zgrat | hxxps://mega[.]nz/file/RC9gBDpA#KBy1GOntXj1-3_y_yE8eQOiZBmASCfytncyFrPBUDzU

Analysis

max time kernel
145s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20231215-en
resource tags

arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
submitted
20-12-2023 09:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://mega.nz/file/RC9gBDpA#KBy1GOntXj1-3_y_yE8eQOiZBmASCfytncyFrPBUDzU

Score

10^/10

zgrat persistence rat spyware stealer

Malware Config

Signatures

Detect ZGRat V1 6 IoCs

resource	yara_rule
behavioral1/files/0x000200000002a827-355.dat	family_zgrat_v1
behavioral1/files/0x000200000002a827-356.dat	family_zgrat_v1
behavioral1/files/0x000200000002a829-367.dat	family_zgrat_v1
behavioral1/files/0x000200000002a829-368.dat	family_zgrat_v1
behavioral1/memory/3140-370-0x0000000000AC0000-0x0000000000DE8000-memory.dmp	family_zgrat_v1
behavioral1/files/0x000100000002a82f-431.dat	family_zgrat_v1

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Windows\\Microsoft.NET\\authman\\spoolsv.exe\", \"C:\\ChainPorthost\\Idle.exe\", \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\SppExtComObj.exe\", \"C:\\ChainPorthost\\explorer.exe\", \"C:\\ChainPorthost\\msFont.exe\""	msFont.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	msFont.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Windows\\Microsoft.NET\\authman\\spoolsv.exe\""	msFont.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Windows\\Microsoft.NET\\authman\\spoolsv.exe\", \"C:\\ChainPorthost\\Idle.exe\""	msFont.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Windows\\Microsoft.NET\\authman\\spoolsv.exe\", \"C:\\ChainPorthost\\Idle.exe\", \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\SppExtComObj.exe\""	msFont.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Windows\\Microsoft.NET\\authman\\spoolsv.exe\", \"C:\\ChainPorthost\\Idle.exe\", \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\SppExtComObj.exe\", \"C:\\ChainPorthost\\explorer.exe\""	msFont.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2552	4968	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	568	4968	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3128	4968	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1972	4968	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3832	4968	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1596	4968	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3572	4968	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2348	4968	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4424	4968	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2700	4968	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3488	4968	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1852	4968	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5060	4968	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5104	4968	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5116	4968	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1788	4968	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3068	4968	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4000	4968	schtasks.exe	81

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Executes dropped EXE 6 IoCs

pid	Process
3312	setup.exe
3140	msFont.exe
656	msFont.exe
4072	msFont.exe
3136	msFont.exe
3964	msFont.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\ChainPorthost\\explorer.exe\""	msFont.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1725696949-2443092314-1471438111-1000\Software\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\SppExtComObj.exe\""	msFont.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	msFont.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1725696949-2443092314-1471438111-1000\Software\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Windows\\Microsoft.NET\\authman\\spoolsv.exe\""	msFont.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Windows\\Microsoft.NET\\authman\\spoolsv.exe\""	msFont.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1725696949-2443092314-1471438111-1000\Software\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\ChainPorthost\\Idle.exe\""	msFont.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\ChainPorthost\\Idle.exe\""	msFont.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\SppExtComObj.exe\""	msFont.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1725696949-2443092314-1471438111-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\ChainPorthost\\explorer.exe\""	msFont.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1725696949-2443092314-1471438111-1000\Software\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	msFont.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msFont = "\"C:\\ChainPorthost\\msFont.exe\""	msFont.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1725696949-2443092314-1471438111-1000\Software\Microsoft\Windows\CurrentVersion\Run\msFont = "\"C:\\ChainPorthost\\msFont.exe\""	msFont.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSC99543B3E6D184F51871FE7B17FBFF0CA.TMP	csc.exe
File created	\??\c:\Windows\System32\wacrrm.exe	csc.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SppExtComObj.exe	msFont.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\e1ef82546f0b02	msFont.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Microsoft.NET\authman\spoolsv.exe	msFont.exe
File created	C:\Windows\Microsoft.NET\authman\f3b6ecef712a24	msFont.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3488	schtasks.exe
1852	schtasks.exe
1788	schtasks.exe
3068	schtasks.exe
3832	schtasks.exe
1596	schtasks.exe
3572	schtasks.exe
568	schtasks.exe
2348	schtasks.exe
4424	schtasks.exe
4000	schtasks.exe
3128	schtasks.exe
2700	schtasks.exe
5060	schtasks.exe
5116	schtasks.exe
2552	schtasks.exe
1972	schtasks.exe
5104	schtasks.exe

Delays execution with timeout.exe 4 IoCs

evasion

pid	Process
472	timeout.exe
2688	timeout.exe
3992	timeout.exe
944	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133475374630434142"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1725696949-2443092314-1471438111-1000_Classes\Local Settings	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1725696949-2443092314-1471438111-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1725696949-2443092314-1471438111-1000_Classes\Local Settings	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1725696949-2443092314-1471438111-1000_Classes\Local Settings	msFont.exe
Key created	\REGISTRY\USER\S-1-5-21-1725696949-2443092314-1471438111-1000_Classes\Local Settings	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1725696949-2443092314-1471438111-1000_Classes\Local Settings	setup.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4640	NOTEPAD.EXE

