xworm | 3933a6053d10ac2a6d87e7286adb069a4e8f8a8348166b5ddf9d70cff64162e9

Analysis

max time kernel
66s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
24-11-2024 21:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

43810.exe
Size

34KB
MD5

3325932fba61e0f8d19d87e3da22b075
SHA1

a8d06733d83de73da64ae6f8bef39a6bbbd1e2ef
SHA256

3933a6053d10ac2a6d87e7286adb069a4e8f8a8348166b5ddf9d70cff64162e9
SHA512

577524bf80a266a9c7f360560be01560248b1aa5e50d1deb5a1df9383103b5889f2f726bb05a45e9529398c52f2d63c484b76770c3db0fa32d6e695fc88c8333
SSDEEP

384:pxaXVqG28uymzhzUuHnOmYxLm9SCwvHixdTX2VR8pkFTBLTIZwYGDcvw9IkuisoW:HaXUzPi9wSC4C+V9FZ9jkOjh//kp5

Score

10^/10

xworm discovery rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

cheflilou-43810.portmap.host:43810

Mutex

ib8OKYsBW5exmPhy

Attributes

Install_directory
%AppData%
install_file
XClient.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/1780-1-0x0000000000C70000-0x0000000000C7E000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	43810.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	43810.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
1864	taskkill.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1008	chrome.exe
1008	chrome.exe

