asyncrat | hxxps://mega[.]nz/file/NN03QRTb#VCCQWKKJ1h075jpQcyGbGeZ7Bt4qnwD_R24CCDuDV2c

Analysis

max time kernel
175s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
06/06/2024, 08:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://mega.nz/file/NN03QRTb#VCCQWKKJ1h075jpQcyGbGeZ7Bt4qnwD_R24CCDuDV2c
Sample240606-j25pyabf8x

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

95.216.52.21:7575

Mutex

xdnqiaxygefjfoolgo

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133621350821074664"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3212	chrome.exe
3212	chrome.exe
4364	chrome.exe
4364	chrome.exe
2300	Client.exe
2300	Client.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3212	chrome.exe
3212	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3212	chrome.exe
Token: SeCreatePagefilePrivilege	3212	chrome.exe
Token: SeShutdownPrivilege	3212	chrome.exe
Token: SeCreatePagefilePrivilege	3212	chrome.exe
Token: SeShutdownPrivilege	3212	chrome.exe
Token: SeCreatePagefilePrivilege	3212	chrome.exe
Token: SeShutdownPrivilege	3212	chrome.exe
Token: SeCreatePagefilePrivilege	3212	chrome.exe
Token: SeShutdownPrivilege	3212	chrome.exe
Token: SeCreatePagefilePrivilege	3212	chrome.exe
Token: SeShutdownPrivilege	3212	chrome.exe
Token: SeCreatePagefilePrivilege	3212	chrome.exe
Token: SeShutdownPrivilege	3212	chrome.exe
Token: SeCreatePagefilePrivilege	3212	chrome.exe
Token: SeShutdownPrivilege	3212	chrome.exe
Token: SeCreatePagefilePrivilege	3212	chrome.exe
Token: SeShutdownPrivilege	3212	chrome.exe
Token: SeCreatePagefilePrivilege	3212	chrome.exe
Token: SeShutdownPrivilege	3212	chrome.exe
Token: SeCreatePagefilePrivilege	3212	chrome.exe
Token: SeShutdownPrivilege	3212	chrome.exe
Token: SeCreatePagefilePrivilege	3212	chrome.exe
Token: SeShutdownPrivilege	3212	chrome.exe
Token: SeCreatePagefilePrivilege	3212	chrome.exe
Token: SeShutdownPrivilege	3212	chrome.exe
Token: SeCreatePagefilePrivilege	3212	chrome.exe
Token: SeShutdownPrivilege	3212	chrome.exe
Token: SeCreatePagefilePrivilege	3212	chrome.exe
Token: SeShutdownPrivilege	3212	chrome.exe
Token: SeCreatePagefilePrivilege	3212	chrome.exe
Token: SeShutdownPrivilege	3212	chrome.exe
Token: SeCreatePagefilePrivilege	3212	chrome.exe
Token: SeShutdownPrivilege	3212	chrome.exe
Token: SeCreatePagefilePrivilege	3212	chrome.exe
Token: SeShutdownPrivilege	3212	chrome.exe
Token: SeCreatePagefilePrivilege	3212	chrome.exe
Token: SeShutdownPrivilege	3212	chrome.exe
Token: SeCreatePagefilePrivilege	3212	chrome.exe
Token: SeShutdownPrivilege	3212	chrome.exe
Token: SeCreatePagefilePrivilege	3212	chrome.exe
Token: SeShutdownPrivilege	3212	chrome.exe
Token: SeCreatePagefilePrivilege	3212	chrome.exe
Token: SeShutdownPrivilege	3212	chrome.exe
Token: SeCreatePagefilePrivilege	3212	chrome.exe
Token: SeShutdownPrivilege	3212	chrome.exe
Token: SeCreatePagefilePrivilege	3212	chrome.exe
Token: SeShutdownPrivilege	3212	chrome.exe
Token: SeCreatePagefilePrivilege	3212	chrome.exe
Token: SeShutdownPrivilege	3212	chrome.exe
Token: SeCreatePagefilePrivilege	3212	chrome.exe
Token: SeShutdownPrivilege	3212	chrome.exe
Token: SeCreatePagefilePrivilege	3212	chrome.exe
Token: SeShutdownPrivilege	3212	chrome.exe
Token: SeCreatePagefilePrivilege	3212	chrome.exe
Token: SeShutdownPrivilege	3212	chrome.exe
Token: SeCreatePagefilePrivilege	3212	chrome.exe
Token: SeShutdownPrivilege	3212	chrome.exe
Token: SeCreatePagefilePrivilege	3212	chrome.exe
Token: SeShutdownPrivilege	3212	chrome.exe
Token: SeCreatePagefilePrivilege	3212	chrome.exe
Token: SeShutdownPrivilege	3212	chrome.exe
Token: SeCreatePagefilePrivilege	3212	chrome.exe
Token: SeShutdownPrivilege	3212	chrome.exe
Token: SeCreatePagefilePrivilege	3212	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3212	chrome.exe
3212	chrome.exe
3212	chrome.exe
3212	chrome.exe
3212	chrome.exe
3212	chrome.exe
3212	chrome.exe
3212	chrome.exe
3212	chrome.exe
3212	chrome.exe
3212	chrome.exe
3212	chrome.exe
3212	chrome.exe
3212	chrome.exe
3212	chrome.exe
3212	chrome.exe
3212	chrome.exe
3212	chrome.exe
