discordrat | 2f294b7dd8df80c19dcf8e338049f55787492e70e39eca8f8dc731b3c6addc83

Resubmissions

11/01/2025, 03:20

250111-dvq1ba1mey 10

28/12/2024, 14:10

28/12/2024, 14:06

17/12/2024, 17:57

04/12/2024, 11:26

04/12/2024, 11:05

Analysis

max time kernel
248s
max time network
535s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
04/12/2024, 11:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

badassfuckingtien.exe
Size

840KB
MD5

264db47eec711ef618870219832e5dfe
SHA1

116d2ff601d6640d3fe24fb67492ca2c82d9bbd9
SHA256

5c8b1d9c70780e1e669b4b34b0e190f6a691b8ada42179e248513feafe5b9ee5
SHA512

1672cbd9273987fd2d3cb1f843e2e28bb4c107913e0d1562ce6cdd7a403ba40e1bdd05647f3d89b0b00a8dff8328c9fad342f1b771ee391990db6d4855d8ad56
SSDEEP

24576:9uDXTIGaPhEYzUzA0q5VR0cNnns+UrZtb5jpXw86qh:gDjlabwz9iVR0WnQZ5xpA86qh

Score

10^/10

discordrat discovery persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTMxMzYwMzQzNTY5MzYwOTEwMg.G0k280.tlujv7Qu1u6uHZMDdDCuyzSTaLQITkGmfU0u3s
server_id
1312325986385264681

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Executes dropped EXE 1 IoCs

pid	Process
2820	backdoor.exe

Loads dropped DLL 6 IoCs

pid	Process
1300	badassfuckingtien.exe
2956	WerFault.exe
2956	WerFault.exe
2956	WerFault.exe
2956	WerFault.exe
2956	WerFault.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1300 wrote to memory of 2820	1300	badassfuckingtien.exe	31
PID 1300 wrote to memory of 2820	1300	badassfuckingtien.exe	31
PID 1300 wrote to memory of 2820	1300	badassfuckingtien.exe	31
PID 2820 wrote to memory of 2956	2820	backdoor.exe	32
PID 2820 wrote to memory of 2956	2820	backdoor.exe	32
PID 2820 wrote to memory of 2956	2820	backdoor.exe	32
PID 2628 wrote to memory of 2640	2628	chrome.exe	35
PID 2628 wrote to memory of 2640	2628	chrome.exe	35
PID 2628 wrote to memory of 2640	2628	chrome.exe	35
PID 2628 wrote to memory of 2892	2628	chrome.exe	37
PID 2628 wrote to memory of 2892	2628	chrome.exe	37
PID 2628 wrote to memory of 2892	2628	chrome.exe	37
PID 2628 wrote to memory of 2892	2628	chrome.exe	37
PID 2628 wrote to memory of 2892	2628	chrome.exe	37
PID 2628 wrote to memory of 2892	2628	chrome.exe	37
PID 2628 wrote to memory of 2892	2628	chrome.exe	37
PID 2628 wrote to memory of 2892	2628	chrome.exe	37
PID 2628 wrote to memory of 2892	2628	chrome.exe	37
PID 2628 wrote to memory of 2892	2628	chrome.exe	37
PID 2628 wrote to memory of 2892	2628	chrome.exe	37
PID 2628 wrote to memory of 2892	2628	chrome.exe	37
PID 2628 wrote to memory of 2892	2628	chrome.exe	37
PID 2628 wrote to memory of 2892	2628	chrome.exe	37
PID 2628 wrote to memory of 2892	2628	chrome.exe	37
PID 2628 wrote to memory of 2892	2628	chrome.exe	37
PID 2628 wrote to memory of 2892	2628	chrome.exe	37
PID 2628 wrote to memory of 2892	2628	chrome.exe	37
PID 2628 wrote to memory of 2892	2628	chrome.exe	37
PID 2628 wrote to memory of 2892	2628	chrome.exe	37
PID 2628 wrote to memory of 2892	2628	chrome.exe	37
PID 2628 wrote to memory of 2892	2628	chrome.exe	37
PID 2628 wrote to memory of 2892	2628	chrome.exe	37
PID 2628 wrote to memory of 2892	2628	chrome.exe	37
PID 2628 wrote to memory of 2892	2628	chrome.exe	37
PID 2628 wrote to memory of 2892	2628	chrome.exe	37
PID 2628 wrote to memory of 2892	2628	chrome.exe	37
PID 2628 wrote to memory of 2892	2628	chrome.exe	37
PID 2628 wrote to memory of 2892	2628	chrome.exe	37
PID 2628 wrote to memory of 2892	2628	chrome.exe	37
PID 2628 wrote to memory of 2892	2628	chrome.exe	37
PID 2628 wrote to memory of 2892	2628	chrome.exe	37
PID 2628 wrote to memory of 2892	2628	chrome.exe	37
PID 2628 wrote to memory of 2892	2628	chrome.exe	37
PID 2628 wrote to memory of 2892	2628	chrome.exe	37
PID 2628 wrote to memory of 2892	2628	chrome.exe	37
PID 2628 wrote to memory of 2892	2628	chrome.exe	37
PID 2628 wrote to memory of 2892	2628	chrome.exe	37
PID 2628 wrote to memory of 2892	2628	chrome.exe	37
PID 2628 wrote to memory of 2896	2628	chrome.exe	38
PID 2628 wrote to memory of 2896	2628	chrome.exe	38
PID 2628 wrote to memory of 2896	2628	chrome.exe	38
PID 2628 wrote to memory of 2964	2628	chrome.exe	39
PID 2628 wrote to memory of 2964	2628	chrome.exe	39
PID 2628 wrote to memory of 2964	2628	chrome.exe	39
PID 2628 wrote to memory of 2964	2628	chrome.exe	39
PID 2628 wrote to memory of 2964	2628	chrome.exe	39
PID 2628 wrote to memory of 2964	2628	chrome.exe	39
PID 2628 wrote to memory of 2964	2628	chrome.exe	39
PID 2628 wrote to memory of 2964	2628	chrome.exe	39
PID 2628 wrote to memory of 2964	2628	chrome.exe	39
PID 2628 wrote to memory of 2964	2628	chrome.exe	39
PID 2628 wrote to memory of 2964	2628	chrome.exe	39
PID 2628 wrote to memory of 2964	2628	chrome.exe	39
PID 2628 wrote to memory of 2964	2628	chrome.exe	39