Suspicious use of AdjustPrivilegeToken 63 IoCs

description	pid	Process
Token: SeDebugPrivilege	1780	43810.exe
Token: SeShutdownPrivilege	1008	chrome.exe
Token: SeShutdownPrivilege	1008	chrome.exe
Token: SeShutdownPrivilege	1008	chrome.exe
Token: SeShutdownPrivilege	1008	chrome.exe
Token: SeShutdownPrivilege	1008	chrome.exe
Token: SeShutdownPrivilege	1008	chrome.exe
Token: SeShutdownPrivilege	1008	chrome.exe
Token: SeShutdownPrivilege	1008	chrome.exe
Token: SeShutdownPrivilege	1008	chrome.exe
Token: SeShutdownPrivilege	1008	chrome.exe
Token: SeShutdownPrivilege	1008	chrome.exe
Token: SeShutdownPrivilege	1008	chrome.exe
Token: SeShutdownPrivilege	1008	chrome.exe
Token: SeShutdownPrivilege	1008	chrome.exe
Token: SeShutdownPrivilege	1008	chrome.exe
Token: SeShutdownPrivilege	1008	chrome.exe
Token: SeShutdownPrivilege	1008	chrome.exe
Token: SeShutdownPrivilege	1008	chrome.exe
Token: SeShutdownPrivilege	1008	chrome.exe
Token: SeShutdownPrivilege	1008	chrome.exe
Token: SeShutdownPrivilege	1008	chrome.exe
Token: SeShutdownPrivilege	1008	chrome.exe
Token: SeShutdownPrivilege	1008	chrome.exe
Token: SeShutdownPrivilege	1008	chrome.exe
Token: SeShutdownPrivilege	1008	chrome.exe
Token: SeShutdownPrivilege	1008	chrome.exe
Token: SeShutdownPrivilege	1008	chrome.exe
Token: SeShutdownPrivilege	1008	chrome.exe
Token: SeShutdownPrivilege	1008	chrome.exe
Token: SeShutdownPrivilege	1008	chrome.exe
Token: SeShutdownPrivilege	1008	chrome.exe
Token: SeShutdownPrivilege	1008	chrome.exe
Token: SeShutdownPrivilege	1008	chrome.exe
Token: SeShutdownPrivilege	1008	chrome.exe
Token: SeShutdownPrivilege	1008	chrome.exe
Token: SeShutdownPrivilege	1008	chrome.exe
Token: SeShutdownPrivilege	1008	chrome.exe
Token: SeShutdownPrivilege	1008	chrome.exe
Token: SeShutdownPrivilege	1008	chrome.exe
Token: SeShutdownPrivilege	1008	chrome.exe
Token: SeShutdownPrivilege	1008	chrome.exe
Token: SeShutdownPrivilege	1008	chrome.exe
Token: SeShutdownPrivilege	1008	chrome.exe
Token: SeShutdownPrivilege	1008	chrome.exe
Token: SeShutdownPrivilege	1008	chrome.exe
Token: SeShutdownPrivilege	1008	chrome.exe
Token: SeShutdownPrivilege	1008	chrome.exe
Token: SeShutdownPrivilege	1008	chrome.exe
Token: SeShutdownPrivilege	1008	chrome.exe
Token: SeShutdownPrivilege	1008	chrome.exe
Token: SeShutdownPrivilege	1008	chrome.exe
Token: SeShutdownPrivilege	1008	chrome.exe
Token: SeShutdownPrivilege	1008	chrome.exe
Token: SeShutdownPrivilege	1008	chrome.exe
Token: SeShutdownPrivilege	1008	chrome.exe
Token: SeShutdownPrivilege	1008	chrome.exe
Token: SeShutdownPrivilege	1008	chrome.exe
Token: SeShutdownPrivilege	1008	chrome.exe
Token: SeShutdownPrivilege	1008	chrome.exe
Token: SeShutdownPrivilege	1008	chrome.exe
Token: SeShutdownPrivilege	1008	chrome.exe
Token: SeShutdownPrivilege	1008	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1008	chrome.exe
1008	chrome.exe
1008	chrome.exe
1008	chrome.exe
1008	chrome.exe
1008	chrome.exe
1008	chrome.exe
1008	chrome.exe
1008	chrome.exe
1008	chrome.exe
1008	chrome.exe
1008	chrome.exe
1008	chrome.exe
1008	chrome.exe
1008	chrome.exe
1008	chrome.exe
1008	chrome.exe
1008	chrome.exe
1008	chrome.exe
1008	chrome.exe
1008	chrome.exe
1008	chrome.exe
1008	chrome.exe
1008	chrome.exe
1008	chrome.exe
1008	chrome.exe
1008	chrome.exe
1008	chrome.exe
1008	chrome.exe
1008	chrome.exe
1008	chrome.exe
1008	chrome.exe
1008	chrome.exe
1008	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1008	chrome.exe
1008	chrome.exe
1008	chrome.exe
1008	chrome.exe
1008	chrome.exe
1008	chrome.exe
1008	chrome.exe
1008	chrome.exe
1008	chrome.exe
1008	chrome.exe
1008	chrome.exe
1008	chrome.exe
1008	chrome.exe
1008	chrome.exe
1008	chrome.exe
1008	chrome.exe
1008	chrome.exe
1008	chrome.exe
1008	chrome.exe
1008	chrome.exe
1008	chrome.exe
1008	chrome.exe
1008	chrome.exe
1008	chrome.exe
1008	chrome.exe
1008	chrome.exe
1008	chrome.exe
1008	chrome.exe
1008	chrome.exe
1008	chrome.exe
1008	chrome.exe
1008	chrome.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1640	mspaint.exe
1640	mspaint.exe
1640	mspaint.exe
1640	mspaint.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1008 wrote to memory of 1644	1008	chrome.exe	36
PID 1008 wrote to memory of 1644	1008	chrome.exe	36
PID 1008 wrote to memory of 1644	1008	chrome.exe	36
PID 1008 wrote to memory of 1260	1008	chrome.exe	37
PID 1008 wrote to memory of 1260	1008	chrome.exe	37
PID 1008 wrote to memory of 1260	1008	chrome.exe	37
PID 1008 wrote to memory of 1260	1008	chrome.exe	37
PID 1008 wrote to memory of 1260	1008	chrome.exe	37
PID 1008 wrote to memory of 1260	1008	chrome.exe	37
PID 1008 wrote to memory of 1260	1008	chrome.exe	37
PID 1008 wrote to memory of 1260	1008	chrome.exe	37
PID 1008 wrote to memory of 1260	1008	chrome.exe	37
PID 1008 wrote to memory of 1260	1008	chrome.exe	37
PID 1008 wrote to memory of 1260	1008	chrome.exe	37
PID 1008 wrote to memory of 1260	1008	chrome.exe	37
PID 1008 wrote to memory of 1260	1008	chrome.exe	37
PID 1008 wrote to memory of 1260	1008	chrome.exe	37
PID 1008 wrote to memory of 1260	1008	chrome.exe	37
PID 1008 wrote to memory of 1260	1008	chrome.exe	37
PID 1008 wrote to memory of 1260	1008	chrome.exe	37
PID 1008 wrote to memory of 1260	1008	chrome.exe	37
PID 1008 wrote to memory of 1260	1008	chrome.exe	37
PID 1008 wrote to memory of 1260	1008	chrome.exe	37
PID 1008 wrote to memory of 1260	1008	chrome.exe	37
PID 1008 wrote to memory of 1260	1008	chrome.exe	37
PID 1008 wrote to memory of 1260	1008	chrome.exe	37
PID 1008 wrote to memory of 1260	1008	chrome.exe	37
PID 1008 wrote to memory of 1260	1008	chrome.exe	37
PID 1008 wrote to memory of 1260	1008	chrome.exe	37
PID 1008 wrote to memory of 1260	1008	chrome.exe	37
PID 1008 wrote to memory of 1260	1008	chrome.exe	37
PID 1008 wrote to memory of 1260	1008	chrome.exe	37
PID 1008 wrote to memory of 1260	1008	chrome.exe	37
PID 1008 wrote to memory of 1260	1008	chrome.exe	37
PID 1008 wrote to memory of 1260	1008	chrome.exe	37
PID 1008 wrote to memory of 1260	1008	chrome.exe	37
PID 1008 wrote to memory of 1260	1008	chrome.exe	37
PID 1008 wrote to memory of 1260	1008	chrome.exe	37
PID 1008 wrote to memory of 1260	1008	chrome.exe	37
PID 1008 wrote to memory of 1260	1008	chrome.exe	37
PID 1008 wrote to memory of 1260	1008	chrome.exe	37
PID 1008 wrote to memory of 1260	1008	chrome.exe	37
PID 1008 wrote to memory of 2300	1008	chrome.exe	38
PID 1008 wrote to memory of 2300	1008	chrome.exe	38
PID 1008 wrote to memory of 2300	1008	chrome.exe	38
PID 1008 wrote to memory of 2044	1008	chrome.exe	39
PID 1008 wrote to memory of 2044	1008	chrome.exe	39
PID 1008 wrote to memory of 2044	1008	chrome.exe	39
PID 1008 wrote to memory of 2044	1008	chrome.exe	39
PID 1008 wrote to memory of 2044	1008	chrome.exe	39
PID 1008 wrote to memory of 2044	1008	chrome.exe	39
PID 1008 wrote to memory of 2044	1008	chrome.exe	39
PID 1008 wrote to memory of 2044	1008	chrome.exe	39
PID 1008 wrote to memory of 2044	1008	chrome.exe	39
PID 1008 wrote to memory of 2044	1008	chrome.exe	39
PID 1008 wrote to memory of 2044	1008	chrome.exe	39
PID 1008 wrote to memory of 2044	1008	chrome.exe	39
PID 1008 wrote to memory of 2044	1008	chrome.exe	39
PID 1008 wrote to memory of 2044	1008	chrome.exe	39
PID 1008 wrote to memory of 2044	1008	chrome.exe	39
PID 1008 wrote to memory of 2044	1008	chrome.exe	39
PID 1008 wrote to memory of 2044	1008	chrome.exe	39
PID 1008 wrote to memory of 2044	1008	chrome.exe	39
PID 1008 wrote to memory of 2044	1008	chrome.exe	39

