29c0f7f08d4a20f83a65b9d32a5b6c268964bc252eb10186eaf5dfe279559a24

Analysis

max time kernel
150s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23/07/2024, 23:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ZeusServerSide.exe
Size 37KB
Sample240723-22358atfnn
SHA256 29c0f7f08d4a20f83a65b9d32a5b6c268964bc252eb10186eaf5dfe279559a24
MD5 369d5903e99751670ef0942318662c65
SHA1 2c688d2bb6b3a14358cb8977d798a7bd6efc5292
SHA512 b8e69d168f038be28a260f1f6dd1e0f648878e9b66a660b243d6bb1fd59e66375c110e358ed4fc5c04cf4dae7c63bb2a518e29be1fd1236e6bca1e7bd5d878d6
SSDEEP 384:kKjoUiFebK7FmpE8QyEfuifpefHCwSrAF+rMRTyN/0L+EcoinblneHQM3epzXoNK:Vt2n8LEfuiAvCzrM+rMRa8NuK0t
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery evasion persistence privilege_escalation

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3692	netsh.exe

Executes dropped EXE 1 IoCs

pid	Process
7020	ZeusServerSide4.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	chrome.exe
File created	\??\c:\windows\system32\driverstore\filerepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZeusServerSide4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZeusServerSide.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133662495616401897"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3568	chrome.exe
3568	chrome.exe
4640	ZeusServerSide.exe
4640	ZeusServerSide.exe
4640	ZeusServerSide.exe
4640	ZeusServerSide.exe
4640	ZeusServerSide.exe
4640	ZeusServerSide.exe
4640	ZeusServerSide.exe
4640	ZeusServerSide.exe
4640	ZeusServerSide.exe
4640	ZeusServerSide.exe
4640	ZeusServerSide.exe
4640	ZeusServerSide.exe
4640	ZeusServerSide.exe
4640	ZeusServerSide.exe
4640	ZeusServerSide.exe
4640	ZeusServerSide.exe
4640	ZeusServerSide.exe
4640	ZeusServerSide.exe
4640	ZeusServerSide.exe
4640	ZeusServerSide.exe
4640	ZeusServerSide.exe
4640	ZeusServerSide.exe
4640	ZeusServerSide.exe
4640	ZeusServerSide.exe
4640	ZeusServerSide.exe
4640	ZeusServerSide.exe
4640	ZeusServerSide.exe
4640	ZeusServerSide.exe
4640	ZeusServerSide.exe
4640	ZeusServerSide.exe
4640	ZeusServerSide.exe
4640	ZeusServerSide.exe
4640	ZeusServerSide.exe
4640	ZeusServerSide.exe
4640	ZeusServerSide.exe
4640	ZeusServerSide.exe
4640	ZeusServerSide.exe
4640	ZeusServerSide.exe
4640	ZeusServerSide.exe
4640	ZeusServerSide.exe
4640	ZeusServerSide.exe
4640	ZeusServerSide.exe
4640	ZeusServerSide.exe
4640	ZeusServerSide.exe
4640	ZeusServerSide.exe
4640	ZeusServerSide.exe
4640	ZeusServerSide.exe
4640	ZeusServerSide.exe
4640	ZeusServerSide.exe
4640	ZeusServerSide.exe
4640	ZeusServerSide.exe
4640	ZeusServerSide.exe
4640	ZeusServerSide.exe
4640	ZeusServerSide.exe
4640	ZeusServerSide.exe
4640	ZeusServerSide.exe
4640	ZeusServerSide.exe
4640	ZeusServerSide.exe
4640	ZeusServerSide.exe
4640	ZeusServerSide.exe
4640	ZeusServerSide.exe
4640	ZeusServerSide.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs

