hxxps://github[.]com/moom825/Discord-RAT-2[.]0/releases/download/2[.]0/release[.]zip

Resubmissions

27-04-2024 21:35

240427-1ff8wsha58 1

27-04-2024 18:27

240427-w3ydgaee6x 10

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
27-04-2024 21:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/moom825/Discord-RAT-2.0/releases/download/2.0/release.zip

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133587273398901811"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
556	chrome.exe
556	chrome.exe
3532	chrome.exe
3532	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
556	chrome.exe
556	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	556	chrome.exe
Token: SeCreatePagefilePrivilege	556	chrome.exe
Token: SeShutdownPrivilege	556	chrome.exe
Token: SeCreatePagefilePrivilege	556	chrome.exe
Token: SeShutdownPrivilege	556	chrome.exe
Token: SeCreatePagefilePrivilege	556	chrome.exe
Token: SeShutdownPrivilege	556	chrome.exe
Token: SeCreatePagefilePrivilege	556	chrome.exe
Token: SeShutdownPrivilege	556	chrome.exe
Token: SeCreatePagefilePrivilege	556	chrome.exe
Token: SeShutdownPrivilege	556	chrome.exe
Token: SeCreatePagefilePrivilege	556	chrome.exe
Token: SeShutdownPrivilege	556	chrome.exe
Token: SeCreatePagefilePrivilege	556	chrome.exe
Token: SeShutdownPrivilege	556	chrome.exe
Token: SeCreatePagefilePrivilege	556	chrome.exe
Token: SeShutdownPrivilege	556	chrome.exe
Token: SeCreatePagefilePrivilege	556	chrome.exe
Token: SeShutdownPrivilege	556	chrome.exe
Token: SeCreatePagefilePrivilege	556	chrome.exe
Token: SeShutdownPrivilege	556	chrome.exe
Token: SeCreatePagefilePrivilege	556	chrome.exe
Token: SeShutdownPrivilege	556	chrome.exe
Token: SeCreatePagefilePrivilege	556	chrome.exe
Token: SeShutdownPrivilege	556	chrome.exe
Token: SeCreatePagefilePrivilege	556	chrome.exe
Token: SeShutdownPrivilege	556	chrome.exe
Token: SeCreatePagefilePrivilege	556	chrome.exe
Token: SeShutdownPrivilege	556	chrome.exe
Token: SeCreatePagefilePrivilege	556	chrome.exe
Token: SeShutdownPrivilege	556	chrome.exe
Token: SeCreatePagefilePrivilege	556	chrome.exe
Token: SeShutdownPrivilege	556	chrome.exe
Token: SeCreatePagefilePrivilege	556	chrome.exe
Token: SeShutdownPrivilege	556	chrome.exe
Token: SeCreatePagefilePrivilege	556	chrome.exe
Token: SeShutdownPrivilege	556	chrome.exe
Token: SeCreatePagefilePrivilege	556	chrome.exe
Token: SeShutdownPrivilege	556	chrome.exe
Token: SeCreatePagefilePrivilege	556	chrome.exe
Token: SeShutdownPrivilege	556	chrome.exe
Token: SeCreatePagefilePrivilege	556	chrome.exe
Token: SeShutdownPrivilege	556	chrome.exe
Token: SeCreatePagefilePrivilege	556	chrome.exe
Token: SeShutdownPrivilege	556	chrome.exe
Token: SeCreatePagefilePrivilege	556	chrome.exe
Token: SeShutdownPrivilege	556	chrome.exe
Token: SeCreatePagefilePrivilege	556	chrome.exe
Token: SeShutdownPrivilege	556	chrome.exe
Token: SeCreatePagefilePrivilege	556	chrome.exe
Token: SeShutdownPrivilege	556	chrome.exe
Token: SeCreatePagefilePrivilege	556	chrome.exe
Token: SeShutdownPrivilege	556	chrome.exe
Token: SeCreatePagefilePrivilege	556	chrome.exe
Token: SeShutdownPrivilege	556	chrome.exe
Token: SeCreatePagefilePrivilege	556	chrome.exe
Token: SeShutdownPrivilege	556	chrome.exe
Token: SeCreatePagefilePrivilege	556	chrome.exe
Token: SeShutdownPrivilege	556	chrome.exe
Token: SeCreatePagefilePrivilege	556	chrome.exe
Token: SeShutdownPrivilege	556	chrome.exe
Token: SeCreatePagefilePrivilege	556	chrome.exe