Runs net.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1372	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
492	chrome.exe
492	chrome.exe
4072	powershell.exe
4072	powershell.exe
2564	powershell.exe
2564	powershell.exe
3140	msFont.exe
3140	msFont.exe
3140	msFont.exe
3140	msFont.exe
3140	msFont.exe
3140	msFont.exe
3140	msFont.exe
3140	msFont.exe
3140	msFont.exe
3140	msFont.exe
3140	msFont.exe
3140	msFont.exe
3140	msFont.exe
3140	msFont.exe
3140	msFont.exe
3140	msFont.exe
3140	msFont.exe
3140	msFont.exe
3140	msFont.exe
3140	msFont.exe
3140	msFont.exe
3140	msFont.exe
3140	msFont.exe
3140	msFont.exe
3140	msFont.exe
3140	msFont.exe
3140	msFont.exe
3140	msFont.exe
3140	msFont.exe
3140	msFont.exe
3140	msFont.exe
3140	msFont.exe
3140	msFont.exe
3140	msFont.exe
3140	msFont.exe
3140	msFont.exe
3140	msFont.exe
3140	msFont.exe
3140	msFont.exe
3140	msFont.exe
3140	msFont.exe
3140	msFont.exe
3140	msFont.exe
3140	msFont.exe
3140	msFont.exe
3140	msFont.exe
3140	msFont.exe
3140	msFont.exe
3140	msFont.exe
3140	msFont.exe
3140	msFont.exe
3140	msFont.exe
3140	msFont.exe
3140	msFont.exe
3140	msFont.exe
3140	msFont.exe
3140	msFont.exe
3140	msFont.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
492	chrome.exe
492	chrome.exe

Suspicious use of AdjustPrivilegeToken 41 IoCs

description	pid	Process
Token: SeShutdownPrivilege	492	chrome.exe
Token: SeCreatePagefilePrivilege	492	chrome.exe
Token: SeShutdownPrivilege	492	chrome.exe
Token: SeCreatePagefilePrivilege	492	chrome.exe
Token: SeShutdownPrivilege	492	chrome.exe
Token: SeCreatePagefilePrivilege	492	chrome.exe
Token: SeShutdownPrivilege	492	chrome.exe
Token: SeCreatePagefilePrivilege	492	chrome.exe
Token: 33	4052	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4052	AUDIODG.EXE
Token: SeShutdownPrivilege	492	chrome.exe
Token: SeCreatePagefilePrivilege	492	chrome.exe
Token: SeShutdownPrivilege	492	chrome.exe
Token: SeCreatePagefilePrivilege	492	chrome.exe
Token: SeShutdownPrivilege	492	chrome.exe
Token: SeCreatePagefilePrivilege	492	chrome.exe
Token: SeShutdownPrivilege	492	chrome.exe
Token: SeCreatePagefilePrivilege	492	chrome.exe
Token: SeShutdownPrivilege	492	chrome.exe
Token: SeCreatePagefilePrivilege	492	chrome.exe
Token: SeShutdownPrivilege	492	chrome.exe
Token: SeCreatePagefilePrivilege	492	chrome.exe
Token: SeShutdownPrivilege	492	chrome.exe
Token: SeCreatePagefilePrivilege	492	chrome.exe
Token: SeShutdownPrivilege	492	chrome.exe
Token: SeCreatePagefilePrivilege	492	chrome.exe
Token: SeShutdownPrivilege	492	chrome.exe
Token: SeCreatePagefilePrivilege	492	chrome.exe
Token: SeShutdownPrivilege	492	chrome.exe
Token: SeCreatePagefilePrivilege	492	chrome.exe
Token: SeShutdownPrivilege	492	chrome.exe
Token: SeCreatePagefilePrivilege	492	chrome.exe
Token: SeShutdownPrivilege	492	chrome.exe
Token: SeCreatePagefilePrivilege	492	chrome.exe
Token: SeDebugPrivilege	4072	powershell.exe
Token: SeDebugPrivilege	2564	powershell.exe
Token: SeDebugPrivilege	3140	msFont.exe
Token: SeDebugPrivilege	656	msFont.exe
Token: SeDebugPrivilege	4072	msFont.exe
Token: SeDebugPrivilege	3136	msFont.exe
Token: SeDebugPrivilege	3964	msFont.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe
492	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 492 wrote to memory of 2120	492	chrome.exe	79
PID 492 wrote to memory of 2120	492	chrome.exe	79
PID 492 wrote to memory of 3968	492	chrome.exe	82
PID 492 wrote to memory of 3968	492	chrome.exe	82
PID 492 wrote to memory of 3968	492	chrome.exe	82
PID 492 wrote to memory of 3968	492	chrome.exe	82
PID 492 wrote to memory of 3968	492	chrome.exe	82
PID 492 wrote to memory of 3968	492	chrome.exe	82
PID 492 wrote to memory of 3968	492	chrome.exe	82
PID 492 wrote to memory of 3968	492	chrome.exe	82
PID 492 wrote to memory of 3968	492	chrome.exe	82
PID 492 wrote to memory of 3968	492	chrome.exe	82
PID 492 wrote to memory of 3968	492	chrome.exe	82
PID 492 wrote to memory of 3968	492	chrome.exe	82
PID 492 wrote to memory of 3968	492	chrome.exe	82
PID 492 wrote to memory of 3968	492	chrome.exe	82
PID 492 wrote to memory of 3968	492	chrome.exe	82
PID 492 wrote to memory of 3968	492	chrome.exe	82
PID 492 wrote to memory of 3968	492	chrome.exe	82
PID 492 wrote to memory of 3968	492	chrome.exe	82
PID 492 wrote to memory of 3968	492	chrome.exe	82
PID 492 wrote to memory of 3968	492	chrome.exe	82
PID 492 wrote to memory of 3968	492	chrome.exe	82
PID 492 wrote to memory of 3968	492	chrome.exe	82
PID 492 wrote to memory of 3968	492	chrome.exe	82
PID 492 wrote to memory of 3968	492	chrome.exe	82
PID 492 wrote to memory of 3968	492	chrome.exe	82
PID 492 wrote to memory of 3968	492	chrome.exe	82
PID 492 wrote to memory of 3968	492	chrome.exe	82
PID 492 wrote to memory of 3968	492	chrome.exe	82
PID 492 wrote to memory of 3968	492	chrome.exe	82
PID 492 wrote to memory of 3968	492	chrome.exe	82
PID 492 wrote to memory of 3968	492	chrome.exe	82
PID 492 wrote to memory of 3968	492	chrome.exe	82
PID 492 wrote to memory of 3968	492	chrome.exe	82
PID 492 wrote to memory of 3968	492	chrome.exe	82
PID 492 wrote to memory of 3968	492	chrome.exe	82
PID 492 wrote to memory of 3968	492	chrome.exe	82
PID 492 wrote to memory of 3968	492	chrome.exe	82
PID 492 wrote to memory of 3968	492	chrome.exe	82
PID 492 wrote to memory of 1112	492	chrome.exe	84
PID 492 wrote to memory of 1112	492	chrome.exe	84
PID 492 wrote to memory of 5040	492	chrome.exe	83
PID 492 wrote to memory of 5040	492	chrome.exe	83
PID 492 wrote to memory of 5040	492	chrome.exe	83
PID 492 wrote to memory of 5040	492	chrome.exe	83
PID 492 wrote to memory of 5040	492	chrome.exe	83
PID 492 wrote to memory of 5040	492	chrome.exe	83
PID 492 wrote to memory of 5040	492	chrome.exe	83
PID 492 wrote to memory of 5040	492	chrome.exe	83
PID 492 wrote to memory of 5040	492	chrome.exe	83
PID 492 wrote to memory of 5040	492	chrome.exe	83
PID 492 wrote to memory of 5040	492	chrome.exe	83
PID 492 wrote to memory of 5040	492	chrome.exe	83
PID 492 wrote to memory of 5040	492	chrome.exe	83
PID 492 wrote to memory of 5040	492	chrome.exe	83
PID 492 wrote to memory of 5040	492	chrome.exe	83
PID 492 wrote to memory of 5040	492	chrome.exe	83
PID 492 wrote to memory of 5040	492	chrome.exe	83
PID 492 wrote to memory of 5040	492	chrome.exe	83
PID 492 wrote to memory of 5040	492	chrome.exe	83
PID 492 wrote to memory of 5040	492	chrome.exe	83
PID 492 wrote to memory of 5040	492	chrome.exe	83
PID 492 wrote to memory of 5040	492	chrome.exe	83

