xworm | bf2af976ce7f83d51146774607bbb9e1ea08c6962d30a22ff3a2a5bae1de41ce

Analysis

user interaction
yes
max time kernel
44s
max time network
45s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 23:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WizClient.exe
Size 30KB
Sample260930-3ytytaxtfs
SHA256 bf2af976ce7f83d51146774607bbb9e1ea08c6962d30a22ff3a2a5bae1de41ce
MD5 2b2a27a48d2ed73c68a20f77eed2476f
SHA1 e584a55f72467acd584b4a8837ec4a91b5a72c93
SHA512 a03d9df59e86c9cba11c662837ec05fd0ebdc32127fadbedaf5ad921c5f0240592cdfbe97f8672a02cf1ea0a197b1ffd626e49cf08e487c224e5b965ecef7fc5
SSDEEP 384:v2458Ytf+1mOEUehuzD2LZX01uYTE5AmRuptFlBLTIOZw/W2Zvn9Ikn1IxOqhdbD:j+1mOE1yG6u4Lm0FG9LUOqhdbD
TLSH
T17CE23B487BA88327DAFE1FF219B3910102749513D913EF9F4CD595EB6B6BAC046013EA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery xworm rat trojan

Malware Config

Extracted

Family

xworm

Mutex

ht3gM45wtfP50ILX

Attributes

install_file
USB.exe
localhost
127.0.0.1

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/2236-0-0x0000000000FC0000-0x0000000000FCE000-memory.dmp	family_xworm

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WizClient.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WizClient.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4344	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
652	chrome.exe
652	chrome.exe

Suspicious behavior: LoadsDriver 10 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
656	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
652	chrome.exe
652	chrome.exe
652	chrome.exe
652	chrome.exe

Suspicious use of AdjustPrivilegeToken 49 IoCs

description	pid	Process
Token: SeDebugPrivilege	2236	WizClient.exe
Token: SeShutdownPrivilege	652	chrome.exe
Token: SeCreatePagefilePrivilege	652	chrome.exe
Token: SeShutdownPrivilege	652	chrome.exe
Token: SeCreatePagefilePrivilege	652	chrome.exe
Token: SeShutdownPrivilege	652	chrome.exe
Token: SeCreatePagefilePrivilege	652	chrome.exe
Token: SeShutdownPrivilege	652	chrome.exe
Token: SeCreatePagefilePrivilege	652	chrome.exe
Token: SeShutdownPrivilege	652	chrome.exe
Token: SeCreatePagefilePrivilege	652	chrome.exe
Token: SeShutdownPrivilege	652	chrome.exe
Token: SeCreatePagefilePrivilege	652	chrome.exe
Token: SeShutdownPrivilege	652	chrome.exe
Token: SeCreatePagefilePrivilege	652	chrome.exe
Token: SeShutdownPrivilege	652	chrome.exe
Token: SeCreatePagefilePrivilege	652	chrome.exe
Token: SeShutdownPrivilege	652	chrome.exe
Token: SeCreatePagefilePrivilege	652	chrome.exe
Token: SeShutdownPrivilege	652	chrome.exe
Token: SeCreatePagefilePrivilege	652	chrome.exe
Token: SeShutdownPrivilege	652	chrome.exe
Token: SeCreatePagefilePrivilege	652	chrome.exe
Token: SeShutdownPrivilege	652	chrome.exe
Token: SeCreatePagefilePrivilege	652	chrome.exe
Token: SeShutdownPrivilege	652	chrome.exe
Token: SeCreatePagefilePrivilege	652	chrome.exe
Token: SeShutdownPrivilege	652	chrome.exe
Token: SeCreatePagefilePrivilege	652	chrome.exe
Token: SeShutdownPrivilege	652	chrome.exe
Token: SeCreatePagefilePrivilege	652	chrome.exe
Token: SeShutdownPrivilege	652	chrome.exe
Token: SeCreatePagefilePrivilege	652	chrome.exe
Token: SeShutdownPrivilege	652	chrome.exe
Token: SeCreatePagefilePrivilege	652	chrome.exe
Token: SeShutdownPrivilege	652	chrome.exe
Token: SeCreatePagefilePrivilege	652	chrome.exe
Token: SeShutdownPrivilege	652	chrome.exe
Token: SeCreatePagefilePrivilege	652	chrome.exe
Token: SeShutdownPrivilege	652	chrome.exe
Token: SeCreatePagefilePrivilege	652	chrome.exe
Token: SeShutdownPrivilege	652	chrome.exe
Token: SeCreatePagefilePrivilege	652	chrome.exe
Token: SeShutdownPrivilege	652	chrome.exe
Token: SeCreatePagefilePrivilege	652	chrome.exe
Token: SeShutdownPrivilege	652	chrome.exe
Token: SeCreatePagefilePrivilege	652	chrome.exe
Token: SeShutdownPrivilege	652	chrome.exe
Token: SeCreatePagefilePrivilege	652	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
652	chrome.exe
652	chrome.exe
652	chrome.exe
652	chrome.exe
652	chrome.exe
652	chrome.exe
652	chrome.exe
652	chrome.exe
652	chrome.exe
652	chrome.exe
652	chrome.exe
652	chrome.exe
652	chrome.exe
652	chrome.exe
652	chrome.exe
652	chrome.exe
652	chrome.exe
652	chrome.exe
652	chrome.exe
652	chrome.exe
652	chrome.exe
652	chrome.exe
652	chrome.exe
652	chrome.exe
652	chrome.exe
652	chrome.exe
652	chrome.exe
652	chrome.exe
652	chrome.exe
652	chrome.exe
652	chrome.exe
652	chrome.exe
652	chrome.exe
652	chrome.exe
652	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
652	chrome.exe
652	chrome.exe
652	chrome.exe
652	chrome.exe
652	chrome.exe
652	chrome.exe
652	chrome.exe
652	chrome.exe
652	chrome.exe
652	chrome.exe
652	chrome.exe
652	chrome.exe
652	chrome.exe
652	chrome.exe
652	chrome.exe
652	chrome.exe
652	chrome.exe
652	chrome.exe
652	chrome.exe
652	chrome.exe
652	chrome.exe
652	chrome.exe
652	chrome.exe
652	chrome.exe
652	chrome.exe
652	chrome.exe
652	chrome.exe
652	chrome.exe
652	chrome.exe
652	chrome.exe
652	chrome.exe
652	chrome.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 652 wrote to memory of 3060	652	chrome.exe	107
PID 652 wrote to memory of 3444	652	chrome.exe	108
PID 652 wrote to memory of 3444	652	chrome.exe	108
PID 652 wrote to memory of 4344	652	chrome.exe	109
PID 652 wrote to memory of 536	652	chrome.exe	110
PID 652 wrote to memory of 536	652	chrome.exe	110
PID 652 wrote to memory of 4264	652	chrome.exe	112
PID 652 wrote to memory of 4264	652	chrome.exe	112
PID 652 wrote to memory of 1512	652	chrome.exe	113
PID 652 wrote to memory of 1512	652	chrome.exe	113
PID 652 wrote to memory of 2740	652	chrome.exe	114
PID 652 wrote to memory of 2740	652	chrome.exe	114
PID 652 wrote to memory of 2952	652	chrome.exe	115
PID 652 wrote to memory of 2952	652	chrome.exe	115
PID 652 wrote to memory of 3048	652	chrome.exe	116

