xworm | 99bf031f23b1759702a56ccfc9425f0a063654dcc4a94d8feeb89792c82f3082

Analysis

max time kernel
140s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/07/2024, 13:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fix.exe
Size 35KB
Sample240701-qjyl8stdna
SHA256 99bf031f23b1759702a56ccfc9425f0a063654dcc4a94d8feeb89792c82f3082
MD5 83bbe29b99a54bad48074efb72ce1fcc
SHA1 421deeba13130a8eebacc8c7f48f28e6fe8485f2
SHA512 67fe2ac907c297cd3c4d1af7f80257b468bc4e73cab428568ea1238d41cd8c43262765a0b0d43b2accb003901a66e9e7ec162fefda2fd89040697e1e168ac27f
SSDEEP 768:ChiLce92aOrsQiUy5FyS9ZL6LOjhibold:ChkceWsQi5FT9ZL6LOjGo7
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

20.ip.gl.ply.gg:53765

Mutex

JCfj6Aifpywc6Ul9

Attributes

Install_directory
%AppData%
install_file
svchost.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/4648-1-0x0000000000D80000-0x0000000000D90000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2044	powershell.exe
1044	powershell.exe
2372	powershell.exe
3268	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	fix.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe"	fix.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133643135111074079"	chrome.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3268	powershell.exe
3268	powershell.exe
2044	powershell.exe
2044	powershell.exe
1044	powershell.exe
1044	powershell.exe
2372	powershell.exe
2372	powershell.exe
1732	chrome.exe
1732	chrome.exe
2876	chrome.exe
2876	chrome.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
1732	chrome.exe
1732	chrome.exe
1732	chrome.exe
1732	chrome.exe
1732	chrome.exe
1732	chrome.exe
1732	chrome.exe
1732	chrome.exe
1732	chrome.exe
1732	chrome.exe
1732	chrome.exe
1732	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe

Suspicious use of AdjustPrivilegeToken 60 IoCs

description	pid	Process
Token: SeDebugPrivilege	4648	fix.exe
Token: SeDebugPrivilege	3268	powershell.exe
Token: SeDebugPrivilege	2044	powershell.exe
Token: SeDebugPrivilege	1044	powershell.exe
Token: SeDebugPrivilege	2372	powershell.exe
Token: SeDebugPrivilege	4648	fix.exe
Token: SeShutdownPrivilege	1732	chrome.exe
Token: SeCreatePagefilePrivilege	1732	chrome.exe
Token: SeShutdownPrivilege	1732	chrome.exe
Token: SeCreatePagefilePrivilege	1732	chrome.exe
Token: SeShutdownPrivilege	1732	chrome.exe
Token: SeCreatePagefilePrivilege	1732	chrome.exe
Token: SeShutdownPrivilege	1732	chrome.exe
Token: SeCreatePagefilePrivilege	1732	chrome.exe
Token: SeShutdownPrivilege	1732	chrome.exe
Token: SeCreatePagefilePrivilege	1732	chrome.exe
Token: SeShutdownPrivilege	1732	chrome.exe
Token: SeCreatePagefilePrivilege	1732	chrome.exe
Token: SeShutdownPrivilege	1732	chrome.exe
Token: SeCreatePagefilePrivilege	1732	chrome.exe
Token: SeShutdownPrivilege	1732	chrome.exe
Token: SeCreatePagefilePrivilege	1732	chrome.exe
Token: SeShutdownPrivilege	1732	chrome.exe
Token: SeCreatePagefilePrivilege	1732	chrome.exe
Token: SeShutdownPrivilege	1732	chrome.exe
Token: SeCreatePagefilePrivilege	1732	chrome.exe
Token: SeShutdownPrivilege	1732	chrome.exe
Token: SeCreatePagefilePrivilege	1732	chrome.exe
Token: SeShutdownPrivilege	1732	chrome.exe
Token: SeCreatePagefilePrivilege	1732	chrome.exe
Token: SeShutdownPrivilege	1732	chrome.exe
Token: SeCreatePagefilePrivilege	1732	chrome.exe
Token: SeShutdownPrivilege	1732	chrome.exe
Token: SeCreatePagefilePrivilege	1732	chrome.exe
Token: SeShutdownPrivilege	1732	chrome.exe
Token: SeCreatePagefilePrivilege	1732	chrome.exe
Token: SeShutdownPrivilege	1732	chrome.exe
Token: SeCreatePagefilePrivilege	1732	chrome.exe
Token: SeShutdownPrivilege	1732	chrome.exe
Token: SeCreatePagefilePrivilege	1732	chrome.exe
Token: SeShutdownPrivilege	1732	chrome.exe
Token: SeCreatePagefilePrivilege	1732	chrome.exe
Token: SeShutdownPrivilege	1732	chrome.exe
Token: SeCreatePagefilePrivilege	1732	chrome.exe
Token: SeShutdownPrivilege	1732	chrome.exe
Token: SeCreatePagefilePrivilege	1732	chrome.exe
Token: SeShutdownPrivilege	1732	chrome.exe
Token: SeCreatePagefilePrivilege	1732	chrome.exe
Token: SeShutdownPrivilege	1732	chrome.exe
Token: SeCreatePagefilePrivilege	1732	chrome.exe
Token: SeShutdownPrivilege	1732	chrome.exe
Token: SeCreatePagefilePrivilege	1732	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeCreatePagefilePrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeCreatePagefilePrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeCreatePagefilePrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeCreatePagefilePrivilege	2876	chrome.exe