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://mega.nz/file/RC9gBDpA#KBy1GOntXj1-3_y_yE8eQOiZBmASCfytncyFrPBUDzU
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffaf4d49758,0x7ffaf4d49768,0x7ffaf4d49778
  2⤵
  PID:2120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1628 --field-trial-handle=1796,i,10084992042186789423,3980421862231875625,131072 /prefetch:2
  2⤵
  PID:3968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2164 --field-trial-handle=1796,i,10084992042186789423,3980421862231875625,131072 /prefetch:8
  2⤵
  PID:5040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 --field-trial-handle=1796,i,10084992042186789423,3980421862231875625,131072 /prefetch:8
  2⤵
  PID:1112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3004 --field-trial-handle=1796,i,10084992042186789423,3980421862231875625,131072 /prefetch:1
  2⤵
  PID:716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2992 --field-trial-handle=1796,i,10084992042186789423,3980421862231875625,131072 /prefetch:1
  2⤵
  PID:2672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4776 --field-trial-handle=1796,i,10084992042186789423,3980421862231875625,131072 /prefetch:8
  2⤵
  PID:3900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5040 --field-trial-handle=1796,i,10084992042186789423,3980421862231875625,131072 /prefetch:8
  2⤵
  PID:1260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4808 --field-trial-handle=1796,i,10084992042186789423,3980421862231875625,131072 /prefetch:8
  2⤵
  PID:1084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3616 --field-trial-handle=1796,i,10084992042186789423,3980421862231875625,131072 /prefetch:8
  2⤵
  PID:3940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5392 --field-trial-handle=1796,i,10084992042186789423,3980421862231875625,131072 /prefetch:8
  2⤵
  PID:3684

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4400

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004F0 0x00000000000004EC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4052