C:\Users\Admin\AppData\Local\Temp\WizClient.exe
"C:\Users\Admin\AppData\Local\Temp\WizClient.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:2236

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffaa743c728,0x7ffaa743c734,0x7ffaa743c740
  2⤵
  PID:3060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1828,i,5592653669930019604,3289683339723831113,262144 --field-trial-handle=2040,i,17693350052678658833,11121552912979101,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2032 /prefetch:2
  2⤵
  PID:3444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1656,i,9907323566534165857,9062271006221565816,524288 --field-trial-handle=2040,i,17693350052678658833,11121552912979101,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2416,i,2450681335582777136,1074125872407797389,524288 --field-trial-handle=2040,i,17693350052678658833,11121552912979101,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2600 /prefetch:8
  2⤵
  PID:536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3288,i,9526233232401855719,993467487830509175,2097152 --field-trial-handle=2040,i,17693350052678658833,11121552912979101,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:4264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3304,i,14829160753737935482,13013888790818853592,2097152 --field-trial-handle=2040,i,17693350052678658833,11121552912979101,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:1512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4508,i,16364698058730863517,7217504252792560846,2097152 --field-trial-handle=2040,i,17693350052678658833,11121552912979101,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4480 /prefetch:2
  2⤵
  PID:2740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4748,i,11152499740411890123,2827326156345122904,2097152 --field-trial-handle=2040,i,17693350052678658833,11121552912979101,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:2952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5476,i,11825990759301944311,13544219567196533714,524288 --field-trial-handle=2040,i,17693350052678658833,11121552912979101,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  PID:3048