pid	Process
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3568	chrome.exe
Token: SeCreatePagefilePrivilege	3568	chrome.exe
Token: SeShutdownPrivilege	3568	chrome.exe
Token: SeCreatePagefilePrivilege	3568	chrome.exe
Token: SeShutdownPrivilege	3568	chrome.exe
Token: SeCreatePagefilePrivilege	3568	chrome.exe
Token: SeDebugPrivilege	4640	ZeusServerSide.exe
Token: 33	4640	ZeusServerSide.exe
Token: SeIncBasePriorityPrivilege	4640	ZeusServerSide.exe
Token: SeShutdownPrivilege	3568	chrome.exe
Token: SeCreatePagefilePrivilege	3568	chrome.exe
Token: SeShutdownPrivilege	3568	chrome.exe
Token: SeCreatePagefilePrivilege	3568	chrome.exe
Token: SeShutdownPrivilege	3568	chrome.exe
Token: SeCreatePagefilePrivilege	3568	chrome.exe
Token: SeShutdownPrivilege	3568	chrome.exe
Token: SeCreatePagefilePrivilege	3568	chrome.exe
Token: SeShutdownPrivilege	3568	chrome.exe
Token: SeCreatePagefilePrivilege	3568	chrome.exe
Token: SeShutdownPrivilege	3568	chrome.exe
Token: SeCreatePagefilePrivilege	3568	chrome.exe
Token: SeShutdownPrivilege	3568	chrome.exe
Token: SeCreatePagefilePrivilege	3568	chrome.exe
Token: SeShutdownPrivilege	3568	chrome.exe
Token: SeCreatePagefilePrivilege	3568	chrome.exe
Token: 33	4640	ZeusServerSide.exe
Token: SeIncBasePriorityPrivilege	4640	ZeusServerSide.exe
Token: SeShutdownPrivilege	3568	chrome.exe
Token: SeCreatePagefilePrivilege	3568	chrome.exe
Token: SeShutdownPrivilege	3568	chrome.exe
Token: SeCreatePagefilePrivilege	3568	chrome.exe
Token: SeShutdownPrivilege	3568	chrome.exe
Token: SeCreatePagefilePrivilege	3568	chrome.exe
Token: SeShutdownPrivilege	3568	chrome.exe
Token: SeCreatePagefilePrivilege	3568	chrome.exe
Token: SeShutdownPrivilege	3568	chrome.exe
Token: SeCreatePagefilePrivilege	3568	chrome.exe
Token: SeShutdownPrivilege	3568	chrome.exe
Token: SeCreatePagefilePrivilege	3568	chrome.exe
Token: SeShutdownPrivilege	3568	chrome.exe
Token: SeCreatePagefilePrivilege	3568	chrome.exe
Token: SeShutdownPrivilege	3568	chrome.exe
Token: SeCreatePagefilePrivilege	3568	chrome.exe
Token: 33	4640	ZeusServerSide.exe
Token: SeIncBasePriorityPrivilege	4640	ZeusServerSide.exe
Token: SeShutdownPrivilege	3568	chrome.exe
Token: SeCreatePagefilePrivilege	3568	chrome.exe
Token: SeShutdownPrivilege	3568	chrome.exe
Token: SeCreatePagefilePrivilege	3568	chrome.exe
Token: SeShutdownPrivilege	3568	chrome.exe
Token: SeCreatePagefilePrivilege	3568	chrome.exe
Token: SeShutdownPrivilege	3568	chrome.exe
Token: SeCreatePagefilePrivilege	3568	chrome.exe
Token: SeShutdownPrivilege	3568	chrome.exe
Token: SeCreatePagefilePrivilege	3568	chrome.exe
Token: SeShutdownPrivilege	3568	chrome.exe
Token: SeCreatePagefilePrivilege	3568	chrome.exe
Token: SeShutdownPrivilege	3568	chrome.exe
Token: SeCreatePagefilePrivilege	3568	chrome.exe
Token: SeShutdownPrivilege	3568	chrome.exe
Token: SeCreatePagefilePrivilege	3568	chrome.exe
Token: 33	4640	ZeusServerSide.exe
Token: SeIncBasePriorityPrivilege	4640	ZeusServerSide.exe
Token: SeShutdownPrivilege	3568	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe
3568	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4640 wrote to memory of 3692	4640	ZeusServerSide.exe	94
PID 4640 wrote to memory of 3692	4640	ZeusServerSide.exe	94
