eeb3a364affb011a8a548ce6878a062de501c5f9acb68f137cb44c6a45d716d5

Analysis

max time kernel
61s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
28/06/2024, 23:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Wave_28_06_24.zip
Size

7.1MB
MD5

add22dd1fc49c09759b17923939c2a00
SHA1

65c0f450b02a72b40ccd3efc1557bebe288de2fe
SHA256

eeb3a364affb011a8a548ce6878a062de501c5f9acb68f137cb44c6a45d716d5
SHA512

840d402d92eb7ad76a1e42cb1adb265f8531be02519af4f5293a86113e685a1a189fe58510f84f565d14b749c9c65179ebfe5a3ef15b58f65a6c5ffd3f574b51
SSDEEP

196608:Dh3/WAH1bmZMbpfZp+MfPQrn/qN14CQPz9lRYQBmUT:DZ/v2MDeG+XrqQBD

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2068	chrome.exe
2068	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 2744	2068	chrome.exe	29
PID 2068 wrote to memory of 2744	2068	chrome.exe	29
PID 2068 wrote to memory of 2744	2068	chrome.exe	29
PID 2068 wrote to memory of 2492	2068	chrome.exe	31
PID 2068 wrote to memory of 2492	2068	chrome.exe	31
PID 2068 wrote to memory of 2492	2068	chrome.exe	31
PID 2068 wrote to memory of 2492	2068	chrome.exe	31
PID 2068 wrote to memory of 2492	2068	chrome.exe	31
PID 2068 wrote to memory of 2492	2068	chrome.exe	31
PID 2068 wrote to memory of 2492	2068	chrome.exe	31
PID 2068 wrote to memory of 2492	2068	chrome.exe	31
PID 2068 wrote to memory of 2492	2068	chrome.exe	31
PID 2068 wrote to memory of 2492	2068	chrome.exe	31
PID 2068 wrote to memory of 2492	2068	chrome.exe	31
PID 2068 wrote to memory of 2492	2068	chrome.exe	31
PID 2068 wrote to memory of 2492	2068	chrome.exe	31
PID 2068 wrote to memory of 2492	2068	chrome.exe	31
PID 2068 wrote to memory of 2492	2068	chrome.exe	31
PID 2068 wrote to memory of 2492	2068	chrome.exe	31
PID 2068 wrote to memory of 2492	2068	chrome.exe	31
PID 2068 wrote to memory of 2492	2068	chrome.exe	31
PID 2068 wrote to memory of 2492	2068	chrome.exe	31
PID 2068 wrote to memory of 2492	2068	chrome.exe	31
PID 2068 wrote to memory of 2492	2068	chrome.exe	31
PID 2068 wrote to memory of 2492	2068	chrome.exe	31
PID 2068 wrote to memory of 2492	2068	chrome.exe	31
PID 2068 wrote to memory of 2492	2068	chrome.exe	31
PID 2068 wrote to memory of 2492	2068	chrome.exe	31
PID 2068 wrote to memory of 2492	2068	chrome.exe	31
PID 2068 wrote to memory of 2492	2068	chrome.exe	31
PID 2068 wrote to memory of 2492	2068	chrome.exe	31
PID 2068 wrote to memory of 2492	2068	chrome.exe	31
PID 2068 wrote to memory of 2492	2068	chrome.exe	31
PID 2068 wrote to memory of 2492	2068	chrome.exe	31
PID 2068 wrote to memory of 2492	2068	chrome.exe	31
PID 2068 wrote to memory of 2492	2068	chrome.exe	31
PID 2068 wrote to memory of 2492	2068	chrome.exe	31
PID 2068 wrote to memory of 2492	2068	chrome.exe	31
PID 2068 wrote to memory of 2492	2068	chrome.exe	31
PID 2068 wrote to memory of 2492	2068	chrome.exe	31
PID 2068 wrote to memory of 2492	2068	chrome.exe	31
PID 2068 wrote to memory of 2492	2068	chrome.exe	31
PID 2068 wrote to memory of 2600	2068	chrome.exe	32
PID 2068 wrote to memory of 2600	2068	chrome.exe	32
PID 2068 wrote to memory of 2600	2068	chrome.exe	32
PID 2068 wrote to memory of 2708	2068	chrome.exe	33
PID 2068 wrote to memory of 2708	2068	chrome.exe	33
PID 2068 wrote to memory of 2708	2068	chrome.exe	33
PID 2068 wrote to memory of 2708	2068	chrome.exe	33
PID 2068 wrote to memory of 2708	2068	chrome.exe	33
PID 2068 wrote to memory of 2708	2068	chrome.exe	33
PID 2068 wrote to memory of 2708	2068	chrome.exe	33
PID 2068 wrote to memory of 2708	2068	chrome.exe	33
PID 2068 wrote to memory of 2708	2068	chrome.exe	33
PID 2068 wrote to memory of 2708	2068	chrome.exe	33
PID 2068 wrote to memory of 2708	2068	chrome.exe	33
PID 2068 wrote to memory of 2708	2068	chrome.exe	33
PID 2068 wrote to memory of 2708	2068	chrome.exe	33
PID 2068 wrote to memory of 2708	2068	chrome.exe	33
PID 2068 wrote to memory of 2708	2068	chrome.exe	33
PID 2068 wrote to memory of 2708	2068	chrome.exe	33
PID 2068 wrote to memory of 2708	2068	chrome.exe	33
PID 2068 wrote to memory of 2708	2068	chrome.exe	33
PID 2068 wrote to memory of 2708	2068	chrome.exe	33