3212	chrome.exe
3212	chrome.exe
3212	chrome.exe
3212	chrome.exe
3212	chrome.exe
3212	chrome.exe
3212	chrome.exe
3212	chrome.exe
3212	chrome.exe
3212	chrome.exe
3212	chrome.exe
3212	chrome.exe
3212	chrome.exe
3212	chrome.exe
3212	chrome.exe
3212	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3212	chrome.exe
3212	chrome.exe
3212	chrome.exe
3212	chrome.exe
3212	chrome.exe
3212	chrome.exe
3212	chrome.exe
3212	chrome.exe
3212	chrome.exe
3212	chrome.exe
3212	chrome.exe
3212	chrome.exe
3212	chrome.exe
3212	chrome.exe
3212	chrome.exe
3212	chrome.exe
3212	chrome.exe
3212	chrome.exe
3212	chrome.exe
3212	chrome.exe
3212	chrome.exe
3212	chrome.exe
3212	chrome.exe
3212	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3212 wrote to memory of 3208	3212	chrome.exe	82
PID 3212 wrote to memory of 3208	3212	chrome.exe	82
PID 3212 wrote to memory of 1696	3212	chrome.exe	83
PID 3212 wrote to memory of 1696	3212	chrome.exe	83
PID 3212 wrote to memory of 1696	3212	chrome.exe	83
PID 3212 wrote to memory of 1696	3212	chrome.exe	83
PID 3212 wrote to memory of 1696	3212	chrome.exe	83
PID 3212 wrote to memory of 1696	3212	chrome.exe	83
PID 3212 wrote to memory of 1696	3212	chrome.exe	83
PID 3212 wrote to memory of 1696	3212	chrome.exe	83
PID 3212 wrote to memory of 1696	3212	chrome.exe	83
PID 3212 wrote to memory of 1696	3212	chrome.exe	83
PID 3212 wrote to memory of 1696	3212	chrome.exe	83
PID 3212 wrote to memory of 1696	3212	chrome.exe	83
PID 3212 wrote to memory of 1696	3212	chrome.exe	83
PID 3212 wrote to memory of 1696	3212	chrome.exe	83
PID 3212 wrote to memory of 1696	3212	chrome.exe	83
PID 3212 wrote to memory of 1696	3212	chrome.exe	83
PID 3212 wrote to memory of 1696	3212	chrome.exe	83
PID 3212 wrote to memory of 1696	3212	chrome.exe	83
PID 3212 wrote to memory of 1696	3212	chrome.exe	83
PID 3212 wrote to memory of 1696	3212	chrome.exe	83
PID 3212 wrote to memory of 1696	3212	chrome.exe	83
PID 3212 wrote to memory of 1696	3212	chrome.exe	83
PID 3212 wrote to memory of 1696	3212	chrome.exe	83
PID 3212 wrote to memory of 1696	3212	chrome.exe	83
PID 3212 wrote to memory of 1696	3212	chrome.exe	83
PID 3212 wrote to memory of 1696	3212	chrome.exe	83
PID 3212 wrote to memory of 1696	3212	chrome.exe	83
PID 3212 wrote to memory of 1696	3212	chrome.exe	83
PID 3212 wrote to memory of 1696	3212	chrome.exe	83
PID 3212 wrote to memory of 1696	3212	chrome.exe	83
PID 3212 wrote to memory of 1696	3212	chrome.exe	83
PID 3212 wrote to memory of 3136	3212	chrome.exe	84
PID 3212 wrote to memory of 3136	3212	chrome.exe	84
PID 3212 wrote to memory of 436	3212	chrome.exe	85
PID 3212 wrote to memory of 436	3212	chrome.exe	85
PID 3212 wrote to memory of 436	3212	chrome.exe	85
PID 3212 wrote to memory of 436	3212	chrome.exe	85
PID 3212 wrote to memory of 436	3212	chrome.exe	85
PID 3212 wrote to memory of 436	3212	chrome.exe	85
PID 3212 wrote to memory of 436	3212	chrome.exe	85
PID 3212 wrote to memory of 436	3212	chrome.exe	85
PID 3212 wrote to memory of 436	3212	chrome.exe	85
PID 3212 wrote to memory of 436	3212	chrome.exe	85
PID 3212 wrote to memory of 436	3212	chrome.exe	85
PID 3212 wrote to memory of 436	3212	chrome.exe	85
PID 3212 wrote to memory of 436	3212	chrome.exe	85
PID 3212 wrote to memory of 436	3212	chrome.exe	85
PID 3212 wrote to memory of 436	3212	chrome.exe	85
PID 3212 wrote to memory of 436	3212	chrome.exe	85
PID 3212 wrote to memory of 436	3212	chrome.exe	85
PID 3212 wrote to memory of 436	3212	chrome.exe	85
PID 3212 wrote to memory of 436	3212	chrome.exe	85
PID 3212 wrote to memory of 436	3212	chrome.exe	85
PID 3212 wrote to memory of 436	3212	chrome.exe	85
PID 3212 wrote to memory of 436	3212	chrome.exe	85
PID 3212 wrote to memory of 436	3212	chrome.exe	85
PID 3212 wrote to memory of 436	3212	chrome.exe	85
PID 3212 wrote to memory of 436	3212	chrome.exe	85
PID 3212 wrote to memory of 436	3212	chrome.exe	85
PID 3212 wrote to memory of 436	3212	chrome.exe	85
PID 3212 wrote to memory of 436	3212	chrome.exe	85
PID 3212 wrote to memory of 436	3212	chrome.exe	85