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1952

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\SetupVi\START.bat" "
1⤵
PID:1632
- C:\Windows\system32\net.exe
  NET FILE
  2⤵
  PID:2164
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 FILE
    3⤵
    PID:2516
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionExtension '.exe','.bat','.vbe','.zip' >$null 2>&1"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4072
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  - Delays execution with timeout.exe
  PID:472
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Expand-Archive -Path 'C:\Users\Admin\Desktop\SetupVi\UAC\setup.zip' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\SetupTemp' -Force"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2564
- C:\Users\Admin\AppData\Local\Temp\SetupTemp\setup.exe
  "C:\Users\Admin\AppData\Local\Temp\SetupTemp\setup.exe"
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  PID:3312
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\ChainPorthost\JhFXOpnZqT77dU5ZZiRHSz6g4OxW2yGxPtdK5A.vbe"
    3⤵
    PID:2616
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\ChainPorthost\ejegsXrvUMLGJN15XBQZYF4KfEY9pYRkILnfh76eD49.bat" "
      4⤵
      PID:3612
    - - C:\ChainPorthost\msFont.exe
        
        "C:\ChainPorthost/msFont.exe"
        5⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        Drops file in Windows directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3140
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\oti0h1ns\oti0h1ns.cmdline"
        6⤵
        Drops file in System32 directory
        
        PID:4724
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES217D.tmp" "c:\Windows\System32\CSC99543B3E6D184F51871FE7B17FBFF0CA.TMP"
        7⤵
        
        PID:3444
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\H8S9Oa3LSw.bat"
        6⤵
        
        PID:2084
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        7⤵
        Runs ping.exe
        
        PID:1372
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:1192
        
        C:\ChainPorthost\msFont.exe
        
        "C:\ChainPorthost\msFont.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:656
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  - Delays execution with timeout.exe
  PID:2688
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  - Delays execution with timeout.exe
  PID:3992
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  - Delays execution with timeout.exe
  PID:944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\Microsoft.NET\authman\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Windows\Microsoft.NET\authman\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\Windows\Microsoft.NET\authman\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\ChainPorthost\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\ChainPorthost\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\ChainPorthost\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\ChainPorthost\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\ChainPorthost\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msFontm" /sc MINUTE /mo 7 /tr "'C:\ChainPorthost\msFont.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\ChainPorthost\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msFont" /sc ONLOGON /tr "'C:\ChainPorthost\msFont.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msFontm" /sc MINUTE /mo 13 /tr "'C:\ChainPorthost\msFont.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4000

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\SetupVi\README.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:4640

C:\Users\Admin\Desktop\setup.exe
"C:\Users\Admin\Desktop\setup.exe"
1⤵
- Modifies registry class
PID:3512
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\ChainPorthost\JhFXOpnZqT77dU5ZZiRHSz6g4OxW2yGxPtdK5A.vbe"
  2⤵
  PID:1412
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\ChainPorthost\ejegsXrvUMLGJN15XBQZYF4KfEY9pYRkILnfh76eD49.bat" "
    3⤵
    PID:2364
  - - C:\ChainPorthost\msFont.exe
      "C:\ChainPorthost/msFont.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:4072

C:\Users\Admin\Desktop\setup.exe
"C:\Users\Admin\Desktop\setup.exe"
1⤵
- Modifies registry class
PID:128
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\ChainPorthost\JhFXOpnZqT77dU5ZZiRHSz6g4OxW2yGxPtdK5A.vbe"
  2⤵
  PID:3172
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\ChainPorthost\ejegsXrvUMLGJN15XBQZYF4KfEY9pYRkILnfh76eD49.bat" "
    3⤵
    PID:3192
  - - C:\ChainPorthost\msFont.exe
      "C:\ChainPorthost/msFont.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:3136

C:\Users\Admin\Desktop\setup.exe
"C:\Users\Admin\Desktop\setup.exe"
1⤵
- Modifies registry class
PID:4724
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\ChainPorthost\JhFXOpnZqT77dU5ZZiRHSz6g4OxW2yGxPtdK5A.vbe"
  2⤵
  PID:3572
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\ChainPorthost\ejegsXrvUMLGJN15XBQZYF4KfEY9pYRkILnfh76eD49.bat" "
    3⤵
    PID:1528
  - - C:\ChainPorthost\msFont.exe
      "C:\ChainPorthost/msFont.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:3964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ChainPorthost\JhFXOpnZqT77dU5ZZiRHSz6g4OxW2yGxPtdK5A.vbe

Filesize
234B

MD5
3632c22b92df1495ff049a06bc800260

SHA1
9096ab13101434dce2019c276259d555cb9f5846

SHA256
bdd9f3fae572716f343901d060b70d04ed18b0623beef6f5d3f4defc9e958372

SHA512
65e95cd7f23f9cb1a60e142dee77031036c8cbca5c577276600de840e7fb114b6c910c248f871971bb38d1c30e6cd71b56e667745b9c67c7c7265ec1cc070702

Download Submit
C:\ChainPorthost\ejegsXrvUMLGJN15XBQZYF4KfEY9pYRkILnfh76eD49.bat

Filesize
73B

MD5
42323dfedc931d4eee66a3bdcf24e49a

SHA1
c1227e702fc3bab5746899e05996cc417ea3741d

SHA256
46df4dfe47aece3932ab0197bbc284a05648d03e5fc2683ac7bfed3e6bfdcc39

SHA512
5a4ad64318e6d80b6d901f99bad68df8d9663e528db27073776bca3066f43a6fbcce4391e3d75afce30d310a3a46ffe32210c950eeb9a49819033d9473062ed0