Token: SeShutdownPrivilege	556	chrome.exe
Token: SeCreatePagefilePrivilege	556	chrome.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe
556	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 556 wrote to memory of 4380	556	chrome.exe	84
PID 556 wrote to memory of 4380	556	chrome.exe	84
PID 556 wrote to memory of 3000	556	chrome.exe	86
PID 556 wrote to memory of 3000	556	chrome.exe	86
PID 556 wrote to memory of 3000	556	chrome.exe	86
PID 556 wrote to memory of 3000	556	chrome.exe	86
PID 556 wrote to memory of 3000	556	chrome.exe	86
PID 556 wrote to memory of 3000	556	chrome.exe	86
PID 556 wrote to memory of 3000	556	chrome.exe	86
PID 556 wrote to memory of 3000	556	chrome.exe	86
PID 556 wrote to memory of 3000	556	chrome.exe	86
PID 556 wrote to memory of 3000	556	chrome.exe	86
PID 556 wrote to memory of 3000	556	chrome.exe	86
PID 556 wrote to memory of 3000	556	chrome.exe	86
PID 556 wrote to memory of 3000	556	chrome.exe	86
PID 556 wrote to memory of 3000	556	chrome.exe	86
PID 556 wrote to memory of 3000	556	chrome.exe	86
PID 556 wrote to memory of 3000	556	chrome.exe	86
PID 556 wrote to memory of 3000	556	chrome.exe	86
PID 556 wrote to memory of 3000	556	chrome.exe	86
PID 556 wrote to memory of 3000	556	chrome.exe	86
PID 556 wrote to memory of 3000	556	chrome.exe	86
PID 556 wrote to memory of 3000	556	chrome.exe	86
PID 556 wrote to memory of 3000	556	chrome.exe	86
PID 556 wrote to memory of 3000	556	chrome.exe	86
PID 556 wrote to memory of 3000	556	chrome.exe	86
PID 556 wrote to memory of 3000	556	chrome.exe	86
PID 556 wrote to memory of 3000	556	chrome.exe	86
PID 556 wrote to memory of 3000	556	chrome.exe	86
PID 556 wrote to memory of 3000	556	chrome.exe	86
PID 556 wrote to memory of 3000	556	chrome.exe	86
PID 556 wrote to memory of 3000	556	chrome.exe	86
PID 556 wrote to memory of 3000	556	chrome.exe	86
PID 556 wrote to memory of 1188	556	chrome.exe	87
PID 556 wrote to memory of 1188	556	chrome.exe	87
PID 556 wrote to memory of 4368	556	chrome.exe	88
PID 556 wrote to memory of 4368	556	chrome.exe	88
PID 556 wrote to memory of 4368	556	chrome.exe	88
PID 556 wrote to memory of 4368	556	chrome.exe	88
PID 556 wrote to memory of 4368	556	chrome.exe	88
PID 556 wrote to memory of 4368	556	chrome.exe	88
PID 556 wrote to memory of 4368	556	chrome.exe	88
PID 556 wrote to memory of 4368	556	chrome.exe	88
PID 556 wrote to memory of 4368	556	chrome.exe	88
PID 556 wrote to memory of 4368	556	chrome.exe	88
PID 556 wrote to memory of 4368	556	chrome.exe	88
PID 556 wrote to memory of 4368	556	chrome.exe	88
PID 556 wrote to memory of 4368	556	chrome.exe	88
PID 556 wrote to memory of 4368	556	chrome.exe	88
PID 556 wrote to memory of 4368	556	chrome.exe	88
PID 556 wrote to memory of 4368	556	chrome.exe	88
PID 556 wrote to memory of 4368	556	chrome.exe	88
PID 556 wrote to memory of 4368	556	chrome.exe	88
PID 556 wrote to memory of 4368	556	chrome.exe	88
PID 556 wrote to memory of 4368	556	chrome.exe	88
PID 556 wrote to memory of 4368	556	chrome.exe	88
PID 556 wrote to memory of 4368	556	chrome.exe	88
PID 556 wrote to memory of 4368	556	chrome.exe	88
PID 556 wrote to memory of 4368	556	chrome.exe	88
PID 556 wrote to memory of 4368	556	chrome.exe	88
PID 556 wrote to memory of 4368	556	chrome.exe	88
PID 556 wrote to memory of 4368	556	chrome.exe	88
PID 556 wrote to memory of 4368	556	chrome.exe	88
PID 556 wrote to memory of 4368	556	chrome.exe	88