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://mega.nz/file/NN03QRTb#VCCQWKKJ1h075jpQcyGbGeZ7Bt4qnwD_R24CCDuDV2c
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd08d0ab58,0x7ffd08d0ab68,0x7ffd08d0ab78
  2⤵
  PID:3208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1592 --field-trial-handle=1972,i,12182627792312470157,11693134618606428090,131072 /prefetch:2
  2⤵
  PID:1696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1892 --field-trial-handle=1972,i,12182627792312470157,11693134618606428090,131072 /prefetch:8
  2⤵
  PID:3136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2232 --field-trial-handle=1972,i,12182627792312470157,11693134618606428090,131072 /prefetch:8
  2⤵
  PID:436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2976 --field-trial-handle=1972,i,12182627792312470157,11693134618606428090,131072 /prefetch:1
  2⤵
  PID:980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2984 --field-trial-handle=1972,i,12182627792312470157,11693134618606428090,131072 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4484 --field-trial-handle=1972,i,12182627792312470157,11693134618606428090,131072 /prefetch:8
  2⤵
  PID:4428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4816 --field-trial-handle=1972,i,12182627792312470157,11693134618606428090,131072 /prefetch:8
  2⤵
  PID:3636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1068 --field-trial-handle=1972,i,12182627792312470157,11693134618606428090,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3024 --field-trial-handle=1972,i,12182627792312470157,11693134618606428090,131072 /prefetch:8
  2⤵
  PID:3600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4996 --field-trial-handle=1972,i,12182627792312470157,11693134618606428090,131072 /prefetch:8
  2⤵
  PID:3936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4984 --field-trial-handle=1972,i,12182627792312470157,11693134618606428090,131072 /prefetch:8
  2⤵
  PID:3448