C:\Users\Admin\AppData\Local\Temp\badassfuckingtien.exe
"C:\Users\Admin\AppData\Local\Temp\badassfuckingtien.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1300
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\backdoor.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\backdoor.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2820
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 2820 -s 596
    3⤵
    - Loads dropped DLL
    PID:2956

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7feef7b9758,0x7feef7b9768,0x7feef7b9778
  2⤵
  PID:2640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1152 --field-trial-handle=1248,i,6239911705511264548,4702296701956696316,131072 /prefetch:2
  2⤵
  PID:2892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1532 --field-trial-handle=1248,i,6239911705511264548,4702296701956696316,131072 /prefetch:8
  2⤵
  PID:2896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1632 --field-trial-handle=1248,i,6239911705511264548,4702296701956696316,131072 /prefetch:8
  2⤵
  PID:2964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=1588 --field-trial-handle=1248,i,6239911705511264548,4702296701956696316,131072 /prefetch:1
  2⤵
  PID:3056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2172 --field-trial-handle=1248,i,6239911705511264548,4702296701956696316,131072 /prefetch:1
  2⤵
  PID:2032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1500 --field-trial-handle=1248,i,6239911705511264548,4702296701956696316,131072 /prefetch:2
  2⤵
  PID:2088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1316 --field-trial-handle=1248,i,6239911705511264548,4702296701956696316,131072 /prefetch:1
  2⤵
  PID:2372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3620 --field-trial-handle=1248,i,6239911705511264548,4702296701956696316,131072 /prefetch:8
  2⤵
  PID:2096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3748 --field-trial-handle=1248,i,6239911705511264548,4702296701956696316,131072 /prefetch:1
  2⤵
  PID:2940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3284 --field-trial-handle=1248,i,6239911705511264548,4702296701956696316,131072 /prefetch:1
  2⤵
  PID:2744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3336 --field-trial-handle=1248,i,6239911705511264548,4702296701956696316,131072 /prefetch:1
  2⤵
  PID:2660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=3844 --field-trial-handle=1248,i,6239911705511264548,4702296701956696316,131072 /prefetch:1
  2⤵
  PID:2540

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
720B

MD5
9bce803999fa19b59bf09fc55e63624d

SHA1
d82f4d3b019fac210bccdb2eb1c7e48df384ceb4

SHA256
6885e40cb865affcaeb55e27e5d18f7897c2b7b2e728a93c6c730f0d3d4f2486

SHA512
5eff7dfcccd913a7ccd51ecb775d1578cea5939ee9beee4c7a72487bfa56ae63fae7ee6ce8b5353bc61b7ebe454d6e6bf646008c140ee9cf0c4cf08d8637b477

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
d566646db914954ea84157622205f985