Download Submit
C:\ChainPorthost\msFont.exe

Filesize
3.1MB

MD5
7453deef0f27042ec6ebdd0c557e9357

SHA1
c1240bfe6a3aac7ba0a242ab4a25bfdc53e6f084

SHA256
70335e2afd31ef6d7944615d876b758406a20994728496ffae63059647ad5f56

SHA512
4f8cd5ca2c7bfdcd560f2185a4efc823100bcd08c1654e94b630f1b2e62b21ecf3d60048dfe4d9abecbb0f3c8d199705473147d640466877cff820a98b2aead7

Download Submit
C:\ChainPorthost\msFont.exe

Filesize
3.1MB

MD5
a131bfcccd79677e89ef15ac0628e8ea

SHA1
7a65bf57f604ff011eedc2716daa11a6e15d6d9a

SHA256
c015a5467c75f9f39f687da0f09418d576d2133c5affd1bfa89ffd4df5468b51

SHA512
0813a98724cbec0f982edf93335f03f99c3e1f6abd8ce17e6febc6cec8ee01e4ec89e5fba03b40f896b3b2eafe7d764ddbf549210c6de96fe986152fd2c3ffa1

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\SppExtComObj.exe

Filesize
982KB

MD5
67cff106df2653cd595427da830c1cb6

SHA1
a6340d042eba85ad83b5792aedb22a8d7cd955cf

SHA256
3c9fadd2feb9552bffe4d04570dccf8249e5378a7cac98444884f484e03b4eb5

SHA512
03757bfbbf26e0080f0350d750cdfe38d626fd872c757d758cc59a8dfd053dd72d3f92bde1b8a6c88fa43b6efb2fab7aeaaa8273d13a83076e849b8234ff4c87

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000027

Filesize
17KB

MD5
950eca48e414acbe2c3b5d046dcb8521

SHA1
1731f264e979f18cdf08c405c7b7d32789a6fb59

SHA256
c0bbe530abfce19e06697bc4358eb426e076ccdb9113e22df4a6f32085da67a2

SHA512
27e55525ade4d099a6881011f6e2e0d5d3a9ca7181f4f014dc231d40b3b1907d0d437b0c44d336c25dd7b73209cd773b8563675ac260c43c7752e2d2d694d4d9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
2d34190034268321add6f1a89a98e389

SHA1
67531ca8903fd29aec8c55d6c05a637f85afb55f

SHA256
8b75767d225bb7b82ab9069c2400f44634b46e98811bd500d90cd0d9d3d5334c

SHA512
13ce7e09708543e674c1447f75e6100f5b19454ce924d2b7006f138bad58c4ad042455f99c81d5c5a062c141a10c08074e907be3729ddf08b8ab24f8d9654715

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History

Filesize
148KB

MD5
ea2d4e3e0a0c5614a7a8f712dfc198ac

SHA1
cf3aeec554681390afdf0341c22054751b8319a4

SHA256
4198fe2790cccaab897855b673d8b77124f16466293c92ed6adfecf7c6a55e35

SHA512
eca5548e0aca3871667ad5c5104df855fe1cd6cf319bb8a645ee894ebe1b2eeb1672c5c97a00243d4be526f86ef7e21caf9635b2bcbc8eafcfcbac98fb267953

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
21000d3e2624c8e6bdf9e649ecfacfba

SHA1
5b9e41da28d1aa2f7ed8e168a6015ef3a309863f

SHA256
86efd5743a3d05d763fe9a8b50d86adf16b5411b5834432b4f1158187662b5e2

SHA512
92b1f17c3e575cbde7e8459e1a4f3765f7bae5140a66e4d5ae55d22a4232d4c9015f21dcee776ac682fb3f45c37718ed1de1ea9e84779d14150007a0f9214ca3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
4ad54a1380740fbd48332ce00b80d539

SHA1
5e24f31f6820f25cd1523d33a4be64d15f10b54f

SHA256
160ba1833dad8a60ae0c7983e8ac585fb6f06fd3ca3c3b9e89434664bea2224a

SHA512
8da6d221edb1bde7fc82060ecd1ff6f6c52811c1434d8ed2fa79d26933dfa7e39586c02f7e2e9f0f1bc4dc1459982c8a56db2562d9ecc0ec10a8a31d2f555957

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
538B

MD5
6f45b7c9066a077cfa4cd21fa156f25e

SHA1
54a1ac7bb64bc409fe479c9d7d3a2d0f1c428437

SHA256
83475549ffa2c6d814728d56c03bac2f1fa35dc718d7961fe750d1bf0dffc25a

SHA512
6e459bdce1ff3b137417c7783b945946f5af5c59acd3e34b9f3354478a95d9908d8d842b1bb440f81f7fd2ffa33c4933b2f33b086b02a88aecf676500d75fdb7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
c4111412142e4e89c16a4fa929340ac3

SHA1
6d265659b21954f58dce5240b833f1dd8182b820

SHA256
152c0024828afc5bb8fe57e43f553f9441a4b62dff28b9c691be7e211211d06a

SHA512
086c750abbd3bd6a45fcea00c7c0a97f54f71dcdcbec0c858266a7623df398af089821abe50b6c610509d32c1add5988e66c3cf177bb1caa2a1ff5ba33e3ecac

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
877be187fbf63e8a2ec2659a63c7cc30

SHA1
854393242886932fe0a634517a3fe5c6226a2325

SHA256
61224241f73588e3bad0c5551cbcba1ec348cc6a9e12d9ff734d5771f824edbb

SHA512
c966c8927996c512ce4b871eba7d7db9bea946fdb9cbd4225941892560c2cb9590e4e6a8a33968fd3897c9e6543bbc1003ad4fa8fbaed862f768f91bc6f9e8c6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
c4c3a0a19a35e6ab1c2d2d64f51c6e16