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Wave_28_06_24.zip
1⤵
PID:2740

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef71e9758,0x7fef71e9768,0x7fef71e9778
  2⤵
  PID:2744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1136 --field-trial-handle=1380,i,983832377618355991,9432500369178288308,131072 /prefetch:2
  2⤵
  PID:2492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1436 --field-trial-handle=1380,i,983832377618355991,9432500369178288308,131072 /prefetch:8
  2⤵
  PID:2600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1620 --field-trial-handle=1380,i,983832377618355991,9432500369178288308,131072 /prefetch:8
  2⤵
  PID:2708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2308 --field-trial-handle=1380,i,983832377618355991,9432500369178288308,131072 /prefetch:1
  2⤵
  PID:812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2324 --field-trial-handle=1380,i,983832377618355991,9432500369178288308,131072 /prefetch:1
  2⤵
  PID:1664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1588 --field-trial-handle=1380,i,983832377618355991,9432500369178288308,131072 /prefetch:2
  2⤵
  PID:2044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1508 --field-trial-handle=1380,i,983832377618355991,9432500369178288308,131072 /prefetch:1
  2⤵
  PID:780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3032 --field-trial-handle=1380,i,983832377618355991,9432500369178288308,131072 /prefetch:8
  2⤵
  PID:824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3596 --field-trial-handle=1380,i,983832377618355991,9432500369178288308,131072 /prefetch:8
  2⤵
  PID:2436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3640 --field-trial-handle=1380,i,983832377618355991,9432500369178288308,131072 /prefetch:8
  2⤵
  PID:1604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3604 --field-trial-handle=1380,i,983832377618355991,9432500369178288308,131072 /prefetch:1
  2⤵
  PID:3060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2812 --field-trial-handle=1380,i,983832377618355991,9432500369178288308,131072 /prefetch:8
  2⤵
  PID:1148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3884 --field-trial-handle=1380,i,983832377618355991,9432500369178288308,131072 /prefetch:1
  2⤵
  PID:352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=3992 --field-trial-handle=1380,i,983832377618355991,9432500369178288308,131072 /prefetch:1
  2⤵
  PID:2152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=2264 --field-trial-handle=1380,i,983832377618355991,9432500369178288308,131072 /prefetch:1
  2⤵
  PID:1684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=3892 --field-trial-handle=1380,i,983832377618355991,9432500369178288308,131072 /prefetch:1
  2⤵
  PID:624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=2992 --field-trial-handle=1380,i,983832377618355991,9432500369178288308,131072 /prefetch:1
  2⤵
  PID:1320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=2428 --field-trial-handle=1380,i,983832377618355991,9432500369178288308,131072 /prefetch:1
  2⤵
  PID:980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2836 --field-trial-handle=1380,i,983832377618355991,9432500369178288308,131072 /prefetch:8
  2⤵
  PID:1288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3816 --field-trial-handle=1380,i,983832377618355991,9432500369178288308,131072 /prefetch:8
  2⤵
  PID:1976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1244 --field-trial-handle=1380,i,983832377618355991,9432500369178288308,131072 /prefetch:8
  2⤵
  PID:2224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=2588 --field-trial-handle=1380,i,983832377618355991,9432500369178288308,131072 /prefetch:1
  2⤵
  PID:1312