Suspicious use of FindShellTrayWindow 54 IoCs

pid	Process
1732	chrome.exe
1732	chrome.exe
1732	chrome.exe
1732	chrome.exe
1732	chrome.exe
1732	chrome.exe
1732	chrome.exe
1732	chrome.exe
1732	chrome.exe
1732	chrome.exe
1732	chrome.exe
1732	chrome.exe
1732	chrome.exe
1732	chrome.exe
1732	chrome.exe
1732	chrome.exe
1732	chrome.exe
1732	chrome.exe
1732	chrome.exe
1732	chrome.exe
1732	chrome.exe
1732	chrome.exe
1732	chrome.exe
1732	chrome.exe
1732	chrome.exe
1732	chrome.exe
1732	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
1732	chrome.exe
1732	chrome.exe
1732	chrome.exe
1732	chrome.exe
1732	chrome.exe
1732	chrome.exe
1732	chrome.exe
1732	chrome.exe
1732	chrome.exe
1732	chrome.exe
1732	chrome.exe
1732	chrome.exe
1732	chrome.exe
1732	chrome.exe
1732	chrome.exe
1732	chrome.exe
1732	chrome.exe
1732	chrome.exe
1732	chrome.exe
1732	chrome.exe
1732	chrome.exe
1732	chrome.exe
1732	chrome.exe
1732	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 3268	4648	fix.exe	81
PID 4648 wrote to memory of 3268	4648	fix.exe	81
PID 4648 wrote to memory of 2044	4648	fix.exe	83
PID 4648 wrote to memory of 2044	4648	fix.exe	83
PID 4648 wrote to memory of 1044	4648	fix.exe	85
PID 4648 wrote to memory of 1044	4648	fix.exe	85
PID 4648 wrote to memory of 2372	4648	fix.exe	87
PID 4648 wrote to memory of 2372	4648	fix.exe	87
PID 1732 wrote to memory of 1992	1732	chrome.exe	92
PID 1732 wrote to memory of 1992	1732	chrome.exe	92
PID 1732 wrote to memory of 948	1732	chrome.exe	93
PID 1732 wrote to memory of 948	1732	chrome.exe	93
PID 1732 wrote to memory of 948	1732	chrome.exe	93
PID 1732 wrote to memory of 948	1732	chrome.exe	93
PID 1732 wrote to memory of 948	1732	chrome.exe	93
PID 1732 wrote to memory of 948	1732	chrome.exe	93
PID 1732 wrote to memory of 948	1732	chrome.exe	93
PID 1732 wrote to memory of 948	1732	chrome.exe	93
PID 1732 wrote to memory of 948	1732	chrome.exe	93
PID 1732 wrote to memory of 948	1732	chrome.exe	93
PID 1732 wrote to memory of 948	1732	chrome.exe	93
PID 1732 wrote to memory of 948	1732	chrome.exe	93
PID 1732 wrote to memory of 948	1732	chrome.exe	93
PID 1732 wrote to memory of 948	1732	chrome.exe	93
PID 1732 wrote to memory of 948	1732	chrome.exe	93
PID 1732 wrote to memory of 948	1732	chrome.exe	93
PID 1732 wrote to memory of 948	1732	chrome.exe	93
PID 1732 wrote to memory of 948	1732	chrome.exe	93
PID 1732 wrote to memory of 948	1732	chrome.exe	93
PID 1732 wrote to memory of 948	1732	chrome.exe	93
PID 1732 wrote to memory of 948	1732	chrome.exe	93
PID 1732 wrote to memory of 948	1732	chrome.exe	93
PID 1732 wrote to memory of 948	1732	chrome.exe	93
PID 1732 wrote to memory of 948	1732	chrome.exe	93
PID 1732 wrote to memory of 948	1732	chrome.exe	93
PID 1732 wrote to memory of 948	1732	chrome.exe	93
PID 1732 wrote to memory of 948	1732	chrome.exe	93
PID 1732 wrote to memory of 948	1732	chrome.exe	93
PID 1732 wrote to memory of 948	1732	chrome.exe	93
PID 1732 wrote to memory of 948	1732	chrome.exe	93
PID 1732 wrote to memory of 948	1732	chrome.exe	93
PID 1732 wrote to memory of 964	1732	chrome.exe	94
PID 1732 wrote to memory of 964	1732	chrome.exe	94
PID 1732 wrote to memory of 3112	1732	chrome.exe	95
PID 1732 wrote to memory of 3112	1732	chrome.exe	95
PID 1732 wrote to memory of 3112	1732	chrome.exe	95
PID 1732 wrote to memory of 3112	1732	chrome.exe	95
PID 1732 wrote to memory of 3112	1732	chrome.exe	95
PID 1732 wrote to memory of 3112	1732	chrome.exe	95
PID 1732 wrote to memory of 3112	1732	chrome.exe	95
PID 1732 wrote to memory of 3112	1732	chrome.exe	95
PID 1732 wrote to memory of 3112	1732	chrome.exe	95
PID 1732 wrote to memory of 3112	1732	chrome.exe	95
PID 1732 wrote to memory of 3112	1732	chrome.exe	95
PID 1732 wrote to memory of 3112	1732	chrome.exe	95
PID 1732 wrote to memory of 3112	1732	chrome.exe	95
PID 1732 wrote to memory of 3112	1732	chrome.exe	95
PID 1732 wrote to memory of 3112	1732	chrome.exe	95
PID 1732 wrote to memory of 3112	1732	chrome.exe	95
PID 1732 wrote to memory of 3112	1732	chrome.exe	95
PID 1732 wrote to memory of 3112	1732	chrome.exe	95
PID 1732 wrote to memory of 3112	1732	chrome.exe	95
PID 1732 wrote to memory of 3112	1732	chrome.exe	95
PID 1732 wrote to memory of 3112	1732	chrome.exe	95