SHA1
7fb92042b941578c191090a60ea85e3b9aed429c

SHA256
88eed03bc1a84251371406bbdefe097c5edf536086b75e50fa7d6bf8cdee0a32

SHA512
723d69e52aa2948ce15e734e7462d87af82a955fecac1048a4a7d53c6c8fbe0db51fcbf2e733b6b5a5a20fdf7f1204c72921c1e2060a41c019d82c2c301d3776

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57b92e.TMP

Filesize
48B

MD5
1b4e2c9e70996b4ed8894da50624824a

SHA1
21d18e67b9e23a98fb97958f3e0034da90bbc782

SHA256
a8b02ac62d0c73e8c4ca939f881c79bb530668b95b468683a4a06b7cc5cb858c

SHA512
821afaa217047ca3168617ac5481cb1786c703ee371d95e97db83eb9d8eea726302d0d6acbcc42d5431ed5a30ceb0c59288ecdbf9f32d92dc327bd67e5d7e84f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
114KB

MD5
f95c4606ff4458813bbc5e15597d7198

SHA1
8323d643fa32c4679ecef1518c1197475a810fe0

SHA256
25df0b519574a44bd6f59a4b069bc8eb7a6ca03e105297eac320879acb1df01f

SHA512
21ee026b12766d18db5196ef856c252a76de4514e29ae61106edb295cbb4b24926fd34bd6c8f4d59218b73296921483456105db8a3bb30de960e5ed26808945e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
114KB

MD5
2c4a40a19bb0e038a92117bd100fae6e

SHA1
e7a58de7ca2310280ee9d0eebd905cab4246009c

SHA256
2de1d5dee60c2018647b7c1fdd8718d4c735fc3c72d8e71ad2b4aa59ecdbf2a1

SHA512
5e2fa98eed9cce0fb292f667f09cc349c6f421db4beb78c6e40e905df3090847c4f81ec1cf26033187db053e8d485cf7aa9efe96c8760f9150d48a3ea2b58f39

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\msFont.exe.log

Filesize
1KB

MD5
1684cd6afdfb7fe412dd27f426064cf5

SHA1
252d8f5815d46d85cd284cc18a30855f7b9af13e

SHA256
8e8f47176b24f335bd198d1525b530063f0ada4e08730593416393e61022439a

SHA512
12a32810d3e1d37536845553a6f6f997876e129f7b0975d8d36a4cbf34e326eb4b213d920266e60869c6f805c334f4983f511f937548d0552c0df2704e99570b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
627073ee3ca9676911bee35548eff2b8

SHA1
4c4b68c65e2cab9864b51167d710aa29ebdcff2e

SHA256
85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

SHA512
3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
1a9fa92a4f2e2ec9e244d43a6a4f8fb9

SHA1
9910190edfaccece1dfcc1d92e357772f5dae8f7

SHA256
0ee052d5333fd5fd86bc84856fec98e045f077a7ac8051651bf7c521b9706888

SHA512
5d2361476fa22200e6f83883efe7dcb8c3fe7dae8d56e04e28a36e9ae1270c327b6aa161d92b239593da7661289d002c574446ecfd6bd19928209aae25e3ef64

Download Submit
C:\Users\Admin\AppData\Local\Temp\H8S9Oa3LSw.bat

Filesize
155B

MD5
c97da8ca79ba0a1f97890e221636e197

SHA1
b8bb72b95eedd9c63168c27fa925bf464eff54a9

SHA256
b98edd785834b22fd0fda7c8efd6e64051685faed70c40b5cae1c137e78a35ee

SHA512
d100e5697ae733d8d225b8ae5b937244bac6ad9cad1289781ca034d915f41fe4dfd2f31fe83437ee3053ea62680c80c0ebc56d08c24537a6e851a6080c8a2eb9

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES217D.tmp

Filesize
1KB

MD5
193d6e93864c9506ab845ce19bc31615

SHA1
823db51f95d1c641b1dec37249f61497798334fa

SHA256
5f74888aa212c92c03171823f1c96c1df476f99666671e11424aea8d466ce64e

SHA512
e24741c678233bd8729ff93311c87fc2f20a719383a0d22b26ef4aa8940daf584eb79f520875ce472075671bbbe19f04ff019e10bc0397362813ab731c5b68be

Download Submit
C:\Users\Admin\AppData\Local\Temp\SetupTemp\setup.exe

Filesize
114KB

MD5
6cdb6345d156ef943f37f2b249da95e5

SHA1
d5aa898b711fd3f531892b0513fdfa41a6e8f88d

SHA256
d1475bf4ec4e3c83458445db902cef9bcce494abcb558e0597597fb118a09503

SHA512
48429ac7228f395d69ca195ca5356aa606600d973524835caa37106af8cf1ec288fb56b65dffef49b3aa978a8e0888c71af278e8eeb455d08173d3198ee511bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\SetupTemp\setup.exe

Filesize
53KB

MD5
78721a4af689684ad9f88a81d3ad4279

SHA1
f5c8b7f53934375ed7811555c2959948201814d9

SHA256
fc269fc2691e4a6d60ddd27ed7617ff37f1abb9a94d68e4a58b66a4eecca69ba

SHA512
cc0e3aa6de1967d278b103320651ddfdceca909105ad89640ed4117c4f7c0ffff2fa36a00b61fa890426a353e4cd96d60fb3384c8e74816625c964932e8380f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hdqlpbcx.mk4.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Downloads\SetupVi.zip