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2024

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
PID:1616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8a55d3b80a8515be8b3c646a0f98e046

SHA1
89af4c7c65ebe988c86eea35bce65e27e2adf35c

SHA256
7b02cd85549c992b28279bdefcd3dc83a20508c05896c0a14141b5f80a69a6f9

SHA512
1aec9fc1c687d824a19c4e2f9471d27bee02b1d1c17bb8f4e49a8e94ff69a643e3d02a0d4a2511651c4f20cce1f54bba3e18b05f7179bc87ae857100a70b0ba1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5d1859270c3383123355f421fed940bb

SHA1
238ecc14936905c0cf610e0c8e6dc88313485ce3

SHA256
99030bf8c6226dbeb2c4a4c55706b90da2bf7b702f5ad763f55bda37b4501461

SHA512
de503dd2e0f736ca864cd150095c208d1d8cf626b32064b1f5234bcfbfbfabe19d8e63d6a3f1c6d4ef0aabb440dc1b1a10dd8ef92a119c1457c5bc276ee7fe2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ea79dd9d6f0c229cd2465d4085892c3e

SHA1
0f77cbfc222b14601e35553ab688658092ab6f70

SHA256
7d109a81eafae4d8721c8f82f952ba32a4982179e3691ef3b42a21ed7a41f2c1

SHA512
d3c0d9384e39f94b67d177ed2589bfd1523c1595da6eba31733834108630c8e29aca7d237e9ce4be4dfc79085da86ecd48c7b19ad5ab2bb3d65d3f5d279ace78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
051b05086317415f9da342a2fd1bf586

SHA1
80c62a46f7b7b09993cbccd38af470ed76f0e0a1

SHA256
4a031bff47b21d13ce76b3ba6334ecddfbf602724b8d33942eb70c3f39eb351b

SHA512
39fb8c0b64138c919f637687c272859200399122f0175d8bcffdb0759fbde9c367c264ff55c1f550afe5c959865a12fdeca9525b43887687c2d0289bebae8cd4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
33f3ef7104a2710809aba230ffd79eb8

SHA1
7c03b0a6005672f6e035c1ff63632a8a760e8147

SHA256
6f9781823fb8128d975638ef89873a000bbfa3dddb1b412357e1bcdb6148159b

SHA512
0017406a9840a1c7000858e8955929d8ac0d1010e81e4251e5a3589e5204887bc953ee233abf2ce8112a1e3617aa2fbc3decad35cc2c7f4d4b4d26a15f2fdac5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
374572a98dcbadbc4bcba4eec8d500e2

SHA1
0995605ffb967b2d72f563e3d891cec4094cb506

SHA256
08db19ad9519db6b28c8da5d2e7a73e369a5e5489fe1ce70de79e1c13671b5e3

SHA512
aebf5b4b3b93e9b40b378acfd6f6b0b5cb21d9944af2bbffaf298a96069ca3e82d98c5d9e5e0f86439584e2294202167c4f21474d0cb3337fbe0c615968c3f6a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
361B

MD5
55e29539401f2527d4b3223ea8e94879

SHA1
e276262bd174e67eb1bef9cc0f10f21151e3bb1f

SHA256
c55a0d5a8d11708917476ad29de69a577661ace4bedab01982e4342930b334ab

SHA512
da7a1450b24345d8cb58fea4ff1774eae8182fe297a14ab00c524c6f9661778a423bbca53f1666e555c317939ef8faa546b430b9eb023b7f7c719fed8e7e68d9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
361B

MD5
1469fccc3d70cc76ac0e57a089653676

SHA1
f9a15e501aa360118dbb9987bcf5a6711c5901d9

SHA256
537fa9e534a11d2ba9550303623d78eaddfd4b80afe89ef1be46c00606aa3d79

SHA512
444f4a9ef65c6e9b1340809ea0f272dbf4a46fe2c0b8d7c1238676d3c720f60a26e67d4c0055d02d9dc479c59987d4479877f13c66099fe8ce2dfc6d9e9091e9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
94899e0c36a5c7b6dfffc4a56079e961