PID 4640 wrote to memory of 3692	4640	ZeusServerSide.exe	94
PID 3568 wrote to memory of 4336	3568	chrome.exe	98
PID 3568 wrote to memory of 4336	3568	chrome.exe	98
PID 3568 wrote to memory of 3240	3568	chrome.exe	99
PID 3568 wrote to memory of 3240	3568	chrome.exe	99
PID 3568 wrote to memory of 3240	3568	chrome.exe	99
PID 3568 wrote to memory of 3240	3568	chrome.exe	99
PID 3568 wrote to memory of 3240	3568	chrome.exe	99
PID 3568 wrote to memory of 3240	3568	chrome.exe	99
PID 3568 wrote to memory of 3240	3568	chrome.exe	99
PID 3568 wrote to memory of 3240	3568	chrome.exe	99
PID 3568 wrote to memory of 3240	3568	chrome.exe	99
PID 3568 wrote to memory of 3240	3568	chrome.exe	99
PID 3568 wrote to memory of 3240	3568	chrome.exe	99
PID 3568 wrote to memory of 3240	3568	chrome.exe	99
PID 3568 wrote to memory of 3240	3568	chrome.exe	99
PID 3568 wrote to memory of 3240	3568	chrome.exe	99
PID 3568 wrote to memory of 3240	3568	chrome.exe	99
PID 3568 wrote to memory of 3240	3568	chrome.exe	99
PID 3568 wrote to memory of 3240	3568	chrome.exe	99
PID 3568 wrote to memory of 3240	3568	chrome.exe	99
PID 3568 wrote to memory of 3240	3568	chrome.exe	99
PID 3568 wrote to memory of 3240	3568	chrome.exe	99
PID 3568 wrote to memory of 3240	3568	chrome.exe	99
PID 3568 wrote to memory of 3240	3568	chrome.exe	99
PID 3568 wrote to memory of 3240	3568	chrome.exe	99
PID 3568 wrote to memory of 3240	3568	chrome.exe	99
PID 3568 wrote to memory of 3240	3568	chrome.exe	99
PID 3568 wrote to memory of 3240	3568	chrome.exe	99
PID 3568 wrote to memory of 3240	3568	chrome.exe	99
PID 3568 wrote to memory of 3240	3568	chrome.exe	99
PID 3568 wrote to memory of 3240	3568	chrome.exe	99
PID 3568 wrote to memory of 3240	3568	chrome.exe	99
PID 3568 wrote to memory of 4920	3568	chrome.exe	100
PID 3568 wrote to memory of 4920	3568	chrome.exe	100
PID 3568 wrote to memory of 636	3568	chrome.exe	101
PID 3568 wrote to memory of 636	3568	chrome.exe	101
PID 3568 wrote to memory of 636	3568	chrome.exe	101
PID 3568 wrote to memory of 636	3568	chrome.exe	101
PID 3568 wrote to memory of 636	3568	chrome.exe	101
PID 3568 wrote to memory of 636	3568	chrome.exe	101
PID 3568 wrote to memory of 636	3568	chrome.exe	101
PID 3568 wrote to memory of 636	3568	chrome.exe	101
PID 3568 wrote to memory of 636	3568	chrome.exe	101
PID 3568 wrote to memory of 636	3568	chrome.exe	101
PID 3568 wrote to memory of 636	3568	chrome.exe	101
PID 3568 wrote to memory of 636	3568	chrome.exe	101
PID 3568 wrote to memory of 636	3568	chrome.exe	101
PID 3568 wrote to memory of 636	3568	chrome.exe	101
PID 3568 wrote to memory of 636	3568	chrome.exe	101
PID 3568 wrote to memory of 636	3568	chrome.exe	101
PID 3568 wrote to memory of 636	3568	chrome.exe	101
PID 3568 wrote to memory of 636	3568	chrome.exe	101
PID 3568 wrote to memory of 636	3568	chrome.exe	101
PID 3568 wrote to memory of 636	3568	chrome.exe	101
PID 3568 wrote to memory of 636	3568	chrome.exe	101
PID 3568 wrote to memory of 636	3568	chrome.exe	101
PID 3568 wrote to memory of 636	3568	chrome.exe	101
PID 3568 wrote to memory of 636	3568	chrome.exe	101
PID 3568 wrote to memory of 636	3568	chrome.exe	101
PID 3568 wrote to memory of 636	3568	chrome.exe	101
PID 3568 wrote to memory of 636	3568	chrome.exe	101