Filesize
6.5MB

MD5
d4f0e925b3ad4ab8f1c45a67c353ce59

SHA1
14ed9be4ee2018fb0ee0b5e03fa33fa126a06b36

SHA256
5c01b40c4db698ed54ded8320f25b6888a30f8ebd9395367e5bee74d953b1eba

SHA512
68dabbded9735b9be1e2a2ec35a46642de70b0a99b99f1318af1723e43e8519b5033184d3428f4cd6cadd1f3952c71ff01893c185a4e217c2f89e22e170dc276

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\oti0h1ns\oti0h1ns.0.cs

Filesize
371B

MD5
9ecf339f04dafe3d8f1b6dacd74d8b0c

SHA1
75eb69c4a108ce7e2efa5da4dcb35359940ed7ee

SHA256
626022c9d848fd2115882513ad136336ae9e8a26993b3ccaab748e3d73994c95

SHA512
0ff4e154c9f28e24f5d4558c0599a9959c315c19af594cfb2283cb436a3a56507f6e0af73bb726aef4aadac6edc083b45c3478bac35ad0678e5f706dd9812fc6

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\oti0h1ns\oti0h1ns.cmdline

Filesize
235B

MD5
680b3b621db987988ba3a9dadd050228

SHA1
08ada4b6bc7ab1e67a60334e36fc8e652a4854eb

SHA256
5972ac1e4691d173b31f4a2b4545c2ec1e0ad06035930e5477ff0453d2432eac

SHA512
bb5ff97d8aa83fdbe39ea2f0a057b3d25b0f5217e0536d1a9140293c41f004ae9659190bb2d60b616c00e863fca18d987dd57974551d798faf8c619ec0e9f837

Download Submit
\??\c:\Windows\System32\CSC99543B3E6D184F51871FE7B17FBFF0CA.TMP

Filesize
1KB

MD5
6eaa6e5023e1227fba7d3417c294f736

SHA1
52f453de297f89a279acd78aaaef29ae69f5ecb1

SHA256
57a212bd8496f460c7424d398d8565cfc07be5c068ec0c5dd6efcbaa3c570625

SHA512
5dab692100abfb5a039a352549fe5f2e5d34a092dc9cb39dd1082ced45e1f40f2cc2454341eeae12fb4a6eb7aa401b785c493069040101071dcaf1c61b99c275

