xworm | c4cf13df8afc3f1f55f9fd30807958839110721316c19f1b0692bc99cb9921bf

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
02-11-2024 16:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Fulloption_3.0.exe
Size

88KB
MD5

94be15b6d23986b1f085d036649dbdb1
SHA1

c871893da78093673b57d616044e61ade9209301
SHA256

c4cf13df8afc3f1f55f9fd30807958839110721316c19f1b0692bc99cb9921bf
SHA512

c62824c0e9f356e214f03577539380d2dac73f7da9768a8a6c7c63b59267c34ccd3c8211762de26b21c38162fd069714a4877594d3d9a2182ce0af5925104636
SSDEEP

1536:pvWgDObMMtlpgcHcR4FwdjGb1A4hJG6bPOhhWqAmoUxl:pvWH2wwYb1Ag7OipmD

Score

10^/10

xworm discovery rat trojan

Malware Config

Extracted

Family

xworm

127.0.0.1:7000

Attributes

Install_directory
%AppData%
install_file
XClient.exe

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/436-1-0x00000000000C0000-0x00000000000DC000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
25	ip-api.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133750371452069470"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3248	chrome.exe
3248	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	436	Fulloption_3.0.exe
Token: SeShutdownPrivilege	3248	chrome.exe
Token: SeCreatePagefilePrivilege	3248	chrome.exe
Token: SeShutdownPrivilege	3248	chrome.exe
Token: SeCreatePagefilePrivilege	3248	chrome.exe
Token: SeShutdownPrivilege	3248	chrome.exe
Token: SeCreatePagefilePrivilege	3248	chrome.exe
Token: SeShutdownPrivilege	3248	chrome.exe
Token: SeCreatePagefilePrivilege	3248	chrome.exe
Token: SeShutdownPrivilege	3248	chrome.exe
Token: SeCreatePagefilePrivilege	3248	chrome.exe
Token: SeShutdownPrivilege	3248	chrome.exe
Token: SeCreatePagefilePrivilege	3248	chrome.exe
Token: SeShutdownPrivilege	3248	chrome.exe
Token: SeCreatePagefilePrivilege	3248	chrome.exe
Token: SeShutdownPrivilege	3248	chrome.exe
Token: SeCreatePagefilePrivilege	3248	chrome.exe
Token: SeShutdownPrivilege	3248	chrome.exe
Token: SeCreatePagefilePrivilege	3248	chrome.exe
Token: SeShutdownPrivilege	3248	chrome.exe
Token: SeCreatePagefilePrivilege	3248	chrome.exe
Token: SeShutdownPrivilege	3248	chrome.exe
Token: SeCreatePagefilePrivilege	3248	chrome.exe
Token: SeShutdownPrivilege	3248	chrome.exe
Token: SeCreatePagefilePrivilege	3248	chrome.exe
Token: SeShutdownPrivilege	3248	chrome.exe
Token: SeCreatePagefilePrivilege	3248	chrome.exe
Token: SeShutdownPrivilege	3248	chrome.exe
Token: SeCreatePagefilePrivilege	3248	chrome.exe
Token: SeShutdownPrivilege	3248	chrome.exe
Token: SeCreatePagefilePrivilege	3248	chrome.exe
Token: SeShutdownPrivilege	3248	chrome.exe
Token: SeCreatePagefilePrivilege	3248	chrome.exe
Token: SeShutdownPrivilege	3248	chrome.exe
Token: SeCreatePagefilePrivilege	3248	chrome.exe
Token: SeShutdownPrivilege	3248	chrome.exe
Token: SeCreatePagefilePrivilege	3248	chrome.exe
Token: SeShutdownPrivilege	3248	chrome.exe
Token: SeCreatePagefilePrivilege	3248	chrome.exe
Token: SeShutdownPrivilege	3248	chrome.exe
Token: SeCreatePagefilePrivilege	3248	chrome.exe
Token: SeShutdownPrivilege	3248	chrome.exe
Token: SeCreatePagefilePrivilege	3248	chrome.exe
Token: SeShutdownPrivilege	3248	chrome.exe
Token: SeCreatePagefilePrivilege	3248	chrome.exe
Token: SeShutdownPrivilege	3248	chrome.exe
Token: SeCreatePagefilePrivilege	3248	chrome.exe
Token: SeShutdownPrivilege	3248	chrome.exe
Token: SeCreatePagefilePrivilege	3248	chrome.exe
Token: SeShutdownPrivilege	3248	chrome.exe
Token: SeCreatePagefilePrivilege	3248	chrome.exe
Token: SeShutdownPrivilege	3248	chrome.exe
Token: SeCreatePagefilePrivilege	3248	chrome.exe
Token: SeShutdownPrivilege	3248	chrome.exe
Token: SeCreatePagefilePrivilege	3248	chrome.exe
Token: SeShutdownPrivilege	3248	chrome.exe
Token: SeCreatePagefilePrivilege	3248	chrome.exe
Token: SeShutdownPrivilege	3248	chrome.exe