C:\Users\Admin\AppData\Local\Temp\ZeusServerSide.exe
"C:\Users\Admin\AppData\Local\Temp\ZeusServerSide.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4640
- C:\Windows\SysWOW64\netsh.exe
  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\ZeusServerSide.exe" "ZeusServerSide.exe" ENABLE
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3692

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0x11c,0x120,0x124,0x118,0x128,0x7ffa523ccc40,0x7ffa523ccc4c,0x7ffa523ccc58
  2⤵
  PID:4336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1996,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=1984 /prefetch:2
  2⤵
  PID:3240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2152,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  PID:4920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2228,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=2192 /prefetch:8
  2⤵
  PID:636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3148,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=3168 /prefetch:1
  2⤵
  PID:4924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3292,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4564,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=4524 /prefetch:1
  2⤵
  PID:4644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4816,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=4832 /prefetch:8
  2⤵
  PID:5032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4972,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=4984 /prefetch:8
  2⤵
  PID:4556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4768,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:2100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4724,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:4696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=4804,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:4188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=4492,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=4548,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:1928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=3180,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:4296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=3356,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=5320,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:3900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=3380,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:4400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=4864,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:4776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=5776,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:4188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=5632,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:4300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=6380,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=6388 /prefetch:8
  2⤵
  PID:3528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=6396,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=6552 /prefetch:8
  2⤵
  PID:1612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=6772,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=6768 /prefetch:1
  2⤵
  PID:5260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --field-trial-handle=6060,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=6888 /prefetch:1
  2⤵
  PID:5328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --field-trial-handle=7004,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=6740 /prefetch:1
  2⤵
  PID:5368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --field-trial-handle=7176,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=7012 /prefetch:1
  2⤵
  PID:5444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --field-trial-handle=7244,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=7280 /prefetch:1
  2⤵
  PID:5564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --field-trial-handle=7164,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=7468 /prefetch:8
  2⤵
  PID:5748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --field-trial-handle=7552,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=7260 /prefetch:1
  2⤵
  PID:5860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --field-trial-handle=7604,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=7736 /prefetch:1
  2⤵
  PID:5868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --field-trial-handle=7856,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=7872 /prefetch:1
  2⤵
  PID:5876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --field-trial-handle=7920,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=7880 /prefetch:1
  2⤵
  PID:5884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --field-trial-handle=7884,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=8024 /prefetch:1
  2⤵
  PID:5892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --field-trial-handle=8056,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=8188 /prefetch:1
  2⤵
  PID:5900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --field-trial-handle=8340,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=8064 /prefetch:1
  2⤵
  PID:5908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --field-trial-handle=8468,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=8580 /prefetch:1
  2⤵
  PID:5916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --field-trial-handle=8632,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=8616 /prefetch:1
  2⤵
  PID:5924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --field-trial-handle=8864,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=8884 /prefetch:1
  2⤵
  PID:5932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --field-trial-handle=9032,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=9044 /prefetch:1
  2⤵
  PID:5940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=9056,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=9184 /prefetch:8
  2⤵
  PID:5948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --field-trial-handle=7452,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=9220 /prefetch:1
  2⤵
  PID:6000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --field-trial-handle=9232,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=6228 /prefetch:1
  2⤵
  PID:6008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --field-trial-handle=9352,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=9384 /prefetch:1
  2⤵
  PID:6016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --field-trial-handle=9368,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=9624 /prefetch:1
  2⤵
  PID:6024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --field-trial-handle=10176,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=10164 /prefetch:1
  2⤵
  PID:6748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --field-trial-handle=9960,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=9972 /prefetch:1
  2⤵
  PID:6816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --field-trial-handle=9888,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=10260 /prefetch:1
  2⤵
  PID:6852
- C:\Users\Admin\Downloads\ZeusServerSide4.exe
  "C:\Users\Admin\Downloads\ZeusServerSide4.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:7020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --field-trial-handle=10368,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=10392 /prefetch:1
  2⤵
  PID:7036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --field-trial-handle=5740,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=10100 /prefetch:1
  2⤵
  PID:6508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --field-trial-handle=5736,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:6536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --field-trial-handle=5724,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=10652 /prefetch:1
  2⤵
  PID:6544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --field-trial-handle=10532,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=10764 /prefetch:1
  2⤵
  PID:6552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --field-trial-handle=9848,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=11008 /prefetch:1
  2⤵
  PID:6732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --field-trial-handle=6912,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=7000 /prefetch:1
  2⤵
  PID:232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --field-trial-handle=6116,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=6984 /prefetch:1
  2⤵
  PID:7060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --field-trial-handle=11496,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=11236 /prefetch:1
  2⤵
  PID:6464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --field-trial-handle=11464,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=11612 /prefetch:1
  2⤵
  PID:5392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --field-trial-handle=11628,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=11204 /prefetch:1
  2⤵
  PID:5328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --field-trial-handle=11752,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=11596 /prefetch:1
  2⤵
  PID:7588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --field-trial-handle=11084,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=11296 /prefetch:1
  2⤵
  PID:7596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --field-trial-handle=11080,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=11232 /prefetch:1
  2⤵
  PID:7604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --field-trial-handle=11772,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=6892 /prefetch:1
  2⤵
  PID:7612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --field-trial-handle=11040,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=11412 /prefetch:1
  2⤵
  PID:7620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --field-trial-handle=11140,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=10060 /prefetch:1
  2⤵
  PID:7648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --field-trial-handle=11172,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=7736 /prefetch:1
  2⤵
  PID:7736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --field-trial-handle=11124,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=7208 /prefetch:1
  2⤵
  PID:7744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --field-trial-handle=11816,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=10324 /prefetch:1
  2⤵
  PID:7752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --field-trial-handle=11320,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=6796 /prefetch:1
  2⤵
  PID:7760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --field-trial-handle=11840,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=10760 /prefetch:1
  2⤵
  PID:7856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --field-trial-handle=11860,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=11848 /prefetch:1
  2⤵
  PID:7864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --field-trial-handle=11868,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=8908 /prefetch:1
  2⤵
  PID:7872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --field-trial-handle=11884,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=8272 /prefetch:1
  2⤵
  PID:8108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --field-trial-handle=11904,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=11756 /prefetch:1
  2⤵
  PID:8140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --field-trial-handle=11912,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=9100 /prefetch:1
  2⤵
  PID:4924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --field-trial-handle=11928,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=8024 /prefetch:1
  2⤵
  PID:2092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --field-trial-handle=12000,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=9656 /prefetch:1
  2⤵
  PID:4668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --field-trial-handle=12024,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=8860 /prefetch:1
  2⤵
  PID:3708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --field-trial-handle=11972,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=11956 /prefetch:1
  2⤵
  PID:6280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --field-trial-handle=6412,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=8356 /prefetch:1
  2⤵
  PID:6424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --field-trial-handle=8252,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=8512 /prefetch:1
  2⤵
  PID:5892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --field-trial-handle=8136,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=6636 /prefetch:1
  2⤵
  PID:7532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --field-trial-handle=6812,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=8216 /prefetch:1
  2⤵
  PID:876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --field-trial-handle=6868,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=4436 /prefetch:1
  2⤵
  PID:388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --field-trial-handle=8084,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=7996 /prefetch:1
  2⤵
  PID:5256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --field-trial-handle=10988,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=9084 /prefetch:1
  2⤵
  PID:4552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=11896,i,10292193380110938897,4592811395031219006,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=10856 /prefetch:8
  2⤵
  - Drops file in System32 directory
  PID:7960