C:\Users\Admin\AppData\Local\Temp\fix.exe
"C:\Users\Admin\AppData\Local\Temp\fix.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\fix.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3268
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'fix.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2044
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svchost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1044
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2372

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8ebb6ab58,0x7ff8ebb6ab68,0x7ff8ebb6ab78
  2⤵
  PID:1992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1728 --field-trial-handle=1908,i,7825806172332991054,2263165797126221756,131072 /prefetch:2
  2⤵
  PID:948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2020 --field-trial-handle=1908,i,7825806172332991054,2263165797126221756,131072 /prefetch:8
  2⤵
  PID:964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2256 --field-trial-handle=1908,i,7825806172332991054,2263165797126221756,131072 /prefetch:8
  2⤵
  PID:3112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3036 --field-trial-handle=1908,i,7825806172332991054,2263165797126221756,131072 /prefetch:1
  2⤵
  PID:2196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3044 --field-trial-handle=1908,i,7825806172332991054,2263165797126221756,131072 /prefetch:1
  2⤵
  PID:4884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4312 --field-trial-handle=1908,i,7825806172332991054,2263165797126221756,131072 /prefetch:1
  2⤵
  PID:1968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4432 --field-trial-handle=1908,i,7825806172332991054,2263165797126221756,131072 /prefetch:1
  2⤵
  PID:3120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4852 --field-trial-handle=1908,i,7825806172332991054,2263165797126221756,131072 /prefetch:8
  2⤵
  PID:3108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5020 --field-trial-handle=1908,i,7825806172332991054,2263165797126221756,131072 /prefetch:8
  2⤵
  PID:3156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5068 --field-trial-handle=1908,i,7825806172332991054,2263165797126221756,131072 /prefetch:1
  2⤵
  PID:2580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4660 --field-trial-handle=1908,i,7825806172332991054,2263165797126221756,131072 /prefetch:1
  2⤵
  PID:3056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4664 --field-trial-handle=1908,i,7825806172332991054,2263165797126221756,131072 /prefetch:1
  2⤵
  PID:1048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=5020 --field-trial-handle=1908,i,7825806172332991054,2263165797126221756,131072 /prefetch:1
  2⤵
  PID:2356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4200 --field-trial-handle=1908,i,7825806172332991054,2263165797126221756,131072 /prefetch:1
  2⤵
  PID:1840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=4516 --field-trial-handle=1908,i,7825806172332991054,2263165797126221756,131072 /prefetch:1
  2⤵
  PID:2044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=5020 --field-trial-handle=1908,i,7825806172332991054,2263165797126221756,131072 /prefetch:1
  2⤵
  PID:3524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=3392 --field-trial-handle=1908,i,7825806172332991054,2263165797126221756,131072 /prefetch:1
  2⤵
  PID:4408

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:4800

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8ebb6ab58,0x7ff8ebb6ab68,0x7ff8ebb6ab78
  2⤵
  PID:5068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1640 --field-trial-handle=1932,i,12046796314867580027,14323489149769731090,131072 /prefetch:2
  2⤵
  PID:4024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1948 --field-trial-handle=1932,i,12046796314867580027,14323489149769731090,131072 /prefetch:8
  2⤵
  PID:3388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2132 --field-trial-handle=1932,i,12046796314867580027,14323489149769731090,131072 /prefetch:8
  2⤵
  PID:3608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2960 --field-trial-handle=1932,i,12046796314867580027,14323489149769731090,131072 /prefetch:1
  2⤵
  PID:564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2968 --field-trial-handle=1932,i,12046796314867580027,14323489149769731090,131072 /prefetch:1
  2⤵
  PID:1044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4244 --field-trial-handle=1932,i,12046796314867580027,14323489149769731090,131072 /prefetch:1
  2⤵
  PID:3408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4492 --field-trial-handle=1932,i,12046796314867580027,14323489149769731090,131072 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4632 --field-trial-handle=1932,i,12046796314867580027,14323489149769731090,131072 /prefetch:1
  2⤵
  PID:1484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3588 --field-trial-handle=1932,i,12046796314867580027,14323489149769731090,131072 /prefetch:1
  2⤵
  PID:1820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3264 --field-trial-handle=1932,i,12046796314867580027,14323489149769731090,131072 /prefetch:8
  2⤵
  PID:2824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4808 --field-trial-handle=1932,i,12046796314867580027,14323489149769731090,131072 /prefetch:8
  2⤵
  PID:2356