Token: SeCreatePagefilePrivilege	3248	chrome.exe
Token: SeShutdownPrivilege	3248	chrome.exe
Token: SeCreatePagefilePrivilege	3248	chrome.exe
Token: SeShutdownPrivilege	3248	chrome.exe
Token: SeCreatePagefilePrivilege	3248	chrome.exe
Token: SeShutdownPrivilege	3248	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe
3248	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3248 wrote to memory of 4256	3248	chrome.exe	114
PID 3248 wrote to memory of 4256	3248	chrome.exe	114
PID 3248 wrote to memory of 3584	3248	chrome.exe	115
PID 3248 wrote to memory of 3584	3248	chrome.exe	115
PID 3248 wrote to memory of 3584	3248	chrome.exe	115
PID 3248 wrote to memory of 3584	3248	chrome.exe	115
PID 3248 wrote to memory of 3584	3248	chrome.exe	115
PID 3248 wrote to memory of 3584	3248	chrome.exe	115
PID 3248 wrote to memory of 3584	3248	chrome.exe	115
PID 3248 wrote to memory of 3584	3248	chrome.exe	115
PID 3248 wrote to memory of 3584	3248	chrome.exe	115
PID 3248 wrote to memory of 3584	3248	chrome.exe	115
PID 3248 wrote to memory of 3584	3248	chrome.exe	115
PID 3248 wrote to memory of 3584	3248	chrome.exe	115
PID 3248 wrote to memory of 3584	3248	chrome.exe	115
PID 3248 wrote to memory of 3584	3248	chrome.exe	115
PID 3248 wrote to memory of 3584	3248	chrome.exe	115
PID 3248 wrote to memory of 3584	3248	chrome.exe	115
PID 3248 wrote to memory of 3584	3248	chrome.exe	115
PID 3248 wrote to memory of 3584	3248	chrome.exe	115
PID 3248 wrote to memory of 3584	3248	chrome.exe	115
PID 3248 wrote to memory of 3584	3248	chrome.exe	115
PID 3248 wrote to memory of 3584	3248	chrome.exe	115
PID 3248 wrote to memory of 3584	3248	chrome.exe	115
PID 3248 wrote to memory of 3584	3248	chrome.exe	115
PID 3248 wrote to memory of 3584	3248	chrome.exe	115
PID 3248 wrote to memory of 3584	3248	chrome.exe	115
PID 3248 wrote to memory of 3584	3248	chrome.exe	115
PID 3248 wrote to memory of 3584	3248	chrome.exe	115
PID 3248 wrote to memory of 3584	3248	chrome.exe	115
PID 3248 wrote to memory of 3584	3248	chrome.exe	115
PID 3248 wrote to memory of 3584	3248	chrome.exe	115
PID 3248 wrote to memory of 984	3248	chrome.exe	116
PID 3248 wrote to memory of 984	3248	chrome.exe	116
PID 3248 wrote to memory of 4284	3248	chrome.exe	117
PID 3248 wrote to memory of 4284	3248	chrome.exe	117
PID 3248 wrote to memory of 4284	3248	chrome.exe	117
PID 3248 wrote to memory of 4284	3248	chrome.exe	117
PID 3248 wrote to memory of 4284	3248	chrome.exe	117
PID 3248 wrote to memory of 4284	3248	chrome.exe	117
PID 3248 wrote to memory of 4284	3248	chrome.exe	117
PID 3248 wrote to memory of 4284	3248	chrome.exe	117
PID 3248 wrote to memory of 4284	3248	chrome.exe	117
PID 3248 wrote to memory of 4284	3248	chrome.exe	117
PID 3248 wrote to memory of 4284	3248	chrome.exe	117
PID 3248 wrote to memory of 4284	3248	chrome.exe	117
PID 3248 wrote to memory of 4284	3248	chrome.exe	117
PID 3248 wrote to memory of 4284	3248	chrome.exe	117
PID 3248 wrote to memory of 4284	3248	chrome.exe	117
PID 3248 wrote to memory of 4284	3248	chrome.exe	117
PID 3248 wrote to memory of 4284	3248	chrome.exe	117
PID 3248 wrote to memory of 4284	3248	chrome.exe	117
PID 3248 wrote to memory of 4284	3248	chrome.exe	117
PID 3248 wrote to memory of 4284	3248	chrome.exe	117
PID 3248 wrote to memory of 4284	3248	chrome.exe	117
PID 3248 wrote to memory of 4284	3248	chrome.exe	117
PID 3248 wrote to memory of 4284	3248	chrome.exe	117
PID 3248 wrote to memory of 4284	3248	chrome.exe	117
PID 3248 wrote to memory of 4284	3248	chrome.exe	117
PID 3248 wrote to memory of 4284	3248	chrome.exe	117
PID 3248 wrote to memory of 4284	3248	chrome.exe	117
PID 3248 wrote to memory of 4284	3248	chrome.exe	117
PID 3248 wrote to memory of 4284	3248	chrome.exe	117
PID 3248 wrote to memory of 4284	3248	chrome.exe	117