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:2856

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x320 0x4e8
1⤵
PID:1912

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4424

C:\Users\Admin\Desktop\Venom RAT + HVNC + Stealer + Grabber v6.0.3\Client.exe
"C:\Users\Admin\Desktop\Venom RAT + HVNC + Stealer + Grabber v6.0.3\Client.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 2ed4f2593fd8cd21ff8d5832382f21d82b7a41e98368e4de978c655063cbeb34
MD5 9c4f1e0c09db9fb09731fba76a969340
SHA1 8d27fe860325945ca3568f6a12ea38763f130f30
SHA512 765388559082abe9ba83169cba96d075adc0348302cbc8b484377ee2223c655380be497851d07a5847730f658b5c9b01f5308ebd00299dbdd7ce273048958ccc
MD5 SHA1 SHA512

Submit Download

00000000

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\000\p\00\00000000
Size 4.5MB
SHA256 3b0e6454d1309ffd74b0ffbd462b822e4e47a5979f4b232ea47628e3583b6a5d
MD5 89d3df15d984b9e1903adbc8725f6878
SHA1 63edec30a0dcfc14fab139b7c6d9f0ac9cbca58a
SHA512 d0976a544ea8da7d2d0dd9083929ab1739d2eb82b36fcba8ec86f39f2d5e5506b895adafb637c08b6c94fdce6eff3d60da2077cfc55b49d5d1cbde2568b96551
SSDEEP 98304:4LuJlxec6gMPuIxsJ3j3WgYnE4yjUaUWLatGOAi3w:4LuXw/6z3WgYnTyjUlWLavAiA
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\000\t\Paths\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\000003.log
Size 67KB
SHA256 b577da37fee0ef7c0d1b0ab719813e99e3c832e3e0ed685f3d6e19950e340ea0
MD5 0faa8f73d2720b1dc012d3787a527403
SHA1 cd2dd041c15f0cbc3d31a76300f81564526e8936
SHA512 e3eeee4728bf8b12e70b3d183a446a4c200e37b4762db0036720e3a4c2e17e24553470da0e46435ab3739709b305fb7aff43a968fdfdb90e3adc3e923a34b973
SSDEEP 1536:6d2HTdfUF4KT4N74o4bY4k45w4U4RPj4m4R1I4RI4RDE4Rg4Rpc4KT:6d2HTdfUFw2B9Pu1TTDPbpsT
MD5 SHA1 SHA512 SSDEEP

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG.old
Size 376B
SHA256 6baae92602987f036b2763581cb075d98ebb4e4dfccb696fa7ea71573479dc32
MD5 2a37fe6075c6884b3b78a8e51f544da7
SHA1 3b661cb4c3242785fcc4e348220f9889ffc309ca
SHA512 9c52e9303f140d345ac213f025e39cc8f6a1ead2d282d0decafcf3970b6f00bc509c0f2a09105f95e309e3f3a44f67c893e102e92a83399b71bac9ff4b73c44f
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG.old
Size 373B
SHA256 40f09a3991daced70bd17bf819b0a3bc210cc6633402d157eb837087b9565a42
MD5 4efa478380b5feeaad58fd56ecd81434
SHA1 d60f838854643a65a0b9671e7d05e001a4a4e1d9
SHA512 cc78874a1fc400288c6663ca3335e56b7a95e462b7903f005eb3d8bc75d6fe2c285bfb388826363c86556e2d3cb48892c4e5e4233cfcbd2643098ccc0aa980e3
MD5 SHA1 SHA512