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 183acf4a52e283da352ac2e3d51d43dbdd1534325f4585b6763a4ef38151b876
MD5 d9a49a7d6d5ca840cf0f0e937007e278
SHA1 90197e483cc1bf8970cb6012997b1968f43d8e78
SHA512 142acbf150500db5f703b3e56c42895cb4374927f6e26adb02f090cf18e9797b8f4e34b7e621de6daf03093cc0a7df73cb4328525ac7a1a4f36e2b61dfde0642
SSDEEP 12:bHi8mkXhVMMBKEKSCemJKlkQITagigpCbEWVhYJ0IppPK6BsyW1inP6:bLmkROMMBS+Mkv/igpFYYWIX1BtXP
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 d0c09cff1833071e93cda9a4b8141a154dba5964db2c6d773ea98625860d13ad
MD5 757f9692a70d6d6f226ba652bbcffe53
SHA1 771e76fc92d2bf676b3c8e3459ab1a2a1257ff5b
SHA512 79580dd7eb264967e0f97d0676ba2fcf0c99943681cad40e657e8e246df1b956f6daeb4585c5913ca3a93fdfd768933730a9a97a9018efa33c829ab1dea7a150
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 908a1796b17c83dfeeb3d2164f8b42b9222b56737fbf82555c8a6b46b26fe1a0
MD5 19c4ceae9b66ede4aa0b966e25ed6a29
SHA1 d15177a00753c6918b0a29ed9632471e290362e9
SHA512 8de6b21feae1943092f7eec29a4eaedf97b1d5aaa866866f615da9dcbcb3e623fe14b2400d3537e7436e5ad19cc70a19f329f1f2c5d18a243b6473352d5523f6
SSDEEP 6:/FoEXEZaDbAikNYys3ni2TiT+kfXBPSjG8AyktI830h/88yzwMtD0:d7XOZHNY/JwMStyMsCBg
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 011062cd7a9699c660d15658fc9cf326e35d1bbf85823f13cfd0d8ba1bcbbb69
MD5 2df8e0b51a64b0313ff134ba1814f732
SHA1 ed3e61db4f900635bc1009b31991d255e5ab837d
SHA512 90b68243732bbbe07f5683bde862b81374de90ea39ad576a7a89fe1d61f6a5399220c06cb9650ae96f5bd5c92d5c40b75de5d6b043325c9f72ac3eb8b5bbab22
SSDEEP 96:4bkxPU0gu0DWPTEhNsP9c2oa4xi7ynsPDqSCyfYdaoFIs:1UN0NP9cxjO3R5u
MD5 SHA1 SHA512 SSDEEP

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG
Size 317B
SHA256 b3a9e8b27b47acfb088657e8501921af44b703693d3743eefab18dd4a557248d
MD5 4896ec04291ac15e2a07ffc284663e64
SHA1 1c2145ef6f8a8bc122795e0bcb9111e9526b020d
SHA512 9900a9aa30c6590d23685380b8774f481151d4d2b4ff22ae7b6d46cb7f7b72e7f7b4c7329ca1305a7af3bb44d358a66345217397786eb045d665dd4b151dd11e
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\LOG
Size 327B
SHA256 88aaab4ddd005fc41c1d88afbf70e32e89a0cc4b4994b32179c5209683bf4ff8
MD5 9db55efb861e4a89da7460fed46b609f
SHA1 f6571f99640b2a2aa934c9bb552ff8b7d6e78a6e
SHA512 5d2dae4795514dbca4683edabd6608e1af6d888bcf810f58825d31a5e86ba8a2ce93002d7e3ccfae0bdf368bd84cfb1056beafbbdef776ff574bcc6a218c8433
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG
Size 332B
SHA256 671e14f11c48c26bb7d060db76931d40797d30c7393733cccc2ed5aeade0af57
MD5 2fe8fd8fbb0d131ac46ce59100d85d3d
SHA1 734e2058fd48935fed76343551316e21be4cc442
SHA512 039e4217f9e246c9c8bfbc56a7c73c1171e64901b9db8a8ae92154bbf6988410b0508947665a3bc6323f267481c530840b523ab23f467db2be24e3366a219e32
MD5 SHA1 SHA512