C:\Users\Admin\AppData\Local\Temp\Fulloption_3.0.exe
"C:\Users\Admin\AppData\Local\Temp\Fulloption_3.0.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:436

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3976

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffb48a0cc40,0x7ffb48a0cc4c,0x7ffb48a0cc58
  2⤵
  PID:4256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1836,i,5864809819252073291,787774791360316583,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1828 /prefetch:2
  2⤵
  PID:3584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2192,i,5864809819252073291,787774791360316583,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  PID:984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2292,i,5864809819252073291,787774791360316583,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2136 /prefetch:8
  2⤵
  PID:4284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3156,i,5864809819252073291,787774791360316583,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3232,i,5864809819252073291,787774791360316583,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:1624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4604,i,5864809819252073291,787774791360316583,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3724 /prefetch:1
  2⤵
  PID:4756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4620,i,5864809819252073291,787774791360316583,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4496 /prefetch:8
  2⤵
  PID:348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4540,i,5864809819252073291,787774791360316583,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4872 /prefetch:8
  2⤵
  PID:3472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4992,i,5864809819252073291,787774791360316583,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4904 /prefetch:8
  2⤵
  PID:4884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5012,i,5864809819252073291,787774791360316583,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4868 /prefetch:8
  2⤵
  PID:4036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=4516,i,5864809819252073291,787774791360316583,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:5216

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:2520

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
57c30588d2c43a2238f9d830df5c958e

SHA1
9d3a1d63ee12c23a200d4b2d0a589c99ebc317d7

SHA256
7d06120aa360c4495e9c2b8c44592985e6087c5df95496bc45573352ba9afba7

SHA512
1c638bc76f7516b5d5e616fa0f97e8ff4b34a74d57d4c378ded4995382c02cfb81d7dbdfd8617028db7d03f59e0292d37e124b5f01b0c06a6731cb2c5c00c0bd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
01f87eb0258d0f5a9fd3184c09dea1c7

SHA1
19090d6bf54e319f8ce74151a6cf03664feaa341

SHA256
fc4f469a13a605d03a0256e4ab740de9580a64bf6a064c4bd8bd4518946f030b

SHA512
a2d1c208c8b197d2f3e19e87f748397874170df323bbe60bb21d2ae9a9ec46e5279a7b21873488716cded9e5c36b699dc3bebdd3af90fa419d7c9cbaab451b7a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
09eb374a0925ac2f1459e28437deec46

SHA1
76ac32abff5333d2513eb78c941506590a2be562

SHA256
9aafa87b032c54a5b0ee10385bc72a1e02a36a6981edad0ab3dbf7ae879fbc5b

SHA512
1edcfd646823b22a14db0b023b897c337bd9daf0caa5c45d9116221c685ff0fb8e567ff55bc6bdb3740fd32e2bd9d698b5deda85e93c7e62cd051207de2d59a0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
524B

MD5
8cd75117959abae064514af6f8d37764

SHA1
221d293f8dabac4893ceeebbee97ee75293703a5

SHA256
5d534817e6efc345dfdb6378cab8719dda3b5651b2c56d824daca7f7bd6d8e71

SHA512
0211e9bad903dfc5507864138c9601ad1670adf4cc0598c54070d53eb5468cae8f1fdee44dd777a71f73da1aa08815717bf0d6a19443a397493ec7562446370c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
310dde2f59fdc94fa651f9af990bc263

SHA1
b9b6ac70251bc4175e9ed370f63cc81d01644ff3

SHA256
a8f7467b5dba93d0c909f10fb1c2aa20cdd71bce3ab052e5bbc23b887b53e561

SHA512
ce4b818f1b6038e96fd7fa09cfe007870ceba8f352ed2e0ca8262d56d97055fc4ad6b5c4c572dc05739765dfdf117f1e4d87cc12449eca787365cb6820b8ee93

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
1bca0a3b580708a2a8162fed0d0f6954