Submit Download

LOG.old~RFe599987.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG.old~RFe599987.TMP
Size 335B
SHA256 1fc56ade632ce7bf8b615b2dcb5159508c050286eb13b67940d55633026c14b9
MD5 fbcb1f4675353587d65e069d7796b574
SHA1 efe1ccdbde1ad6939cb435d9573fde240e657b96
SHA512 b613d6f227adcf15e4b5cce8ba366f67a5e0c3173e01d37320bf54beaef8e8874e9b76c209b3a4dcd5c87ce7e66d0e3a3039c92cd0ac4fae79cbf903821560cb
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 9bc0b26ce9bc8f0ee01d86be9b7d604bb0f58087dd06588d07f58bb90951a232
MD5 5292e59cd52dac8fb5d7901a4d277e5a
SHA1 b2a3de66167eb48113d2ebbb5fe40d40b1cf02d9
SHA512 1f19d0400a28c6811140db7690a8ab703f4c65c5f3ffcaab92410e1fb7f36f83e58d6f2cce9b678fe333e105afb684f143ade7eaf609c73f1f1e708026d3678e
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 1b80cd8eccd1cf072b52e4b136ca2894b54741d6a1c7052831b5513097e05afd
MD5 da8cf0d4c49532075da1261867a0ab75
SHA1 82a867ac674d8d2225a3b7edc7d113cba2f6b3c7
SHA512 be040cf4b68792495d884cbd6cee6c7aa34026b07d9f7463d2149b399c4740897e318b64479e3a17ed1fd64f8739d298f03022362af1a063096f863d7dd2474e
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 892cd1aa80f8a18e28eba70d95735818f40665277b621c2ee3b65b32a64c6d57
MD5 6fe572b16e85aa6a69a2fe78baa692d3
SHA1 44bb09dcc39d55730363bc4b19fc753ff0cba7eb
SHA512 667aca73e389bd999cd6e7f380cf9e0ea804944048a0b6461afe13aee995910efccaa53a1e12e7e362e5d208491b7f20edb9f10de2704b6a845b81b7b4ac400f
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 7KB
SHA256 a6e3d6fc41c29251f49c9bc9c4a918ac8f2893f7b9d84aa090343e523b31eb55
MD5 a9c7ad070945cff806a4ab5465505319
SHA1 ae6e583e7029b00129381eedeabaaa8aad51143e
SHA512 af9f00cdc02b8985274582ff84599342b119ea64201160f2720fee9dc91d2791e2e2809f8bc0a9b328d849e3e3039fe0ac20a509a5c003a14b3193872addceb7
SSDEEP 96:ciVo73X56J/RKIkJjEV8iZRy7Dx+6MSmue4ZE1bOjY3h+a2MEVhYtjEsXt0/cgVI:cKk34ZaJi8syh+FgEVRpP5tjEsXtScR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 7KB
SHA256 4464f6e3f140448f2c7888b02eb635dc3341725b088bd7b4a3d889924c552183
MD5 0ee82f103c1b4fca2ca0491fe7e139f4
SHA1 52f5482b7923c42227ab0f8cc86d3fbdb038966d
SHA512 1a09115547a3f536ce3c5b4627c2297012bbab9a5b9f08aaa474abb46a54780eb60a0a2318e2a115297f139d7d5779736343822671e054c1b83511a3eee366a9
SSDEEP 96:cigoP3X56J/RKIkJjEV8iZRy7Dx+6MSmue4MbjMORKY3h+a2MEVhYtjEsXt0/cgS:cBQ34ZaJi8syh+FtbFRpP5tjEsXtScR
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 ebce6de05596cb041f7d9116928e25970d292929269284e438f37b93db2acc2e
MD5 bb2e84b65a43f3817d3e1045dc42e7e4
SHA1 3ea6b437d38f9675350c630bfe4d81a553c32465
SHA512 b275c22049c1a775788d30981218a96bbb0af8130317c58145e825ac78c089fa71c01ea2c131b425746ad40197fd2fa1af4fbb613cddefe62ad0b932dc3ad9a5
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe57b6bd.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57b6bd.TMP
Size 48B
SHA256 ec2dc99d41df225e957d5675d35b0c11f62ba0fa02cb8e844868941b3bab1b5e
MD5 4b63393b69456dd6ee45458901e97309
SHA1 7e74f65ac4f2a3562851598c7343a2746d561a4b
SHA512 53148b2159cb1f64e834fbff9ba273ded804a18f6627e781845621249b6b2d05b3ec77c65413840fabc6c0d16b7397f1da98542c257be0d918b2e338884fdcb6
MD5 SHA1 SHA512