SHA1
57ba7994e46011c35d43477cb0e8ff2f3d193c10

SHA256
e46f4b12c9be896c91c242501fe0e57b8aacad5586f122846b4a1973b7989360

SHA512
b893a4da9f3b5d8fc0168c4d6d1ad644a314f69e9b9995b86c84dfed429e12303f1332cfa2c6942257b78c6c85018e1eaa828e939daf090a333900b826cdf3e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
a5c22a72a1487b326215fbf0b6864ae7

SHA1
6729a2287199a87943835762ce8971520e42ac43

SHA256
bc5667ceca72b4d1d3b647b32da143d3dd480ea7146fa910acf648d3d98a9607

SHA512
c37165c552070f0a70e5c42e6ec80f703ed1030106c227e18ff978aa42855df75275c708d4ff9d0f5caf1285a71a508e467efc85abf79f13ed205ed08875b526

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
550851b64e90d358f684e5c7eaa968f0

SHA1
4086a5d90ffc76f42e4278efe7715d9fd9fb6263

SHA256
75c62da0d22bdc6c972b5d70769c50de71c423eb145d0ad81e7766dab5b41b15

SHA512
3e13649db32288d678b4a26d69c4a5126089a6b10c772ae8430a81b7cc6fc104bac0a50745e318a43e7248b46c35cad2403a78129058b33e0127704141141fec

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
91c3ea02be33c9b0a4abd83f94af53ea

SHA1
4972cd86bc44c48fcfb7b44b618fbeb0dca3bd58

SHA256
14630dc14851dcd2e9222a769a308329f1f45a0c29cc2e4d3e1b5e51d0dea109

SHA512
0b626b2f427cacb5948aa471cc6922161402c4bcbfe3148dfa1feef499e0bcbe0c4ce6c77998c3170eed7d459c98c500be5914ab8880196314486f94accec6cd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
293KB

MD5
a1fc1663adfe1af7536b4f6f45921114

SHA1
23c71e0f15fbc874202a16674c2453c4dbec860d

SHA256
255145cc9e82e2c08232d62defd4869d4aeaeb5ac9e350233d6fa37fe77a9bb9

SHA512
20308bb51351f30f679620849e320cf1a449ad3a58b86fbfaec9c9d77cce3e0a257f716c65ffa1c1e3f5223f7adb3e4b6535bbc9ba8c3becd235a9da7d5b3f91

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
293KB

MD5
b174bf425ef5d34a700460d6951ce30d

SHA1
9cf4fd3bcbb0f3c14cac49e212be3dde00dff2cd

SHA256
f52b17076b1d710d3741dfbcc8266d92c2b3116fec170c843f3cd6cecbcbddd9

SHA512
bb444508f506255977d7f972780fa82a8796f838b1c96e1f15f081f8eda1b3047dfc16ffeca6a86c92f9b506b049ea918ecf7930725cce714ee3611681896826

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
75KB

MD5
8473b0688c319f744a0fbbf8dc291e80

SHA1
bf7c16c15a11a93ae108751458e6203f18b998dc

SHA256
c3b952bfa4b497e85f1729b24af0620898f53a258f148036e09e1fea2f50e503

SHA512
51f2eeba4237140ab0a615d0daa43a3902340ef285203eb67a9cdb879b73473195c4e81489289b41ea788a0fca41c4865173fb8bdb30f653937d5773de35490e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\b067c0be-9fa6-454b-b6cf-e50f487198d2.tmp

Filesize
293KB

MD5
257848a5e3291c51573733e8e46ca368

SHA1
02b9e0ca4f9377569999d4aae78eaa898bda3cea

SHA256
94f6811ef39637fcc3d6e7d0fdcde9d071970a8df32cb75c74fe4e3b610504c9

SHA512
e2af9abef94e4831e0f86b3d7583c77207792904e394553345ee0c11d84d06b5ef0abc4dd601fe7e0f85b0a205320a3a032de3f155cad7837ae1929cbc2c5287

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB38E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
memory/1616-720-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/1616-721-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/1616-723-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/1616-722-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/1616-725-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/1616-724-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download