SHA1
1536f1c4a3ec34f0747abb2072f6cecea6d3a990

SHA256
db10dbb20351c4c3c4c19f3dd4420313f60f99c7c0383d3f921a71686ac051fb

SHA512
330dffcdcadfc806c33909acbecd728a37cac75ba44f75d146736fef60d28e3971b5ea4518a1cfd26321cb152db08e9264f619120abed7e3a5577f1993ae72ef

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
b217a84a50cfee86b12673466b832675

SHA1
031fa447fcae5a9d45bfa8effc79f6c65bb3f51e

SHA256
782c6ffdf2d62bfa20713a59587cf0610c84c8d67a1f7eeddd29cd2fb54aaca5

SHA512
20134eff914d7203d8b2f8c86439fe60e87bb86ecfa022d7dc6222b3b19c942cb9baa394de56e93665f7ff99f8953570645f0bc9fc0b441c86c7cdb610e78e4a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
94d6d1c5c1cd2bca168ddaa1b5b8a87a

SHA1
5207a871a592e705b9920357c07d4159b7531260

SHA256
f9842553d2a8f57d7678b521adaa586d9b77eb2e63ae0b7153ddce40a7a68cd9

SHA512
5b9205423d0f4f2dc22692ecdd5fa0f7f55895248c9f97d97c2a6ff6a2b035f336108fc620b81a376d1e11fb3666f7f922431923790f183a118c28ce84d91e66

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
e6c8314ae05bda216b8724b86d00d9b6

SHA1
49eb32c7cf1722d460ddab0c07385702f41389b8

SHA256
ef1170d944747501f09316ddba99d886e4b5a0cf8efa2b30a9898b3c4cbd39a0

SHA512
cdb1ab8d53850bf5050326021c2f7afb53e20c404a722b5cec53c93ea2931c63f29b11962c26b58e152eda33bfb811e33d4ca1af4564eee91c8951d7d68e6dbf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
8c0588550a13b3db4f4616028f416d45

SHA1
68047c048eeda58554c041b3d2cecb0ed47b51c4

SHA256
46bfb427babd0e0d3d9a9be3f2906e75d441417f19797990c26c7a88c4268b05

SHA512
64b85fdb52881151492248a3d4706a78b5e9664d35bb476cb6532367384743204470583b373f543de8342a81ca651d539809ef5b1c5b3a88a04de7075ed5c9ab

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
83b5271ad9d5107449fb97844e4faf20

SHA1
330dd902708a686225ec12cdfe9e9064d2a40af2

SHA256
0c1bfbf904d56a12cef48ab5c28f3b87cdb062f97ae649dbe48c725ab8c976ac

SHA512
ac4fc40ff2757289950ab965e37ec0f683ab2306476db434bc178528baaf15c8adf96dbd5fd2ee54f404c635f9009ca16482047db2e6ee3c33e2d7032c15fe0e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
bbbfd6d831c086b67288c6d8eb1ed3fe

SHA1
065ba01ccf9b068d7fc9ba6c3cd5426facea3eef

SHA256
3151f5dce9c2dd6ab336733ddb74c4231599e4ac88c5eb754e71f89e456ffa05

SHA512
f58e5d473d4c621267425b29b168bd2926778dd7f29f18b022c38e4cf4bad46950ce6c9d3e5a7b61a550b631ce6629b8159dc41e7c58741d54ed302cfed5c721

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
229KB

MD5
2f7a351b7931f72880168de952ec99ba

SHA1
38aa335370f3f380fb2cfecb4bb0d163a2e33a42

SHA256
51651a8f1895865068f6c21fc61c41a31111b4cc7bdc457ce55b4baede2e74e6

SHA512
6fdc0b7d855ba0e150a5c83494045d572034eb1e4dc12427eeaf570fc8a5bdcf0705c94ccf9f4eacf646acd8c1ae3ee2d434c47f14764cb9493c46a3a065c324

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
229KB

MD5
58e01f4c8240d13a2e51f11c811ecfd4

SHA1
61c6ca240db7c56697bc331f51fd317672b47ace

SHA256
451a2d84400e53bca62df95fae4f03a918946a577aade821c222fa0eef82b3c0

SHA512
d5a2e7f5d8e331cf37c86a0af504ca793e9ad60bfb09639dace2369cd031f1d88e4b2b97ef3125b75d7a5299e538ef6922559949cddcaae7d3b5a8616c52f000

Download Submit
memory/436-3-0x00007FFB49B70000-0x00007FFB4A631000-memory.dmp

Filesize
10.8MB

Download
memory/436-2-0x00007FFB49B70000-0x00007FFB4A631000-memory.dmp

Filesize
10.8MB

Download
memory/436-0-0x00007FFB49B73000-0x00007FFB49B75000-memory.dmp

Filesize
8KB

Download
memory/436-1-0x00000000000C0000-0x00000000000DC000-memory.dmp

Filesize
112KB

Download