SHA1
ea04678ee871e3ed1a1656fcac8c0d9ef136d126

SHA256
398cb2f3cce63e9be21971ddce44a0bdbee79e41cd8a579ff104059daa82e994

SHA512
64b8163e90914a63b50734257f95ed2d5b395919e69557e81ffe3f206d9eedf235095c4bca94e52df294f94d2c534bece051bd8cc90a3a38702d51fbfeb24cbb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
056b9e30286dccca28bbfbc6cb6d5290

SHA1
0fc54827baaeccb56d3b79cc9f86d9aaee559719

SHA256
f82aca142e9333cc718ec0bc554f29f7912b118594967b5d271e0efd444c6cbe

SHA512
08df9c4feff4c82c7574c37d2dfdaf02f016d3db9e07f57cc1813894c9b4915350a9153591ea057ca95db56f383749e1e315c164eaddbe0c3bf056097aa076fc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
cad4abfc27e8b85954ce227c5828d60e

SHA1
d4b1d652e598f8c115eab915f12e018eccf34ad6

SHA256
ef65eba243dde4230d79c89986a929e1dc31ce61b2b383dbed74128d627ffae3

SHA512
4c764d755f18499c407f807f7b5195db350ec2df38c4c12d5601657c1a74e29f100ae90bd6fd47aef05c0544f94823fa4af771ae0bc02016dfd2da817fff7cc3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
363B

MD5
733684b73d22755e401789fb207b38ee

SHA1
b6fc49c2ffb220c6109d3e044ad68656eb41dcee

SHA256
6759288263a197cf7ac40e03aaf3b4cd9b64093d3fa3f8b5951a10b2276d118f

SHA512
18ba943bb4261a82a2fb9d613c8f85aef7dbdf7be8363c7ec52ca641d0137df5c42bafe80e3162ce53f788ecf4285ff0d4954c5e676a772858a963870e6aadfb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
e1d32c41aebe1bafc615abc4c88e87c6

SHA1
bbc8a9b3c62baf7cc1fba3185e5113a136b2dff0

SHA256
9d516727e6c86e88919d482fde83d9868c6f6457c7c0fe0e2b884c7eb9c74dd6

SHA512
1b311cfc2b25eb67ecb6dc65c65b202e93313ab91119588bc42af58cd657bf9f485f485a7adf8859bc33b99d3b683d598a4472272c34d572d87dd2754c74b8d1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
87201a247c66a4e37025c4f0c8e8b550

SHA1
4d43cbbb89c2838356d6692fbf9e2dfcc293ad71

SHA256
5628eddbd709108533d6c2ede2e9ca1459e40aa5b7a47d13a52b849858af5a9e

SHA512
499ed4c3648ab47cd53ff861bf8939e315205d321e6f2e103494e85f2b6c0f2620ab9849e2a9bfcfba81d53dbc7946fd218b049c4894ad54c8c7b1eae44e4975

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
4e10c77342fd8aa3c52eed944e6ffe2f

SHA1
d141f433ca1ebdb6a88cf7b72827c625c01dd0dd

SHA256
beb0e55691ea2fbf616e4c0cbc2898a77a750860bc0850e7d203280b28f95519

SHA512
7e1d1023d49b8273480546aa0381a8e781d66a2480001121c5f535aa64edd3f017b48b8746bf2642300fba8569b2a8e276c4f6477633fe9ca01a99b4161ea34b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\backdoor.exe

Filesize
78KB

MD5
83584a62c33baae3be8b48c32ae4acb6

SHA1
9bb68ea8bb9f2c2e54d9a0efff4a66a512ac90b5

SHA256
56bc5859994282eb5b672c9b27c2ef7cad232af34c9033077a949b04d6c55c58

SHA512
554caabadea24ad0c2f0e1c55632d76b12e2f19ce506f5dffa39f841e35d263bffb001e2f6ebab043070794f97f988802e3db086092e28f262b36569ed8c7d79

Download Submit
memory/1300-6-0x0000000002280000-0x0000000002290000-memory.dmp

Filesize
64KB

Download
memory/2820-69-0x000007FEF4D90000-0x000007FEF577C000-memory.dmp

Filesize
9.9MB

Download
memory/2820-21-0x000007FEF4D93000-0x000007FEF4D94000-memory.dmp

Filesize
4KB

Download
memory/2820-19-0x000007FEF4D90000-0x000007FEF577C000-memory.dmp

Filesize
9.9MB

Download
memory/2820-14-0x000000013F080000-0x000000013F098000-memory.dmp

Filesize
96KB

Download
memory/2820-13-0x000007FEF4D93000-0x000007FEF4D94000-memory.dmp

Filesize
4KB

Download