Submit Download

Network Action Predictor

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network Action Predictor
Size 36KB
SHA256 e9fa886041a3b4a2f4f2ea2153496937e0f23bb6c4dc0489d6fc78d2de6c32ca
MD5 d99c41497199097024601ea735d54897
SHA1 967597de8a9b1f6158cb342e8563f1261bfa6db6
SHA512 7e62022e185abac96573beefd327ad26ef044774797b5a9852755ecfe671e317422c90b8282f39913b2aa36656a2a775958e70b8e2935c0141d7c23f90230d99
SSDEEP 96:9qAuhjspnWOuPWpT2/Hs1sIGbzc7Gvu6utAMErPKKuaXN8WJ:QfPAuMyIicivutxErPPTG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Action Predictor-journal

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network Action Predictor-journal
Size 8KB
SHA256 df49c00b701d160e5bfded403290ec370502c6c64a83542dec2ba1c46fee259e
MD5 5b010072fe2827e01db5f7836a9dcb14
SHA1 c537ca27bb00bffe4d740492b94478e6052720bf
SHA512 9fd29edc1a8d4c4af20327b94204013c1636588408dc9a96c0e901458f24a7be309078125fb7e7e592dddc3327c554aa771391f04d95e67f37e7bb165cf85ecf
SSDEEP 96:c2PWpT2/Hs1sIGbzc7Gvu6utAMErRKKuaXN8Wk:c2PAuMyIicivutxErRPTGh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 811B
SHA256 9ddac02bad8b5c58a8ec04bd9890a001bd58d1ffa3eadb9bcfdfb41d3ce88aa0
MD5 70faca97a63144c38d3fd073de8e0699
SHA1 38f2b975d7a1eaa64d3d8d649f191c654ede6d7e
SHA512 fb532e09069d2a899e13315a63ec33587958dfb05c7318137fbdebdc601482350a512381276069a088859cff2ee3de34d0b8cdc9e41e9ec8358b67d212befcf3
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 811B
SHA256 fb9205a0d29527329adab0829df31a716d97915d8f0c3662513f5df5c2699309
MD5 92232a3ba5b6e00ea433e0b737a88f82
SHA1 9ca54888a5ad92dbf74f6bbf7894393ba16b26c6
SHA512 47e0ab76fb99c7cb2915a59576e735dd6bce6a49bb1659ba808a5e660d1576f7ab159f5f6d10119628a6c12364f268bb4b4bea522132109ec233dc079fde10a0
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 7KB
SHA256 42f89ff51e51d7ff288b7cd71dce1418cb4bbc02a623203c1c0a0831ebe22bc5
MD5 da201d910fb3e60d10b00647390ace6e
SHA1 d9855950eb049cedb74ba50f92dffef1e7bf0f46
SHA512 dec6979059ae16fa16db2e938ee3a6fe9d1c44bce8f583462808eba236897340ffdbdd90d6d6d62bb389d51df952fe072027d601c322c7c304d2ac991fb05a79
SSDEEP 192:RXc2kJ2bpuPZaJ0o8syh+FjoKtAjtd5tjEsXtScR:RXc2bcE0CyqsKtAVtIsXtScR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 7KB
SHA256 06e231d574d449ee96f0d38907fb22ed7352c7afd9575db798b4267a3ce38103
MD5 e899ebb0a1785449bc16343117ddd31b
SHA1 e2793477cf00bae8b32cfe02546eaf4f28c16ccf
SHA512 d65352fe7ac064e1f3d62d8d2c6cb0b161c5e5602f8c995eb8e1c5ba28c7b4eb53ed690ed131593ebb3b25317cc3c78cc61af88c1f6dd83225bf0dbfdb08c3be
SSDEEP 192:OXc2kJ2bpuPZaJuo8syh+FjoKtAjBd5tjEsXtScR:OXc2bcEuCyqsKtAZtIsXtScR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 7KB
SHA256 73fe7996912fdec1dd99f9a671ae387edc8e7d48816296733e46ea1c1b95603f
MD5 967894577af12ad5fa251d6ff7a0f383
SHA1 9552486b8c774901e89aa946de1872671e90ca08
SHA512 82815406ab6c8698269d16b4bf4898996d6848f761788b44765f846a0adda440cdfe20771c16ae4d7a6618030caebada7672c70fea7270654c36a4d74bd77b18
SSDEEP 192:OrbpuPZaJuo8syh+F6etAjIP5tjEsXtScR:OrbcEuCyq5tAktIsXtScR
MD5 SHA1 SHA512 SSDEEP