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/moom825/Discord-RAT-2.0/releases/download/2.0/release.zip
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc27e0ab58,0x7ffc27e0ab68,0x7ffc27e0ab78
  2⤵
  PID:4380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1256 --field-trial-handle=1896,i,12962536340337434644,11396059157287882880,131072 /prefetch:2
  2⤵
  PID:3000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1896,i,12962536340337434644,11396059157287882880,131072 /prefetch:8
  2⤵
  PID:1188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2268 --field-trial-handle=1896,i,12962536340337434644,11396059157287882880,131072 /prefetch:8
  2⤵
  PID:4368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2860 --field-trial-handle=1896,i,12962536340337434644,11396059157287882880,131072 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2868 --field-trial-handle=1896,i,12962536340337434644,11396059157287882880,131072 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4668 --field-trial-handle=1896,i,12962536340337434644,11396059157287882880,131072 /prefetch:8
  2⤵
  PID:4092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4784 --field-trial-handle=1896,i,12962536340337434644,11396059157287882880,131072 /prefetch:8
  2⤵
  PID:2144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4812 --field-trial-handle=1896,i,12962536340337434644,11396059157287882880,131072 /prefetch:8
  2⤵
  PID:5084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4792 --field-trial-handle=1896,i,12962536340337434644,11396059157287882880,131072 /prefetch:8
  2⤵
  PID:4816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=984 --field-trial-handle=1896,i,12962536340337434644,11396059157287882880,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3532

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:3848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\77f1ed93-168b-4cf7-83e5-88e6f45a83db.tmp

Filesize
7KB

MD5
60cd0ae54d47f674a32a0812e4abcde2

SHA1
b5aefdb8cd334c33592dc22c473b0cbdeeed9d6b

SHA256
18638db52982c2ddb41ff14fba1fa20e6d1a907c4155d8ec83de82140c512204

SHA512
baa0c8d56eeeab79fb4f144acec467868c32382377bf9c70970f10529cd73e094cccb380a0659133880077ccd566d10bfda9a6d7572a116412c1420e545d0d23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
42b99470b48425f8e9145d3d1c7d401e

SHA1
a13a9551ae2b4b1ff780d50e227fe8a2ccc571ea

SHA256
e185f3cfe0d3ac39e03339a3807b98fedd20ced005bb76abfbb4610076b41e28

SHA512
d2d24dfe8ea3463dd0c16768d73b78dc414997789bd183e4264e9c9cf5d308462962a81539818256009949b111498dd8a3a5167c8508ff8a6da544e2569d1456

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
135971600835b02c1711cdf4b491f1af

SHA1
d17b2a7a34ffce79ae420f458e662928bacdc8e7

SHA256
4782028833471636d638164416c1f88c5c159fdfb3027ff93fb18780841a248a

SHA512
2ef281fccd651e5482076aae90dd943ffb4e22984843cab3b04a1fed771e5bdc8d5b13b6b2bcacca73d563773d104d96531a252060a9bf3cbca3dc7ec6be0287

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
32d77d1d1501694dcce65f14676ff92f

SHA1
569e60d4969cc9376b14e9d90c8c811008cc5fe4

SHA256
a0385de61f9a1c7b9cc33d3b30aceab7e9eb1acd2be1c810222eda7b77ac1c73

SHA512
490b6fbf8ea7f4770b8f8a3dbb5d0181e66c7abc5eafafea0f22a7668d832624376a965443a7e2f867a375e4319da6f9812086fd758edc47c74bc4f89b8aa3b8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1024B

MD5
85dc522a3f55574e54c6ddd08dda29ac

SHA1
f9e5c36b5b36609eb9f0c4fb09706f3ecd57cfd8

SHA256
df17b68f8032ece2279ea0d324db6bfaf2f70b3500e93c665e3bc61693c3b877

SHA512
7d2ae7ba1f6113df8d43d318a15ea1aee5313da140565bbfcdcbe788c09850d909ce114832c612a01bbb90da3415db28b7937c1c6b4851bd6cfbcaea28a51c23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
689B