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2148

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 c1f07c09fd75d2e3fd3434f633fc5ad29b4329981d47d3145bac0a860ec11b4e
MD5 86cd472808b96fd76afa9367b8e5afba
SHA1 aa1512abf68f3ca1aed2ebf196c685ead5888940
SHA512 d9090bd1b4664a1b999a94de2f02f7ddda4f7c16e2641e1a2361e1aff04d792ad3086cfb78ee038f8c69d4925af50beb321e9bc4d562769139b18e21f50e47f5
TLSH
T146F0F9A9DC21AC3B1CFC1B6960A41B4AF76113772651844B773D810D4FB553B464595C
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 3848c8f285f2faf2eb7be01d07dd6dc41d0a1e780f8f3140e016d2453407c30f
MD5 dc374542b56ed78481a1ad286df5a0f5
SHA1 0b0fa4edec6205d3c8b981725625034851a0dddb
SHA512 470ac83fc145c6b2dbd42d8de489295a7e2d3185faa5119adef3eac1a49d24bd60a1211f24751ad5785366396445086ce3deb1b20a90c63813e985d349c6cfd1
SSDEEP 192:7R35F6SvN728Kv7VJpAPRp2B9fHsb+WNnH/dcQc2wMkwY+VyIsnAUgtaJ:7R3jpdGvUXGhwfdcN2t428
TLSH
T10942A22EFE20793B9DDBD22AF9217653D7F6102221842E84E6F8C93C15E75CE621741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 1f54a63591e6dde1b69486f2c8df6aaa98f633d0dd8c27d42b25af96f2f70962
MD5 5cab65b9e642c268f5e70f2293b70c27
SHA1 9b7f8ea2e54c186b6be63179827f24fefd5b4203
SHA512 aaedba4547233d39a1d47ce7a59630f5cd2b806b21bbc46f0287631c30dbc811e831b70b7718e86c903808f8295a1c84b1c15b731955021a00b7e0db90e5171f
SSDEEP 384:JvjFE7KxkXqKf/pUZNCgVLH2HfgslsS7pLuLceSbWXODFs+ErU3kTHGDrUWmrgas:JbFE7KxkXqKf/pUZNCgVLH2HfgsKS7p9
TLSH
T1D8721967AC4C9E3B4F94C6CCD8167B4FADB5024B65DE886483FA982503D5ACF110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 6034756af238f61ccdb6cf7333b5316e58e6bcc05243d1b63782d82ee550157f
MD5 f09e3f5e926ec4259f6475028d116e4a
SHA1 82b91fb7ce2d5a9566dd4a302ac3df3f7fbf8a79
SHA512 23da0a9f14a859604cfeca55215101cdb52f52feabb814a28e23026699663137598e143afe5d3d6c54548f25d564c8180c051a4f53d835af6ef613ba20237f38
TLSH
T107B0124480426712C48302B0155034DC76589F18E609134741F80D86EC39271805B098
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe599fef.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe599fef.TMP
Size 96B
SHA256 65579eb1f670f49baae2a90c4fdb18830c1af8ddac52a01ceb5211a6ad35e8c6
MD5 8b910a72f85a6877b0e9cf949650aa8b
SHA1 fc96c34fd433da56e6a269712687d3fbb61fe798
SHA512 e82d064fafcd26c69bb56f0ffd4b2b58fc03598defec76eb2c98879eb7f65f733702c2e78a9e4fa325ab70334bb60d805fe9388e07977793aa37eb4db603f298
TLSH
T1F6B00255D9027217C08307B066EA99D87170EF2DE6071252D3F02EF7EC25B754666174
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 265KB
SHA256 cb209c721d62599eebfbc914582f663d432bbaf1ab324f518a1f7c7acaebb32d
MD5 0c8304a5b37d15faccffa3f571de1c85
SHA1 f20425f1d2bde9c6e7280f50d0282d85408b0353
SHA512 e0582d434b9e0758ec8a1fd8a81b7252b0209e24aba70df5bbd5ddd97e163cc4ce6c033848e7ac4ffb789762dd023d0f93769de7e528f011bda2e9f4ae61cf99
SSDEEP 6144:Ki+Dvz0p3IGzzZDTo+hFD+7t56OD9ZfSApprX:7+fM4GRPoyFSXD9ZfS4F
TLSH
T17344223629959C7784ADE050E06FB134CD28C9CF42EEAB0A84465F8AD29FC4E0757D37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 08f49ccc48c307962d0d45907cf4b15ebab0b2fc1579f1f20adc709d3e67c7a5
MD5 a0466cd0b58ff021c2e3fbfbb8ec1ca3
SHA1 1b2d3c4bea2fef303205c7b23c501dd151e37aa1
SHA512 3952612fc31e79f297c6553ec16d50e8db698c4c70d40621276a4f9f632396a33f343006a85784f46aead5fbec4154318489a6e00eb15b26cabb2ca3a103a588
SSDEEP 3072:wJE+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+g3:wS+hFD+7t56OD9ZfSAppr3
TLSH
T1D2D31232AA94C8BBC9BD6541F157A300CE626CED41DE7A09444A9F8EE09FC5D0773A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2236-0-0x0000000000FC0000-0x0000000000FCE000-memory.dmp

Download

memory/2236-4-0x0000000001790000-0x00000000017A0000-memory.dmp

Download

memory/2236-3-0x00000000018C0000-0x00000000018F5000-memory.dmp

Download

memory/2236-2-0x000000001C110000-0x000000001C212000-memory.dmp

Download

memory/2236-1-0x0000000001790000-0x00000000017A0000-memory.dmp

Download