C:\Users\Admin\AppData\Local\Temp\43810.exe
"C:\Users\Admin\AppData\Local\Temp\43810.exe"
1⤵
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
PID:1780
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM explorer.exe
  2⤵
  - Kills process with taskkill
  PID:1864

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" /p "C:\Users\Admin\Downloads\BlockUnblock.rle"
1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1640

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:1684

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7feeecf9758,0x7feeecf9768,0x7feeecf9778
  2⤵
  PID:1644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1116 --field-trial-handle=1320,i,16123489664540193929,7387532731451762074,131072 /prefetch:2
  2⤵
  PID:1260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1524 --field-trial-handle=1320,i,16123489664540193929,7387532731451762074,131072 /prefetch:8
  2⤵
  PID:2300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1628 --field-trial-handle=1320,i,16123489664540193929,7387532731451762074,131072 /prefetch:8
  2⤵
  PID:2044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2328 --field-trial-handle=1320,i,16123489664540193929,7387532731451762074,131072 /prefetch:1
  2⤵
  PID:1364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2348 --field-trial-handle=1320,i,16123489664540193929,7387532731451762074,131072 /prefetch:1
  2⤵
  PID:1520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1592 --field-trial-handle=1320,i,16123489664540193929,7387532731451762074,131072 /prefetch:2
  2⤵
  PID:2352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1464 --field-trial-handle=1320,i,16123489664540193929,7387532731451762074,131072 /prefetch:1
  2⤵
  PID:1716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3692 --field-trial-handle=1320,i,16123489664540193929,7387532731451762074,131072 /prefetch:8
  2⤵
  PID:2484
- C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
  "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe" --reenable-autoupdates --system-level
  2⤵
  PID:2096
- - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x154,0x158,0x15c,0x128,0x160,0x13fc87688,0x13fc87698,0x13fc876a8
    3⤵
    PID:572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3864 --field-trial-handle=1320,i,16123489664540193929,7387532731451762074,131072 /prefetch:1
  2⤵
  PID:2164