C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"
1⤵
PID:3892

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1300

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x510 0x32c
1⤵
PID:5804

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:7112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4da3de2f-8633-4ddc-abe9-94cf4c014bc2.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\4da3de2f-8633-4ddc-abe9-94cf4c014bc2.tmp
Size 9KB
SHA256 d2ea14870bc8dd8e02b09ec7a5f1267c9179f625da1a5b19d1c285d9da61b171
MD5 6a11fbaf0e2286c2706bf614312340f4
SHA1 2fcd647cf35d46624be4e86ae1ef5cf61da1c2cc
SHA512 cb16eeed7506789f9909ed958edffdb03d046de0e62862c3642a5b7ded0a7823792e3951abcf800183b9e4c42859618250c5a45bce49dcc9e657bf1df2f841a9
SSDEEP 192:+p2fwBmfe7WWHV+FepiM2ieIjDPo6yIsnVdg4:+p24oyGgiM2s4
MD5 SHA1 SHA512 SSDEEP

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 c0f09887a489ae76d22a15fc9253e75c01ce7f761af08895351ce9a2e8925d51
MD5 bbf17d3f1a8c8cfe47159f67cecdc033
SHA1 7ed166aec57d5a89a32fd16e5c900477e04bb59a
SHA512 3631eb9a0c7f3f28019504c9eacf1e90c07e05d38b792ac2abc61178ce98c9394fcd6e9bfc34d7cd1ee9a3893e12eab4aeacea46800ed0651f4a3fdb7a1ee1ae
MD5 SHA1 SHA512

Submit Download

f_00001e

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001e
Size 64KB
SHA256 c264675175a122bbfeb151f7eb7da13b101c9df02b3e1322a8463b63aa0b17c7
MD5 46f2f184120ff24c4b1cb07aad0a0655
SHA1 619c676ab04182b6d8d41ed897cca90bfe28386a
SHA512 913e01695f8f0bba123a88c16b88acfaf4ff1135eae23391c2c0e115ceff1feffb50376d6184da50695e488a4839cbab07d8c21cdf79af32b5efa4857b2b5016
SSDEEP 1536:QICVU/K3gyAs8rz3rwx/yo7jhW/KRjuEFCLL:GU4gLVv3Uxx7j5JuEFCLL
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000030

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000030
Size 250KB
SHA256 3f6a8271ab6be6c66a9a21bba8fdea108140c22423a10946388bb33df1d8389d
MD5 472c8d9af4dcb7f09467a5dc6160065f
SHA1 6ba99608be921ba48ee357ac160496f889fab2c1
SHA512 9b7bf472d2d0a156e0cf1c85169943c632cf0d75bbbc12077b6a446a2660bf66ebc36188772d5a622fffa2ef9479c5e5c367818bee4219d7d3682114986f594a
SSDEEP 6144:GYeeSzWTi4vOoCjcVeFx4nu5RmY3lUbqHTxv8BTuoayDGIC5:UWWCi8qx4nunb3Jv4SojXC5
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000038

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000038
Size 1024KB
SHA256 1bfdab24a0f2ad3a40a43db5afc6ce4f97e4a4092d35768300399ab99fa07730
MD5 099d8e1f3f8203715803f284eebd02a6
SHA1 0275efc65797bcdbe502594f2938e215a7bfe80b
SHA512 bc57372f13e4f1aa456b0a77621790bfaebe35665e44bfbe5ee1fc22707ebc98c34fa0fd7679cbc793b520160dbd4c387523f645bda5e6a90edbdbc20e61c7b9
SSDEEP 24576:cgrLrNDhfpNpwIqWrRwqOV489OtWOCIA1UCdvQnphoB8je9:cOrNDlPyIqMRwJ9DOyv2+BWc
MD5 SHA1 SHA512 SSDEEP

Submit Download

11b0d92e0678c31e_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\11b0d92e0678c31e_0
Size 43KB
SHA256 7ce82a9bbaecf4a2347389aaabee3324e186c21bbf32b541ff08690f6ef1ecae
MD5 d346aba21dc2e584a9c9a3724abe8f28
SHA1 e51dd552b52c4c5745f4fb2befd771025bc19e81
SHA512 6519c1b0f09c2f010c26ca743392c267d42dc3cc89651f775018b9d704dfecdd38d2d69f07be726be8ad693c486959e06652d57466e530f18ae33ca454356a9d
SSDEEP 768:We4vAo9DXyPLWt9IT5Cr7dwZfSg72d00fPDa81Q:We4f1iPqUos37gfPDa81
MD5 SHA1 SHA512 SSDEEP

