b81a0c3e0188

SHA256
a6d6ac1b2e86fb7019642447ca0db582de48477f8b33fead52b42d03ae63f04f

SHA512
a93c074b870a268fb8069c47883237582d97b79a7911540d0dc0e1b0e0d6c06f9981638e7b4941088fe40b246e4435e79f7cc1ad4a0924a440f5f0a9761e3d8b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
258KB

MD5
329085b7236095714740a60d330877d9

SHA1
660e09183d765e63d0973698a68a5c3179e9a050

SHA256
abfb51d9faecc51e76cdcac6d5dedaee3259f1e4de06e51816aab505d5bc717b

SHA512
a1ef97d2df91bd34b9a811c15b530c73a312b3c8860e2cf69247a49af1219d06ee35d33f5ad7f307320533b6372aa9bbfd414291ea1e5bd196a53fb2d797f9ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9600.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit
memory/1756-0-0x000000013FD80000-0x000000013FD98000-memory.dmp

Filesize
96KB

Download
memory/1756-3-0x000007FEF5570000-0x000007FEF5F5C000-memory.dmp

Filesize
9.9MB

Download
memory/1756-2-0x000000001BA50000-0x000000001BAD0000-memory.dmp

Filesize
512KB

Download
memory/1756-1-0x000007FEF5570000-0x000007FEF5F5C000-memory.dmp

Filesize
9.9MB

Download