xworm | hxxps://github[.]com/GeniAIDiscord/Solara2/blob/main/cmd[.]exe

Analysis

max time kernel
56s
max time network
52s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05-11-2024 15:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/GeniAIDiscord/Solara2/blob/main/cmd.exe

Score

10^/10

xworm discovery rat trojan

Malware Config

Extracted

Family

xworm

completed-rally.gl.at.ply.gg:28996

Attributes

Install_directory
%LocalAppData%
install_file
Windows Data Compiler.exe

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000f000000023b6b-150.dat	family_xworm
behavioral1/memory/3384-192-0x0000000000770000-0x0000000000788000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm
Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
3384	cmd.exe
3908	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
58	raw.githubusercontent.com
59	raw.githubusercontent.com
60	raw.githubusercontent.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
71	ip-api.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133752941254931629"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2924	chrome.exe
2924	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
2924	chrome.exe
2924	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2924	chrome.exe
Token: SeCreatePagefilePrivilege	2924	chrome.exe
Token: SeShutdownPrivilege	2924	chrome.exe
Token: SeCreatePagefilePrivilege	2924	chrome.exe
Token: SeShutdownPrivilege	2924	chrome.exe
Token: SeCreatePagefilePrivilege	2924	chrome.exe
Token: SeShutdownPrivilege	2924	chrome.exe
Token: SeCreatePagefilePrivilege	2924	chrome.exe
Token: SeShutdownPrivilege	2924	chrome.exe
Token: SeCreatePagefilePrivilege	2924	chrome.exe
Token: SeShutdownPrivilege	2924	chrome.exe
Token: SeCreatePagefilePrivilege	2924	chrome.exe
Token: SeShutdownPrivilege	2924	chrome.exe
Token: SeCreatePagefilePrivilege	2924	chrome.exe
Token: SeShutdownPrivilege	2924	chrome.exe
Token: SeCreatePagefilePrivilege	2924	chrome.exe
Token: SeShutdownPrivilege	2924	chrome.exe
Token: SeCreatePagefilePrivilege	2924	chrome.exe
Token: SeShutdownPrivilege	2924	chrome.exe
Token: SeCreatePagefilePrivilege	2924	chrome.exe
Token: SeShutdownPrivilege	2924	chrome.exe
Token: SeCreatePagefilePrivilege	2924	chrome.exe
Token: SeDebugPrivilege	3384	cmd.exe
Token: SeShutdownPrivilege	2924	chrome.exe
Token: SeCreatePagefilePrivilege	2924	chrome.exe
Token: SeShutdownPrivilege	2924	chrome.exe
Token: SeCreatePagefilePrivilege	2924	chrome.exe
Token: SeShutdownPrivilege	2924	chrome.exe
Token: SeCreatePagefilePrivilege	2924	chrome.exe
Token: SeShutdownPrivilege	2924	chrome.exe
Token: SeCreatePagefilePrivilege	2924	chrome.exe
Token: SeShutdownPrivilege	2924	chrome.exe
Token: SeCreatePagefilePrivilege	2924	chrome.exe
Token: SeShutdownPrivilege	2924	chrome.exe
Token: SeCreatePagefilePrivilege	2924	chrome.exe
Token: SeShutdownPrivilege	2924	chrome.exe
Token: SeCreatePagefilePrivilege	2924	chrome.exe
Token: SeShutdownPrivilege	2924	chrome.exe
Token: SeCreatePagefilePrivilege	2924	chrome.exe
Token: SeShutdownPrivilege	2924	chrome.exe
Token: SeCreatePagefilePrivilege	2924	chrome.exe
Token: SeShutdownPrivilege	2924	chrome.exe
Token: SeCreatePagefilePrivilege	2924	chrome.exe
Token: SeShutdownPrivilege	2924	chrome.exe
Token: SeCreatePagefilePrivilege	2924	chrome.exe
Token: SeShutdownPrivilege	2924	chrome.exe
Token: SeCreatePagefilePrivilege	2924	chrome.exe
Token: SeShutdownPrivilege	2924	chrome.exe
Token: SeCreatePagefilePrivilege	2924	chrome.exe
Token: SeShutdownPrivilege	2924	chrome.exe
Token: SeCreatePagefilePrivilege	2924	chrome.exe
Token: SeShutdownPrivilege	2924	chrome.exe
Token: SeCreatePagefilePrivilege	2924	chrome.exe
Token: SeShutdownPrivilege	2924	chrome.exe
Token: SeCreatePagefilePrivilege	2924	chrome.exe
Token: SeShutdownPrivilege	2924	chrome.exe