Submit Download

d5e42077b85df235_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\d5e42077b85df235_0
Size 271B
SHA256 bc92bd483eac314d8601e47a8d781b2bade99b9bc904b298bfb105212995839b
MD5 04121ad8a08edea5fa7c4e67f928c8c4
SHA1 dad09045fc2164e8d3ed8c807962cb99bc5805c2
SHA512 c62c02d48cd183d1c362b7cfb246255161489b783ac95ad13c064c4ce38c8f742262f0fe7385aaf1e0e21563b3298482f75d1576a3ac41f8a0d067742a4a051c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 1KB
SHA256 6977489169108b53adbad3c99d54ff4d9b2a152f9abf7c3d67e227d4cd61141c
MD5 86dccb816cbd45dc505399c8ae92c8f1
SHA1 987c4dc6990936dfeec675446f927cd526235dd5
SHA512 de9749f132538f207e9c36b6a01b8bf8d3807e2fb781a9850f8911077c2db1338720c2f1c33087b3b26aae5333711bc8cd127a743720307d41e505e1aa976dff
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 29KB
SHA256 46eb33ebdb47a9d9105e94d06189720381927a20ceb29483b687eb5bcdb6b337
MD5 9c06552fa86304fd987e33f3e45acc1b
SHA1 5ed2ab66b62f21220713e20515101b2793fb3101
SHA512 69f39ecae21d33441f82c7b43e48a1d28c360732fa8f6a73a9d038490c9c778aedc7f01a2facfc0b29e9c8ce60fe9b9f5da2672cc40e3231924ac8bc4861891a
SSDEEP 384:DXheXHmXEqxXmHMuBXTXkXbXNVzXrXNEXeXEXlXNWXNP9XTXoRXdXCXEXnXHTX/z:lnooQmPoB39irA
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 5KB
SHA256 65e129b0377c5eb43fedd49013f172d82aeed230e0cf58e09dfe705d08d18ccd
MD5 f41a45bd9fec9ce7fcdeaa06e96d7aa2
SHA1 60d55420d0baa1fac3d6f481fa45e2c61e2fe7b3
SHA512 7e934754348f1769cc3f0ee7787fc85f57b3ebf8947e38d9211c61b1004fee438262ca30cef89a08666cbab89b3dbab238e018fa8396f83ef74c5342856d9ddb
SSDEEP 96:TOUwpUioAUbcvUJ9FieUyzsUrEUvwFU7NZULSrUceU1TULbUmMUT4IU69IUwUUhv:TOUuUbAUQvUPbUGsUYUMURZULSUJUhUY
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 356B
SHA256 3734de1bed5f0eb246d52f3bc2715745bc4d5c2c62321ef977d6e7f38cae7367
MD5 8743914725b4ae5df2a55c6ec8a0081c
SHA1 0c2ebb3ad585af43ce842aabd60fee160413adb4
SHA512 a4b6e09a976a29afad9d1d0c0d724cfa09f0e99eabcb790cf1a0dc65556c8fc1c7efc2f90507363333756477573294263f21f09b2242c085b5ef184c16349aa6
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 3KB
SHA256 44ca2d4594f50729053b2ea1688787bd4b925065ce7871b9192a9d540a07d0e7
MD5 8d59894872989f9545bfa50dcdc82609
SHA1 01e432ef407c0e08d83c1c2d838fe2d48b61449b
SHA512 a5203465438ea04fd5c6b0c5a3ef1549cf48441432ae7aaefcbdc280c309767ee5460e4fe93c98f0611b093c233d6f884f6e1e93a254dc6a46182cf952887ef5
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 5KB
SHA256 fc75abb0c56d7fbda7de08f6d75cd370757ecf74ee870aae953fae7317032908
MD5 c2cdabab4bbc61a4c9d4539773609822
SHA1 918ab6332d409be644725dc1aad7dd3518d6e568
SHA512 ca6523969e4b10d8fc07082e2d0fe5350d05d1a4a99379d55f50744ea98fdc26c21a0ae2d2e3fe06904dc67d1ed8202a6f73edfc2032ee934b47c6597da6fd28
SSDEEP 96:ZUeoAUbcvUJ9FieUywsUCEUv/FU8NZULSrUceU1TULbUmMUT4IU69IUwUUhNUn6R:ZUPAUQvUPbUdsUVUFUAZULSUJUhUXUFn
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 5KB
SHA256 2c9c464403b6a3509314b5ccfbc1ab118fc1af6d2df10a54adbdf39809fdfd26
MD5 1ae64a5a48252c07b0e7e50c311b480f
SHA1 636111e8f93278c560921f19f213183a8c7bb70f
SHA512 2b0af9d083b51681ff1465f9ad212c0d7aa77db078fc9296ac3be1a209e721b5c9abfd456f0070c05dfc23dc9cf42158299d0c9020b4f91e3c4a641facd287fb
SSDEEP 96:TOUwpUioAUbcvUJ9FieUyzsUrEUv/FU8NZULSrUceU1TULbUmMUT4IU69IUwUUhP:TOUuUbAUQvUPbUGsUYUFUAZULSUJUhUw
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 5KB
SHA256 cdd9b3aa8f590362eda7cb30d8ba873d241a7659ceff43f0e64792fa83c3b7d4
MD5 d6ed44f989d989487dc7cdaa5031d64d
SHA1 a7580e121e570446f12949777eb2248558056559
SHA512 910d2e2a8d8468f4bce0bef4c2b74f42f4afcc005d6d43660db7ae6ffd1d9cf18ba37ca6f6eb9ffa161e3462d4768ab1858a229a0ee74fe0e5d9bb1a38c95c43
SSDEEP 96:TOUwpUioAUbcvUJ9FieUyzsUrEUvwFU7NZULSrUceU1TULbUmMUT4IU69IUwUUhz:TOUuUbAUQvUPbUGsUYUMURZULSUJUhUk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 ed041e0d1b0c684f724641f6c992bee8be797bab3f5f1c97faa0b98fd526c4a6
MD5 72378dba86b35597d901de3ffd821c6f
SHA1 b8eeaa1863db88b9ef6126c09c81f43f01db6e9f
SHA512 867e23ef34048959513434b49055a9d2b9f02dfda007d69a362dc8050c2696422573df7080b40f25aef54abe4cd1b3ea8cc8f4005aea69cbf8fef5a6ab9cd858
SSDEEP 192:+p2fwBmwe7WWHV+FepO62ieIVDPo6yIsnVdg4:+p24FyGoO62w4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 180a333b14d04b58c5c34c5bb4bd55b08895c36223d09ed7e22fd2bb91d19885