MD5
dc980318cf5220882bffe02b7442b4b7

SHA1
567881d0fa25b3518c7bee309e6d3a46e20e2076

SHA256
17d7e4fff7ed72e1fc41230dfbfd5f762897ad48d668b5b2d3544c2046977b87

SHA512
eaf8ad2e4ea09c57ff9e5bb63c322993e765167c8d68425b96b4a8c508b165aa130c5671d885155d746ab0932cccea7fe0bf8a8540e1212ed12387f7c6120921

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
689B

MD5
e3355818de186a8de00284fe338b4c6b

SHA1
fbddf3e85cfcd85ca9b7a9f36fc251c77e484d18

SHA256
4256136727af8ff5388ea9ec26ece09dafb1f7a122aad27d3c676e80afa05961

SHA512
cb7470018d849a9271d2838dbb6fdd983c6d8a6ed0252085f5f0ec9d6ad2edd410ef5aa957d413b757955b5f918fbfdf2d643ffab0a42f9b809581fd9e78a554

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
689B

MD5
2194cf7a39bff746a3f99aa2f275c9f8

SHA1
7985fd9ecfeb2d3ffd279c67d9c9288ea7752930

SHA256
d1297d144c8c9d9bb5ed2fc81446ca0120918fd2b3b73fec3978f165708b8dba

SHA512
308dab9cf2ff5bb4c62fe79470f2d467b178d9b6c59f4a87441e8b0191ddc236e264a4952d0260897af91fa8d25e811376b13c9a9816f0d41ff93678f8a25fd5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
689B

MD5
50e3b95c28da4cb9fe98f1e5028709ce

SHA1
390fe5811d764b437e3f82b10d27effe26dec932

SHA256
e97dcddd6d98fcf2db2cdd5c17f427c99dd6d0d6c6ebcf9f3131eafc75e8b6fa

SHA512
8068d84e204aeb426c526e3965db2492b55faf3d4828afb02c404ad8238bba166d48638e581181fad23ba90b697a9cf387773d4cc0a7072a7c0ad2967aca209e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1024B

MD5
a361aa9e6c5450116042493aab08bd0a

SHA1
f005ab60c19c4e48df60b6f2f0ef0f65d62a32b4

SHA256
74307ae4248789c96a57f2aa57331ae1e721b9afaaa6fec41410a56966753d19

SHA512
bfb4b46db81637666b19e01c797e2ea5462700fd2a22c759e06512566b677d845b399507714ed2949952f5ead5a5aa855241a51dab0bbf3f4f4bfb0169dbb2e1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
521B

MD5
41cd4bfd32cdd2d5c986e4bc8e22a51e

SHA1
d21c1eb4f09bdcadb1f5fc95bfc81e34db827c14

SHA256
3f1da4316a3039bc427b712c723ddd5e39d3a3d7095eabcce2ef4d78f96f777f

SHA512
168b68abfbc2497078782722840442e66dd64ef6d5b7220925c43dd3ee23aba5102ae51673a6c0291b63b4dc8306fd5052fd14d04d8d473bff668d47c324e3c4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
51fac5616d7c6912b425dcb505f4c4e4

SHA1
a3f024db36a97da99018d34ee04a1f5a2b410d9a

SHA256
c0d8197443d8f0a2f3fcd13a962c9a0f843fe4247bad389d879c935b58f7e33d

SHA512
fb069e6290a90b4a4b16a25b8e1509bd72b4660cd87fb8cdbc500bb38261cbca13c2567c84b1b69cea8fb043487d565ea3f0447f0b6118d5a595a04f2963e385

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
5ff9b91e0218a7cde6f452985b1a5e17

SHA1
3219541d521a6a8947c1b711b4073170ac8a158b

SHA256
6e48845f0cecfb1d81344d5482088f6bac2e9a7ee63f90336324cb9eeb4e019f

SHA512
da76c69dece63dcff686750608848e11982d54692ac63c905074d474e5cd21684deb0b4b4662fdbd7d74522b1a9a9a8c5b5fab30a637d74d06547f45bc3d160d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
130KB

MD5
64fd5e20515d05e8afc23089075d48c8

SHA1
1c71a5940b93142ae809b2bcc00661f5676c26b3

SHA256
add483a0a4e3338850372e29514f4512f788ac9baf27a819a751f5ad9eca85c2

SHA512
dfd467f24e440ed53365f54ebe495df49a3f956f969c287dfbfa3cb943899acf12728c92250208e00780c93a95b5669139298bacf440d6826f5969c8c9fc73c8

Download Submit