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\000003.log
Size 232B
SHA256 88fe1d31608930f2738d102d45c75dc77acdf01a1b69bfb7e7c0281575b75e33
MD5 8a30a1fdd0459d9ea8b1e78a8e636856
SHA1 9d7225e97f9cfcfb225cfbfd0b0bba21d4efdd20
SHA512 b529bce870cd8165bf82f3ebf94f07552467bd0993b9d35145182e54e26fb2ae8e7bb167d88267b632757e2146f27dfddf8867db0c66e5dcc306db12ec6b7bef
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG
Size 317B
SHA256 aa4d797a46cbbaab22275d6bd3ea026ca82c82a9ae025b2f1e2b41ba2d5a8c88
MD5 32e1bd351b1fc78e45930f1744cfa2fc
SHA1 b20a03a67fa2fd84e8b4b2dc82cb8e0e4db73a93
SHA512 3e74b9597b00267746b8cb818659d47d5b743b213949d8e4abcddb91090847e89aebd027226c1e46ba63a0c8fefd64fbaa74ad84ecc120192c2f91fe1d59a0f6
MD5 SHA1 SHA512

Submit Download

Session_13364313510220515

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sessions\Session_13364313510220515
Size 10KB
SHA256 6c4fc81ae80316030c9d4b9954e54b96641a5711e0c6717b9330639641e4d5d4
MD5 6e8ac10168572998e4ee565d814af27d
SHA1 63233d1bef04e6f6deff0dd2dac3b9af0e855d39
SHA512 16dacfb05581bbf3508e5bf7df44108ad218bd6770ec0969c86e60128fba869cf2b70fa575e2b8ba3734120182ace0b091b4caa6d5dd918c8a67b8754dbb992d
SSDEEP 192:3LCDnWPfEnCe+0IgYm+0I70IG4Yu+0I5qalUGKqr:bEnWPsn5+0I3b0I70IOz0I5qUUXqr
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tabs_13364313531257515

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sessions\Tabs_13364313531257515
Size 4KB
SHA256 5424e6a148591629340c0f5b7616e976d69b8def3f0e6d3794f3534087857ffc
MD5 d6895b4739b5f055077d8eb1ad15e26e
SHA1 0befa7715ebeafa13d170c84eb517ba05d52bde9
SHA512 7863267db6ffce6d091b7aaf831c192c470d580367321a0af0b8a5def51a963cef744cdfb25769cff919fb4de34e284cc7b68beb4e4682a0ad6c4b42aa9a309b
SSDEEP 96:30tVqC6FA9Bib0IGhfviYF5RAZib0I1qWuZ7lFvmGKqfnqE:30SC3E0IG4Yu+0I1qW0lUGKqvqE
MD5 SHA1 SHA512 SSDEEP

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000003.log
Size 172B
SHA256 104439217eb1a794541cf55d9a6fe98a28d9f7b93273bd01bdfc5caabb9d2eb2
MD5 2951dd80d668424c8bc30f0c4a279a2d
SHA1 e2ec75f46f0ef3d4fc993184ab1141fc74e7c5f3
SHA512 858b5801186016f8ca1854fb74b42d445957d8d70afb4ca791cca6d7ce96d8293d15174c1a4720fa570c8f11239049d73a85915d0982fe3ddc075e65de1b11d2
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG
Size 345B
SHA256 139481f9b542e56117a6359714ffed327c9ca519c7f71dbd6d14e004e9c442d8
MD5 b1922ccc2f6705007a9a76aae39c73f6
SHA1 cb3b19857413a90589e5d722bf94599b4d7c85a2
SHA512 36452e692391a1f81ca9d75a0504cbe3f6e414f25453f21b30acf3808469a464a550db65c5f42967d314bd436918a56b54d29dfe013e6fdfc25d8538b7abdc06
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000003.log
Size 15KB
SHA256 ab3e7bed83ec7df51c3b6a188245b92e29391c8d0255e5c5ce0d8032282379e6
MD5 4c8880e852431209a46d854cda50aacd
SHA1 133930a1e006db94c59ada72317e2e36b626ed30
SHA512 096582523a0037e3b8a2b6b2ce1b9ce6f24e6d61df313a628abd82140104d87f109511dcf9aa239f7ad6af7ce0293cac95376fb30dfbe4813678419ae959a5fe
SSDEEP 384:HFKuWnwu3pEGGUCps3pNrm3cKpNsKv1PYnB833HfvFP8nBCKpNnA3jfvVvPjnBmK:EuuwCpEGGUCpopNrm3ppNHv1PwB833/v
MD5 SHA1 SHA512 SSDEEP