MD5 aff972f62820c79a25c9bc25ef2cb5d5
SHA1 6ac4898627c88beaa4a27f453ae35a6d838a8ebb
SHA512 42976e0c3d1776a1648fbf5b3d8f302676ca7400c671eb9ea9c583642112554c2a6cf796f3175686a3f4d7222eab0952342910ab50733929b1572e59d7bcf726
SSDEEP 192:+p2fwBm3e7WWHV+FGz8q02ieIjDPo6yIsnVdg4:+p24IyGlq02s4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 d5dc049a7cd8281977c74c0ca0df4a5b149a7c6569d1b6c12e5763c371426329
MD5 6caeb4f1997765f48e7f9aeced8f1b8d
SHA1 86a78de82d60e23f708d28e7c4fb3c73297b80cb
SHA512 b79293a6f426ca063fab891c0e08ea169aa9a16324af494fbbb516160cc9398ce458fccdcc7cf29cfb2178c679d3c35d36778c343c34c1026da95792c6e7e892
SSDEEP 192:+p2fwBmJe7WWHV+Fmxk+2ieIVDPo6yIsnVdg4:+p24ayGgk+2w4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 91f703dda09c50492c6b7987f008d73cfd4fbc97c92cd4727dbd9308a4e89c74
MD5 8ac9f224ca5bc8ba952c64fe3732a6a8
SHA1 a86a77f7e07810691643aa5a786f023e35819a56
SHA512 252ed1611be535c39e3d0e5aea9221e5810376dbb90a19344a336fce0e2744d1428bb0bcbf7adc5488c112cb65f515e18b7fc67b61b5c1f4752dddf78e088e22
SSDEEP 192:+p2fwBmEe7WWHV+Fv5a/2ieIjDPo6yIsnVdg4:+p249yGha/2s4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 8KB
SHA256 338bc7ceda6d6914831da2edafcc6d82b78f030695bb77238a417fa634a20bd3
MD5 bda91c8297ed3d35ee4762e8af93d076
SHA1 ea794dc0667d24589b06e63b130a70d4df3fcf28
SHA512 794ed62a75c4b114dbe543aef24620d44b92778901089dff10f3f0dd6ef3d1420110f4981ad364c4850f01fab1bbfeefe50ca50017eca725aa9cca3a41e20322
SSDEEP 192:+p+fwBm2ejWHV+FRLe2ieI0DPo6yIsnVdg4:+p+4MyGRS2V4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 1f66efc853ce3b80f1ba772c74ff8eed45b244cdf201c4c6fc8b65b691a0769d
MD5 535c059bfcf8e9259261071b5d3ad60b
SHA1 90453b5174e6d154eea29fb55548894231ec6a67
SHA512 624eea72c252e5b468519a66599371a038527eee6918090863a127c87adc9a565234882704469d8bee209e2473b6309b700af19f9291d84d1d2496e56a40a3fd
SSDEEP 192:+p2fwBmie7WWHV+FXhKH2ieIjDPo6yIsnVdg4:+p243yGRKH2s4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 85754ee98bb4cc17b13a9080d0f949631eb427a64476b9662977d51a3bc063e8
MD5 ac53c05b4e8da58c9a37f871a7acc07a
SHA1 5b1ce3aadfe6adc8e925f50c9c32188bf8f89e6e
SHA512 4dc19d120a387d7f27c29a28d9748720dee2bc1a8a71061ad5b719d7697e06da9d4c3d7df44b39b11f2812070ef471ca285f4d39b12bd0fb137717134a52842f
SSDEEP 192:+p2fwBmXe7WWHV+Fb9yr2ieIjDPo6yIsnVdg4:+p24AyGxyr2s4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 8a6c0b621a221d646f6d135813b138f5517b189c3b3dcd0ba88e900d6bd41ac2
MD5 db47e098713534ffc14810f62f71c4a2
SHA1 31577a38ee297b7cd4d380bbf472e27e775be935
SHA512 bab064b31c14ea2d33df7185448fd230d183c7918b3171c2c717365636d0d193c0db856c891902e9b9412563329f95854d75fc5bfc6e013eb576babd5a5f67f5
SSDEEP 192:+p+fwBm/ejWHV+FRLe2ieI0DPo6yIsnVdg4:+p+49yGRS2V4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 15KB
SHA256 9978330ffc21bd5f92f5f37dc714dd4b54d99dc927da9f37dabb9efbf0518731
MD5 4cfe85be0ae4c7fdae08f04ec393eb38
SHA1 4aada3f062598bf2f49a62708d788eecc85d0b2c
SHA512 9a185323fda8f886ea8a945175ace2f77541f43888518937685fc2a19bf22eec02bf3fb5c3486204f93b85addd7a578442922c9e45b81912667c536126fd2e9c
SSDEEP 384:G+zY7pLhLcsBO3XMx1kXqKf/pUZNCgVLH2HfPu/rUYjHG0C5Ga:GgY7pLhL94HMx1kXqKf/pUZNCgVLH2HP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 186KB
SHA256 bdab5334f52ee01023e8d6fbeb7527ac6ae40b5fe99a72e586ce616141a41a46
MD5 4c222d70b469e3cae49a735ea94cbdc7
SHA1 cb4a55cd1a3f980859c78c3f55c68bd7dcc3d517
SHA512 304243e6e17921dec8574043c2cbc9e9413c9533f3f64b0473936654b91f4389c037a445b7342b1fe54718651da5f9b9bfad977ce74418cb9f63b67c285d61ad
SSDEEP 3072:hHxfLrE/P2BUA75+HRcGmRL8lXn6xQYA4eBly/y9DSsbPNFWekZkOsF0:hRTr5T7O/mRS36xkPBly/M2ekZkOs6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 186KB
SHA256 75369650ce66adcfdf3de595c4f239ed49e3b6606e436d744df3af79ca5c0e72
MD5 ba102426a5a1e4954d2e874ea70bdac4
SHA1 2f258f5a1f420cf1213fda263572cc02af5eb440
SHA512 2e6184f5bec8d3fbf6d6cee116abcc4ad1ff1d13cc17bf532d8be69eea2db59b19bf234049d7077c6601c9a6c9d9a57866f89952ae6aeaacc098da04fb6b5197
SSDEEP 3072:SHxfLrE/P2BUA75+HRcGmRL8lXn6xQYA4eBly/y9DSsbPNFWekZkOsF0:SRTr5T7O/mRS36xkPBly/M2ekZkOs6
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZeusServerSide4.exe