Download Submit
memory/656-462-0x0000000000FF0000-0x0000000000FF1000-memory.dmp

Filesize
4KB

Download
memory/656-461-0x000000001B670000-0x000000001B680000-memory.dmp

Filesize
64KB

Download
memory/656-500-0x000000001CA10000-0x000000001CB2E000-memory.dmp

Filesize
1.1MB

Download
memory/656-474-0x00007FFB02C50000-0x00007FFB02C51000-memory.dmp

Filesize
4KB

Download
memory/656-466-0x00007FFB02C90000-0x00007FFB02C91000-memory.dmp

Filesize
4KB

Download
memory/656-464-0x00007FFB02CA0000-0x00007FFB02CA1000-memory.dmp

Filesize
4KB

Download
memory/656-472-0x00007FFB02C60000-0x00007FFB02C61000-memory.dmp

Filesize
4KB

Download
memory/656-470-0x00007FFB02C70000-0x00007FFB02C71000-memory.dmp

Filesize
4KB

Download
memory/656-460-0x00007FFAE26D0000-0x00007FFAE3192000-memory.dmp

Filesize
10.8MB

Download
memory/656-468-0x00007FFB02C80000-0x00007FFB02C81000-memory.dmp

Filesize
4KB

Download
memory/2564-336-0x00007FFAE26D0000-0x00007FFAE3192000-memory.dmp

Filesize
10.8MB

Download
memory/2564-337-0x000001E263190000-0x000001E2631A0000-memory.dmp

Filesize
64KB

Download
memory/2564-353-0x00007FFAE26D0000-0x00007FFAE3192000-memory.dmp

Filesize
10.8MB

Download
memory/2564-338-0x000001E263190000-0x000001E2631A0000-memory.dmp

Filesize
64KB

Download
memory/2564-349-0x000001E2632B0000-0x000001E2632BA000-memory.dmp

Filesize
40KB

Download
memory/2564-348-0x000001E263620000-0x000001E263632000-memory.dmp

Filesize
72KB

Download
memory/3140-385-0x00007FFB02C80000-0x00007FFB02C81000-memory.dmp

Filesize
4KB

Download
memory/3140-389-0x00007FFB02C60000-0x00007FFB02C61000-memory.dmp

Filesize
4KB

Download
memory/3140-392-0x00007FFB02C50000-0x00007FFB02C51000-memory.dmp

Filesize
4KB

Download
memory/3140-391-0x000000001BAD0000-0x000000001BADE000-memory.dmp

Filesize
56KB

Download
memory/3140-379-0x000000001BB20000-0x000000001BB70000-memory.dmp

Filesize
320KB

Download
memory/3140-380-0x00007FFB02C90000-0x00007FFB02C91000-memory.dmp

Filesize
4KB

Download
memory/3140-394-0x000000001BAE0000-0x000000001BAEE000-memory.dmp

Filesize
56KB

Download
memory/3140-396-0x000000001BAF0000-0x000000001BAFC000-memory.dmp

Filesize
48KB

Download
memory/3140-398-0x000000001BBB0000-0x000000001BBC0000-memory.dmp

Filesize
64KB

Download
memory/3140-397-0x00007FFAE26D0000-0x00007FFAE3192000-memory.dmp

Filesize
10.8MB

Download
memory/3140-403-0x000000001BB70000-0x000000001BB82000-memory.dmp

Filesize
72KB

Download
memory/3140-401-0x00007FFB02C20000-0x00007FFB02C21000-memory.dmp

Filesize
4KB

Download
memory/3140-405-0x000000001BB90000-0x000000001BBA6000-memory.dmp

Filesize
88KB

Download
memory/3140-406-0x00007FFB02C10000-0x00007FFB02C11000-memory.dmp

Filesize
4KB

Download
memory/3140-409-0x000000001BB00000-0x000000001BB0E000-memory.dmp

Filesize
56KB

Download
memory/3140-400-0x00007FFB02C30000-0x00007FFB02C31000-memory.dmp

Filesize
4KB

Download
memory/3140-408-0x00007FFB02C00000-0x00007FFB02C01000-memory.dmp

Filesize
4KB

Download
memory/3140-399-0x00007FFB02C40000-0x00007FFB02C41000-memory.dmp

Filesize
4KB

Download
memory/3140-412-0x00007FFB02BF0000-0x00007FFB02BF1000-memory.dmp

Filesize
4KB

Download
memory/3140-411-0x000000001BB10000-0x000000001BB20000-memory.dmp

Filesize
64KB

Download
memory/3140-414-0x000000001BFC0000-0x000000001BFD0000-memory.dmp

Filesize
64KB

Download
memory/3140-415-0x00007FFB02BE0000-0x00007FFB02BE1000-memory.dmp

Filesize
4KB

Download
memory/3140-418-0x000000001C030000-0x000000001C08A000-memory.dmp

Filesize
360KB

Download
memory/3140-416-0x00007FFB02BD0000-0x00007FFB02BD1000-memory.dmp

Filesize
4KB

Download
memory/3140-420-0x000000001BFD0000-0x000000001BFE0000-memory.dmp

Filesize
64KB

Download
memory/3140-421-0x00007FFB02BC0000-0x00007FFB02BC1000-memory.dmp

Filesize
4KB

Download
memory/3140-422-0x00007FFB02BB0000-0x00007FFB02BB1000-memory.dmp

Filesize
4KB

Download
memory/3140-424-0x000000001BFE0000-0x000000001BFEE000-memory.dmp

Filesize
56KB

Download
memory/3140-426-0x000000001C0E0000-0x000000001C12E000-memory.dmp

Filesize
312KB

Download
memory/3140-427-0x00007FFB02BA0000-0x00007FFB02BA1000-memory.dmp

Filesize
4KB

Download
memory/3140-388-0x0000000002F90000-0x0000000002FA0000-memory.dmp

Filesize
64KB

Download
memory/3140-384-0x0000000002F80000-0x0000000002F90000-memory.dmp

Filesize
64KB

Download
memory/3140-386-0x00007FFB02C70000-0x00007FFB02C71000-memory.dmp

Filesize
4KB

Download
memory/3140-382-0x000000001BAA0000-0x000000001BAB8000-memory.dmp

Filesize
96KB

Download
memory/3140-378-0x0000000002FA0000-0x0000000002FBC000-memory.dmp

Filesize
112KB

Download
memory/3140-374-0x00007FFB02CA0000-0x00007FFB02CA1000-memory.dmp

Filesize
4KB

Download
memory/3140-457-0x00007FFAE26D0000-0x00007FFAE3192000-memory.dmp

Filesize
10.8MB

Download
memory/3140-376-0x0000000002F70000-0x0000000002F7E000-memory.dmp

Filesize
56KB

Download
memory/3140-373-0x000000001BBB0000-0x000000001BBC0000-memory.dmp

Filesize
64KB

Download
memory/3140-372-0x00000000015F0000-0x00000000015F1000-memory.dmp

Filesize
4KB

Download
memory/3140-371-0x000000001BBB0000-0x000000001BBC0000-memory.dmp

Filesize
64KB

Download
memory/3140-369-0x00007FFAE26D0000-0x00007FFAE3192000-memory.dmp

Filesize
10.8MB

Download
memory/3140-370-0x0000000000AC0000-0x0000000000DE8000-memory.dmp

Filesize
3.2MB

Download
memory/4072-333-0x00007FFAE16C0000-0x00007FFAE2182000-memory.dmp

Filesize
10.8MB

Download
memory/4072-330-0x0000013EDE700000-0x0000013EDE710000-memory.dmp

Filesize
64KB

Download
memory/4072-327-0x00007FFAE16C0000-0x00007FFAE2182000-memory.dmp

Filesize
10.8MB

Download
memory/4072-329-0x0000013EDE700000-0x0000013EDE710000-memory.dmp

Filesize
64KB

Download
memory/4072-328-0x0000013EDE700000-0x0000013EDE710000-memory.dmp

Filesize
64KB

Download
memory/4072-326-0x0000013EC6120000-0x0000013EC6142000-memory.dmp

Filesize
136KB

Download