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG
Size 321B
SHA256 cc6bd197dbd2a3e865bf76bbb354fd680eef75fb08928131721c3a4ba5a1ef03
MD5 e26de657403313850e49922855985cbe
SHA1 05a94c1bd439a35301b3138539c0ed37a532d595
SHA512 5c0be02b06e485d3f2fb4c92f1a3bd77d2f99d8a8d5a8e7010cd4b6a70e471969b79118827e0c4c63213c2bc3d08a8291ba25f0de4f8f3b41938e51160c74091
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log
Size 2KB
SHA256 aa3d09cfa760f86f3428a2d7be36a71dbc7f4e2e042d45f6608ea42f3f166295
MD5 b9853cf5960421632f7121a86a281864
SHA1 abb898faa1f164125a213da3260d83d2229560e3
SHA512 9e3d6af18a6f0f82026789208303c73e37c962a485a7271f1f9bf1ebb4a8f7d4311108c4344332b9a0dfd2b49fba041fbd8068770a1a8778773e2326533bc297
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG
Size 317B
SHA256 ddc8aa8b6bc6e6c5f843cd946b5986e320f582c48d9dab0968e3d4a8a6a70496
MD5 616cad5e039c23fc9d81d4df42706555
SHA1 836a4238f93e32f2f8d3e46fb74aa98088fad913
SHA512 a305b1a1d76e4194a59087bb9a5a609abaf53b8a78e7ac96c077102b713bcffd3c44680e1ae6f79baebf71bc6568d881fd47ae489c8339c7af304da0a96571b9
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000003.log
Size 889B
SHA256 980856d398501a500254c358b46c06061d6f66f4f5e77ac049625d24500380b1
MD5 c31c4325b6b9099d3fa9c007ad3a16e2
SHA1 686046aae26ce5c5b75e807e48e11a8de74a73dc
SHA512 d4c6eb6c29560e60052b1c24ece9a282b51a3374eca307ee3d6a824104b12fbc2f10d14f84a14830e13ed52252616320f2d10075da5d323a30a883ad4863f9fc
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG
Size 335B
SHA256 0baefe420306eff60c1c2f0060aefbbdc4a96bf9fe647f6d82e83a402901c132
MD5 e078965da55bfa0524bd2ffee8360db7
SHA1 385b2c4f1d7e99e06f52289544312025d662d6a5
SHA512 29761e17b28ffeec016b616a3c9e43af7ab12f6254f42083ed1757d08fc151244c05e3daf068bcd99fa5b5b90261471e854e4acef103f5657b94ffc5f0f499c5
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_0
Size 44KB
SHA256 a79d0a048a8ad946b8beb7bd103d816d17feb602bcdaaeff00c848652d95afa2
MD5 5bb001082e21b43d3a488cf87a82cc52
SHA1 4b2bea4f830b38012fa70b1c97e068d247c4abb6
SHA512 fbcf67e1e48db1f0e0032e41401f696b772a746bc42424477638797b8b7be32164607308ad8075ac63f9868a719b6944735036b30c8810590d959a4c66d38bcc
SSDEEP 24:d+EDyyyZSdCR//CxKdSVQVg5dvG61PzaJkEi+mcF/saFXJKvsVNqE2+znTIxyo6b:JyqCpKx2C4kajzrb+MBr
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_1
Size 264KB
SHA256 440f0e483c86b2fba25877167e6dfc4db6a6dbda8bf59eced01d2a947fd042dc
MD5 1ec95fe5d3b20315fafd4213be101e5b
SHA1 d1c0aafcd6506d6c730d9f193587e00b5d6a8e17
SHA512 9137e6babec769ee11a3570093768e1d0e2dcf8d5bbf73ca363aa7552d990ed602d252699419290ed846d97dad37dd1dbb0e271a6cf4b8941dfd76f7e33b4523
SSDEEP 96:DSmSFdSDS3CS+S4QSxsSV4QSUWSFQSxHSwDSsESDLSrSsgS5SHTES8lOS7jtSVS9:cLOj4LJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_3
Size 4.0MB
SHA256 f1bb5dc110fb624807cde7b8f288c573f64191aee4a0b1ca84b499671634bdb3
MD5 f972fb17fd35393d5c5ebea7d0610b55
SHA1 87bce7a055b76071de7cd0561ec40c197f5fef1b
SHA512 0e9507857fc76522928d2ae6fcbfbc72938982a6edbfad94e816934ee75cc3d7d87b1085fa887fcaefc96765062bd520fbb6e3308b046f9f3e8c69ac3c960e3e
SSDEEP 3072:tp4URggHH6Mslc5sqd6qR39j9Vyfi9hWK1mpd+Dw:
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Browser
Size 106B
SHA256 3615498fbef408a96bf30e01c318dac2d5451b054998119080e7faac5995f590
MD5 de9ef0c5bcc012a3a1131988dee272d8
SHA1 fa9ccbdc969ac9e1474fce773234b28d50951cd8
SHA512 cea946ebeadfe6be65e33edff6c68953a84ec2e2410884e12f406cac1e6c8a0793180433a7ef7ce097b24ea78a1fdbb4e3b3d9cdf1a827ab6ff5605da3691724
MD5 SHA1 SHA512