Path C:\Users\Admin\Downloads\ZeusServerSide4.exe
Size 35KB
SHA256 b0a29c478ef6813d800d5dc15615d6b4f08c5d876bd878acc95591e23af88dc8
MD5 a3f6f8393c241fb86563eb9afdb78643
SHA1 ba42276e0baf94066af907318f70f918683e81e5
SHA512 660bc1054a4944a4cc13488032c8a2baa9bcd882bf5f2c5ae07b8076d99a31c34569d44424e270b091695c4e56df22a2f57b60d332c6cd44c5678b179c118d6b
SSDEEP 768:q+4JH5roGtlwMC/3PH0V7sYZcVcBUZMYSpKZMY:qhh/ji3e+3Miq
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4640-0-0x0000000074E12000-0x0000000074E13000-memory.dmp

Download

memory/4640-313-0x0000000074E10000-0x00000000753C1000-memory.dmp

Download

memory/4640-398-0x0000000074E10000-0x00000000753C1000-memory.dmp

Download

memory/4640-48-0x0000000074E10000-0x00000000753C1000-memory.dmp

Download

memory/4640-47-0x0000000074E10000-0x00000000753C1000-memory.dmp

Download

memory/4640-2-0x0000000074E10000-0x00000000753C1000-memory.dmp

Download

memory/4640-46-0x0000000074E12000-0x0000000074E13000-memory.dmp

Download

memory/4640-45-0x0000000074E10000-0x00000000753C1000-memory.dmp

Download

memory/4640-335-0x0000000074E10000-0x00000000753C1000-memory.dmp

Download

memory/4640-1-0x0000000074E10000-0x00000000753C1000-memory.dmp

Download