Token: SeCreatePagefilePrivilege	2924	chrome.exe
Token: SeShutdownPrivilege	2924	chrome.exe
Token: SeCreatePagefilePrivilege	2924	chrome.exe
Token: SeShutdownPrivilege	2924	chrome.exe
Token: SeCreatePagefilePrivilege	2924	chrome.exe
Token: SeShutdownPrivilege	2924	chrome.exe
Token: SeCreatePagefilePrivilege	2924	chrome.exe
Token: SeShutdownPrivilege	2924	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe
2924	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 1168	2924	chrome.exe	83
PID 2924 wrote to memory of 1168	2924	chrome.exe	83
PID 2924 wrote to memory of 2212	2924	chrome.exe	84
PID 2924 wrote to memory of 2212	2924	chrome.exe	84
PID 2924 wrote to memory of 2212	2924	chrome.exe	84
PID 2924 wrote to memory of 2212	2924	chrome.exe	84
PID 2924 wrote to memory of 2212	2924	chrome.exe	84
PID 2924 wrote to memory of 2212	2924	chrome.exe	84
PID 2924 wrote to memory of 2212	2924	chrome.exe	84
PID 2924 wrote to memory of 2212	2924	chrome.exe	84
PID 2924 wrote to memory of 2212	2924	chrome.exe	84
PID 2924 wrote to memory of 2212	2924	chrome.exe	84
PID 2924 wrote to memory of 2212	2924	chrome.exe	84
PID 2924 wrote to memory of 2212	2924	chrome.exe	84
PID 2924 wrote to memory of 2212	2924	chrome.exe	84
PID 2924 wrote to memory of 2212	2924	chrome.exe	84
PID 2924 wrote to memory of 2212	2924	chrome.exe	84
PID 2924 wrote to memory of 2212	2924	chrome.exe	84
PID 2924 wrote to memory of 2212	2924	chrome.exe	84
PID 2924 wrote to memory of 2212	2924	chrome.exe	84
PID 2924 wrote to memory of 2212	2924	chrome.exe	84
PID 2924 wrote to memory of 2212	2924	chrome.exe	84
PID 2924 wrote to memory of 2212	2924	chrome.exe	84
PID 2924 wrote to memory of 2212	2924	chrome.exe	84
PID 2924 wrote to memory of 2212	2924	chrome.exe	84
PID 2924 wrote to memory of 2212	2924	chrome.exe	84
PID 2924 wrote to memory of 2212	2924	chrome.exe	84
PID 2924 wrote to memory of 2212	2924	chrome.exe	84
PID 2924 wrote to memory of 2212	2924	chrome.exe	84
PID 2924 wrote to memory of 2212	2924	chrome.exe	84
PID 2924 wrote to memory of 2212	2924	chrome.exe	84
PID 2924 wrote to memory of 2212	2924	chrome.exe	84
PID 2924 wrote to memory of 3632	2924	chrome.exe	85
PID 2924 wrote to memory of 3632	2924	chrome.exe	85
PID 2924 wrote to memory of 3104	2924	chrome.exe	86
PID 2924 wrote to memory of 3104	2924	chrome.exe	86
PID 2924 wrote to memory of 3104	2924	chrome.exe	86
PID 2924 wrote to memory of 3104	2924	chrome.exe	86
PID 2924 wrote to memory of 3104	2924	chrome.exe	86
PID 2924 wrote to memory of 3104	2924	chrome.exe	86
PID 2924 wrote to memory of 3104	2924	chrome.exe	86
PID 2924 wrote to memory of 3104	2924	chrome.exe	86
PID 2924 wrote to memory of 3104	2924	chrome.exe	86
PID 2924 wrote to memory of 3104	2924	chrome.exe	86
PID 2924 wrote to memory of 3104	2924	chrome.exe	86
PID 2924 wrote to memory of 3104	2924	chrome.exe	86
PID 2924 wrote to memory of 3104	2924	chrome.exe	86
PID 2924 wrote to memory of 3104	2924	chrome.exe	86
PID 2924 wrote to memory of 3104	2924	chrome.exe	86
PID 2924 wrote to memory of 3104	2924	chrome.exe	86
PID 2924 wrote to memory of 3104	2924	chrome.exe	86
PID 2924 wrote to memory of 3104	2924	chrome.exe	86
PID 2924 wrote to memory of 3104	2924	chrome.exe	86
PID 2924 wrote to memory of 3104	2924	chrome.exe	86
PID 2924 wrote to memory of 3104	2924	chrome.exe	86
PID 2924 wrote to memory of 3104	2924	chrome.exe	86
PID 2924 wrote to memory of 3104	2924	chrome.exe	86
PID 2924 wrote to memory of 3104	2924	chrome.exe	86
PID 2924 wrote to memory of 3104	2924	chrome.exe	86
PID 2924 wrote to memory of 3104	2924	chrome.exe	86
PID 2924 wrote to memory of 3104	2924	chrome.exe	86
PID 2924 wrote to memory of 3104	2924	chrome.exe	86
PID 2924 wrote to memory of 3104	2924	chrome.exe	86
PID 2924 wrote to memory of 3104	2924	chrome.exe	86