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000a

Filesize
215KB

MD5
2be38925751dc3580e84c3af3a87f98d

SHA1
8a390d24e6588bef5da1d3db713784c11ca58921

SHA256
1412046f2516b688d644ff26b6c7ef2275b6c8f132eb809bd32e118208a4ec1b

SHA512
1341ffc84f16c1247eb0e9baacd26a70c6b9ee904bc2861e55b092263613c0f09072efd174b3e649a347ef3192ae92d7807cc4f5782f8fd07389703d75c4c4e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
432B

MD5
06e80601948463c7bec4f3b93e47e6a3

SHA1
791fa3fa2ff11d5a7fd85a85fa69a279a1d2ce98

SHA256
042d78af14c180699448c70771771f92b494e1aa55d44d655f79665b509901d3

SHA512
513df97673ce800cf8cd3fd7266508ca5e19c5c7a847a19ceb97c33a6f0b897784e80c3526aeba9ee910bdd52bbd01710b095633244749d6c8aea492dd1f01ff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
363B

MD5
52a3fc28a26a524c86e0131868f4f21f

SHA1
86ca9249d4d3babb27b8cd6d6f06e46987aee5b2

SHA256
085b1abcab028ac397bf8696b094879b6628265f13f2a27aab70da1fca58ccc1

SHA512
6febb5c64a32c131843671718fc89695b82f0ab624a30b9ec2f1c8a914f7bd13054aae49c65663324b46ed33511faf042cef36dc05d76bf255ebadc839fe60ac

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
ddb9128ce9f82b6e494a2afd337d03f1

SHA1
1136a6f6fc651de5e8d6d2c4123a211117f44eef

SHA256
f4f58d985e306e3da7343784eb90c4989d7569f15e2f2a0b9d49e0d671307b56

SHA512
c4cfec0ba483bc2d43f82a600a34de14f85a85b4c81bbf959602f32d2af5d150423eaefcfc012317e6ab876f3795f436a2264941618a301d1e78e111206ae556

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
a0a07994f2de3e7afcf4328671e36d2b

SHA1
506afda1faa0b74e0ff7235c2d0b2a96ad752097

SHA256
11f746520c8754eb73c8a11131400d58db78b43f4286920ad3121f9bdc20ebab

SHA512
e62cea2058f50e758770048b8f34c87c965d0818724f684cd49a65a911bf7392378c80a258586b946ed04edb768abad54ec79d0325c31fe187b84027eef5ae82

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
memory/1640-8-0x000007FEEF6F0000-0x000007FEEF73C000-memory.dmp

Filesize
304KB

Download
memory/1640-10-0x000007FEEF6F0000-0x000007FEEF73C000-memory.dmp

Filesize
304KB

Download
memory/1640-9-0x0000000001EF0000-0x0000000001EF1000-memory.dmp

Filesize
4KB

Download
memory/1780-0-0x000007FEF57E3000-0x000007FEF57E4000-memory.dmp

Filesize
4KB

Download
memory/1780-153-0x0000000002190000-0x000000000219C000-memory.dmp

Filesize
48KB

Download
memory/1780-7-0x000007FEF57E0000-0x000007FEF61CC000-memory.dmp

Filesize
9.9MB

Download
memory/1780-6-0x000007FEF57E0000-0x000007FEF61CC000-memory.dmp

Filesize
9.9MB

Download
memory/1780-179-0x000000001A7E0000-0x000000001A7EC000-memory.dmp

Filesize
48KB

Download
memory/1780-1-0x0000000000C70000-0x0000000000C7E000-memory.dmp

Filesize
56KB

Download
memory/1780-191-0x000000001A7F0000-0x000000001A7FA000-memory.dmp

Filesize
40KB

Download
memory/1780-192-0x000000001A8C0000-0x000000001A8CA000-memory.dmp

Filesize
40KB

Download