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 14B
SHA256 de607a2c68f52e15a104ead9ecbaa3e6862fdb11eac080e408ba4d69f1f7a915
MD5 009b9a2ee7afbf6dd0b9617fc8f8ecba
SHA1 c97ed0652e731fc412e3b7bdfca2994b7cc206a7
SHA512 6161dd952ae140a8fb8aa5e33f06bc65fdc15ce3fbfe4c576dc2668c86bce4a1d5c1112caee014e5efa3698547faad3bc80ec253eedb43148e36e1a02ce89910
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 257KB
SHA256 ba147be19898ea50cc704289b14be773ce62591c04bba058366417b439356e6e
MD5 0bc80917fb0c904aaee2f2c035ca3df1
SHA1 98a8eef9a4d14ad5c786e9f2469ed170daa7cafb
SHA512 2c346005c4f947baee7bb5de3c9a0962906c99454cd38ef3d7b30b9407eb4f0b5246c9445d9bf126f4ae8769bdcb45f2b873626a034f6059d4c5264962f22adf
SSDEEP 6144:y1Z5IZXqXHjTdCP3y/aQYRPILxZnhLMJjX0EeGzY2rLi:CsqlGSaQ5fnReEFsLLi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 257KB
SHA256 d15895902e53fa2c9f8b0ed9244979e072829fae2c1869baceb6e44effa9645c
MD5 5daf9af3fb001f031a9f913941fa01dc
SHA1 c08e25fd68a3689bc5dd7d2353b8b28bf6392171
SHA512 027fb3e20ac0249243fdd73700e34ae0597ef17eb5fc5b93c849d5eb00de334433c443c31d7079298429b3ed0ce08c12f88a3c3fbc65181195519a4d13ded24a
SSDEEP 6144:nZ5IZXqXHjTdCP3y/cQYRPILxZnhLMJjX0EeGzY2rLi:fsqlGScQ5fnReEFsLLi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 257KB
SHA256 423f7f393133da5bfa6941b53ee52357116fbd264d3b4d2480e28cf7418fd0a0
MD5 c8f075601e2d61d386e9d680f09b5ea7
SHA1 cd5070b32f13f0f30740ace34162c0803a67d9c9
SHA512 7a82d90f06b0dac23e67ee8509f657c1bed86c8c9f4664199138be2a8110c0f06af1c7c5b659b51c9cd60cd409cd7ca5afcb498d96598d819607b8742c676e0f
SSDEEP 6144:keZ5IZXqXHjTdCP3y/9QYRPILxZnhLMJjX0EeGzY2rLi:PsqlGS9Q5fnReEFsLLi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 257KB
SHA256 4a4668130961e7019d88284730ac0b6bd3a9b1855abc3c77caf6665bdd20f63c
MD5 3949768298ee6dcd333f8ac9647beb82
SHA1 6b325a46d57475c2f0088efcf34658714cc2abef
SHA512 0c476d127167ef28fbd2939c0fdae46f403db69f67f1b4bcb4cc3c83ed3d55beb8ab7276f718b302f57042ebac208c9e14d647918d47d5aa4bcc26d08827b97a
SSDEEP 6144:EmZ5IZXqXHjTdCP3y/9QYRPILxZnhLMJjX0EeGzY2rLi:TsqlGS9Q5fnReEFsLLi
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
MD5 SHA1 SHA512

Submit Download

chrome_shutdown_ms.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\chrome_shutdown_ms.txt
Size 4B
SHA256 659a0eb34b709f718bcbf30cab06e8e491d290424694d7bc155218f2290ff8ce
MD5 ea6e60354b61a9d62f1a0bcfd432f8b9
SHA1 f598436e5ac6c9cf042ab751e80c739fffac7cb4
SHA512 4f1818e4c7151ed5f8784a69f48d8c11e327cc9ea5d53ef7510529ef4991266301121f5bf70f2da84f9e0ab8d189a3aaaaa5901942aca39279d08139ea4c2838
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d
MD5 6d3e9c29fe44e90aae6ed30ccf799ca8
SHA1 c7974ef72264bbdf13a2793ccf1aed11bc565dce
SHA512 60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 a5735921fc72189c8bf577f3911486cf031708dc8d6bc764fe3e593c0a053165
MD5 a7cc007980e419d553568a106210549a
SHA1 c03099706b75071f36c3962fcc60a22f197711e0
SHA512 b9aaf29403c467daef80a1ae87478afc33b78f4e1ca16189557011bb83cf9b3e29a0f85c69fa209c45201fb28baca47d31756eee07b79c6312c506e8370f7666
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_iwbko0yv.isc.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_iwbko0yv.isc.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

memory/2372-52-0x000001EBE9690000-0x000001EBE98AC000-memory.dmp

Download

memory/3268-17-0x00007FF8EF1A0000-0x00007FF8EFC61000-memory.dmp

Download

memory/3268-14-0x00007FF8EF1A0000-0x00007FF8EFC61000-memory.dmp

Download

memory/3268-13-0x00007FF8EF1A0000-0x00007FF8EFC61000-memory.dmp

Download

memory/3268-12-0x00007FF8EF1A0000-0x00007FF8EFC61000-memory.dmp

Download

memory/3268-7-0x000001E7B1AD0000-0x000001E7B1AF2000-memory.dmp

Download

memory/4648-119-0x00007FF8EF1A0000-0x00007FF8EFC61000-memory.dmp

Download

memory/4648-0-0x00007FF8EF1A3000-0x00007FF8EF1A5000-memory.dmp

Download

memory/4648-54-0x00007FF8EF1A0000-0x00007FF8EFC61000-memory.dmp

Download

memory/4648-1-0x0000000000D80000-0x0000000000D90000-memory.dmp

Download