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/GeniAIDiscord/Solara2/blob/main/cmd.exe
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc8686cc40,0x7ffc8686cc4c,0x7ffc8686cc58
  2⤵
  PID:1168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1924,i,7710897614316541791,2548078190767621332,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1920 /prefetch:2
  2⤵
  PID:2212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2136,i,7710897614316541791,2548078190767621332,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2160 /prefetch:3
  2⤵
  PID:3632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2232,i,7710897614316541791,2548078190767621332,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2392 /prefetch:8
  2⤵
  PID:3104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3116,i,7710897614316541791,2548078190767621332,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3144 /prefetch:1
  2⤵
  PID:3016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3108,i,7710897614316541791,2548078190767621332,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3168 /prefetch:1
  2⤵
  PID:388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=4936,i,7710897614316541791,2548078190767621332,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4980 /prefetch:8
  2⤵
  PID:4428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=4952,i,7710897614316541791,2548078190767621332,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5008 /prefetch:8
  2⤵
  PID:1636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=4960,i,7710897614316541791,2548078190767621332,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:1840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=4964,i,7710897614316541791,2548078190767621332,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  PID:3324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=4996,i,7710897614316541791,2548078190767621332,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5564 /prefetch:8
  2⤵
  PID:3144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4984,i,7710897614316541791,2548078190767621332,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4948 /prefetch:8
  2⤵
  PID:3360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5600,i,7710897614316541791,2548078190767621332,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4564 /prefetch:8
  2⤵
  PID:4032
- C:\Users\Admin\Downloads\cmd.exe
  "C:\Users\Admin\Downloads\cmd.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3384
- C:\Users\Admin\Downloads\cmd.exe
  "C:\Users\Admin\Downloads\cmd.exe"
  2⤵
  - Executes dropped EXE
  PID:3908

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:4944

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
0d9a554737c844e3893a37ffce0b58a7

SHA1
4361ed59c7aef643288f74d598c6a757b8ec5b16

SHA256
cfae2e1aa477d7a8a8b3db5caea276adecdb7f5f3dd6dde58e41c16b918f1330

SHA512
9609e01e560f7eaa9ffb95fc9b6d4c25c07aa9b7a81b5832637ef4cc5b87c1fd66c664bdcbe5ecdc55ef02a0aab386902671ac9cf5d87c2ff413c54292039256

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
14f3896856daee8572339df99d7854b7

SHA1
cf71417c3b533a1c349c9db9f8ad72214eef0109

SHA256
9dc34e27a7e145e29aa905b1d1f9ca3d7047e0859dfbb0a1c42d87dc9fa85e1c

SHA512
90083d5a367e9246133b63f17cb836a7772b0d2f2c39d162263ddae7602c4ea34e3ebacf9cba3234147bc1fd3eb28cd82b32472d5e805dd70cb5ff623babae11

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
2444318a6458844f97974dfd70ff05f1

SHA1
df8b70ad3e456cb29ae9dd7324cd08536360aca2

SHA256
77a669b40e9fd4bc637c2da779b206ca711b2c8ac40a06ec0481242714b550f4

SHA512
641a7c41fa03a26e76a222288e9df754abc247cbe63b75d00a5093325b6c13aaaca18d4c493dfabd418ce95359c5d8e767581f533307e3afd0fa5b771253c40e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\17500d13-ee82-4bf7-a68d-7a0e1be340e1.tmp

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
48f89d50c74135a3996069af1ca0036e

SHA1
37650a0ba065319199f596e9cbcae08631b1017f

SHA256
1e3dea0955140e06c8dc50ae8239608aea120c8ffb6bb8b5e6b199b9ce916377

SHA512
d4fac0597a18c5034b12b5496f4d855e4a49376d3299e7e00d7dbe0b082f38d78b49d556c70598421a70321b9feed232c24a3d70927d293700a0ff064c14c02b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
fee20491a187a2b9ab08df195b2d01ec

SHA1
35e605b02c964ec3309079052d3cab33005095cf

SHA256
c6a19dbd9b076a15bf7fe2525690a6daed0162d11e77aa3092ea2770c621ab52

SHA512
78fc77662458be8c536ab9158980ed9688618deb41f29d6bb85982e38114c815ff51758b16724f39b57d1947541e464c2f86cefd8ee740ec5307ab53b2697b28