Submit Download

Module Info Cache

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Size 97KB
SHA256 24058925d04ed9534da0490f118a32c27f3085b402fe47620337719b356417c3
MD5 ba28d7a3eebe87ef847776a5ad817845
SHA1 dbfa6dab54b4fd949f80a5db020ab8a47cf462f9
SHA512 c3564f2792f603c533273b5bf2caa22773701b5b9ea114493a1e3f1f1d1430d226a34b49e2a609c02297b401b9d71c3bdf593ed1e8bde3b2da099ae0ba46c8af
SSDEEP 384:xOZWxEQrC8a8CJXPJHYHIGppuSj1+ErZXPN0TUhyiA0DnzbfQiru/kE2zmZ24cy1:xiQXjGh7KyE2i+52Kd+do
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache~RFe59e267.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe59e267.TMP
Size 88KB
SHA256 72dc779c1dacd0e59adc00e6f58b865a877d1d34602eaa8c737625c6c9a067f3
MD5 5d64f2795a625f7410a7ef26de7f7f52
SHA1 9b5a3e12d07d6bef96001bd509f82e7d50955f44
SHA512 9c7d69dc4da02b84ed75e6e468c2b0eeb66f061deb3d559754be6a62da98c583c4a94df89edbf94e84298da8df8b72ace1888a4cb9b649e884e1b210e97982b9
SSDEEP 384:kOZWxEQrC8a8CJXPJHYHIGppuSj1+EcxN0TUoiAVnzbrirukE2dZ24cyz3/XQuKu:oiQXjG37K9EnX+52Kd+dH
MD5 SHA1 SHA512 SSDEEP

Submit Download

f89e219c-0fce-4424-a4c3-f921722a3ef4.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\f89e219c-0fce-4424-a4c3-f921722a3ef4.tmp
Size 129KB
SHA256 4f036b1ea61d0b758a33db9762582e47f58abf184a5ede5ad52337dbd5af8fd1
MD5 6018139323eeca6c57c4fd1ddd7f6467
SHA1 16d96c6fa596acc3fa76ab7da333d9744b848959
SHA512 37a04136df8c68901482fe1885612023fdd4f5cf7266e7999256e20a22d1bcea422303082684bbee2787e1fce081b2c0187b1b08bec7f4d58cb3414c5afb8130
SSDEEP 3072:AlJ5TObcly4nASlCdNpLpDqqnhXNFM35jX0HYw6eGGCBa2DX1hJ:AQYRPILxZnhLMJjX0EeGzY2rLJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2300-475-0x0000000000C50000-0x0000000000C66000-memory.dmp

Download

memory/2300-476-0x00007FFCF5413000-0x00007FFCF5415000-memory.dmp

Download

memory/2300-477-0x00007FFCF5410000-0x00007FFCF5ED1000-memory.dmp

Download