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
691d342a1163d6407cc81ed303b91004

SHA1
75ee967cc2b36bb22f837b32e97866a0f3733800

SHA256
71aaa19760d0064f5452eeaf897245b36aa7aea3b55d0f1a4d6cd351090e2131

SHA512
fcbcf586bd7a5ca24009f48c49a0496da3560041a4c00a55e3914bea9a996b491dc5c013b76deed8101917accfdc213d6aff680de2784a5a0e77d4b22e34898b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
b454ec26f58de5753b0a708daa0f5f21

SHA1
985908ddce7569e90161d07e0deafdd0d899c60a

SHA256
49013113d2aaba6e33d624a266942f34d1fc147e1d2fee1f787b72d8252384f2

SHA512
a771b4835a34aab543fd62b8b4e5057e1a36dd27de02dc50d9207934a24e84553b845afc3175426377e7aba1d3c0ae84fa10dfb8a7db6012c9ff14428a901651

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
0bd52a2a09ae5a9783e054287edd4e8f

SHA1
c799c4ee0b514175892e1de992befb99b03fd464

SHA256
00c1dccb670c39feb8a87827638ee44e13fcf0619906488041ed696ad96a251d

SHA512
38e58b509b1c2cb4b3272718340ae2f238fd21d018e3e76993d4214d00a085e21760854834a6b20d39f1e3552ee97453fdf22e17b4915ba113d5ed179e68b0d1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
6ac13ff7162570c611212cce2d463bd4

SHA1
e5da5686ef07d00ddcc4a974f6e3e3e367254138

SHA256
6f1f3a860feea7bc18637c60220d42954f14c739c18ae7e7419bf95331ba3333

SHA512
d415946feb1078874fb4894bf557bc0a54fd0db31a741a1eb5ed09a6a17cb59074ad9fd878a99b485378867389ebdded93fc82bf1f2df992d145b1bc25a5c24d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
c194c960c8f6a0aede12ebf8607d642b

SHA1
11ef9d3c2b06a3bbe3c818540647727dbd96409f

SHA256
f081fb608a8e2682166d6d666b246fb0eb85e19636762739b5c458ed1e4c9876

SHA512
a0ee467d78eb7de1bc46564228ab59efcc6aed90c00e52f7dc7276d47a0126b4e38cf2e8160c75cbcc81b18db2478e1ef9ccbf0366d3d3438b1facb9b0ea026f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
116KB

MD5
0465413622dff8f13572a4489524a5b5

SHA1
5367cc5c48cfbdf55bacfc6a7a7432cf3323de99

SHA256
9176489e12784ae863db63e64bae758349c354fa1bae652a873f6fe551704c0a

SHA512
acc8d15db1f9ace7df5a288de076e43270dc469dbc1845ec619c00f0edf7a885cfc9f5ce340af117a2bd3d97204a2fb018059c02edd872d1779a58d924cfe161

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
116KB

MD5
c83cb7f280598c76dd893bfe970ebaf1

SHA1
12fcc40355f86c8009c92e95d43b3c59b38aca5a

SHA256
9744329eaa606d175cc58b399334dd07535bf9c1319698437f65c34785e0e31c

SHA512
1cedd54e8974df02010f313c5051d06eea766bf60fb26a874631848c6c3cf187622bd0d902d009ce942a3c49276dfcf7c2f31361dee93c135d0715d191567c79

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 110686.crdownload

Filesize
67KB

MD5
7928407f9279ea20ae811608e85e9f24

SHA1
be0414ecfcda4fe76dd12c571e5c01e99a26ea57

SHA256
6b74151930702bbabe7511fb4b73ccdc543734bad541f3a5e482912c7530bdca

SHA512
9f8f3d304ccedac5705367f02ddab38c096dd65e54089eefabd21a410ba031d364c780475f8a36fcb55290d64b0a09bec83c158fd9a8e97e746f12f21572319e

Download Submit
memory/3384-194-0x00007FFC728F0000-0x00007FFC733B1000-memory.dmp

Filesize
10.8MB

Download
memory/3384-193-0x00007FFC728F0000-0x00007FFC733B1000-memory.dmp

Filesize
10.8MB

Download
memory/3384-192-0x0000000000770000-0x0000000000788000-memory.dmp

Filesize
96KB

Download
memory/3384-191-0x00007FFC728F3000-0x00007FFC728F5000-memory.dmp

Filesize
8KB

Download
memory/3908-345-0x00007FFC720A0000-0x00007FFC72B61000-memory.dmp

Filesize
10.8MB

Download
memory/3908-355-0x00007FFC720A0000-0x00007FFC72B61000-memory.dmp

Filesize
10.8MB

Download