zgrat | e522f402bd19d48588dfe55c5178f82d4f3e365817fdd3a30de52c09926ff81e

Analysis

max time kernel
141s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
26/07/2024, 02:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Beta_0.6.exe
Size 2.1MB
Sample240726-cytpya1bnk
SHA256 e522f402bd19d48588dfe55c5178f82d4f3e365817fdd3a30de52c09926ff81e
MD5 c3ce5141cd6793d20a56d323acaa6723
SHA1 8859b8cea7f5cbef73ddbc8e9070d85ce57b04ec
SHA512 a1ea620babd76f54cb6577b405f16ecac1c4d9df79c18b9e3654a8c3fb7902305f85800e44b0ec867da8c5847588276149e5989391da224c0106ccc597f28e43
SSDEEP 49152:31tVLt+HCyVkdgiikpTRKi5hYK2Be/zjc9QPirSqQp/FelB:31nL8Pkr1Km2BcM6PiGdN
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

zgrat discovery rat

Malware Config

Signatures

Detect ZGRat V2 1 IoCs

resource	yara_rule
behavioral2/memory/8-1-0x0000025509400000-0x0000025509624000-memory.dmp	family_zgrat_v2

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Crashpad\metadata	setup.exe
File opened for modification	C:\Program Files\Crashpad\settings.dat	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133664346684379427"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3436	chrome.exe
3436	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	8	Beta_0.6.exe
Token: SeShutdownPrivilege	3436	chrome.exe
Token: SeCreatePagefilePrivilege	3436	chrome.exe
Token: SeShutdownPrivilege	3436	chrome.exe
Token: SeCreatePagefilePrivilege	3436	chrome.exe
Token: SeShutdownPrivilege	3436	chrome.exe
Token: SeCreatePagefilePrivilege	3436	chrome.exe
Token: SeShutdownPrivilege	3436	chrome.exe
Token: SeCreatePagefilePrivilege	3436	chrome.exe
Token: SeShutdownPrivilege	3436	chrome.exe
Token: SeCreatePagefilePrivilege	3436	chrome.exe
Token: SeShutdownPrivilege	3436	chrome.exe
Token: SeCreatePagefilePrivilege	3436	chrome.exe
Token: SeShutdownPrivilege	3436	chrome.exe
Token: SeCreatePagefilePrivilege	3436	chrome.exe
Token: SeShutdownPrivilege	3436	chrome.exe
Token: SeCreatePagefilePrivilege	3436	chrome.exe
Token: SeShutdownPrivilege	3436	chrome.exe
Token: SeCreatePagefilePrivilege	3436	chrome.exe
Token: SeShutdownPrivilege	3436	chrome.exe
Token: SeCreatePagefilePrivilege	3436	chrome.exe
Token: SeShutdownPrivilege	3436	chrome.exe
Token: SeCreatePagefilePrivilege	3436	chrome.exe
Token: SeShutdownPrivilege	3436	chrome.exe
Token: SeCreatePagefilePrivilege	3436	chrome.exe
Token: SeShutdownPrivilege	3436	chrome.exe
Token: SeCreatePagefilePrivilege	3436	chrome.exe
Token: SeShutdownPrivilege	3436	chrome.exe
Token: SeCreatePagefilePrivilege	3436	chrome.exe
Token: SeShutdownPrivilege	3436	chrome.exe
Token: SeCreatePagefilePrivilege	3436	chrome.exe
Token: SeShutdownPrivilege	3436	chrome.exe
Token: SeCreatePagefilePrivilege	3436	chrome.exe
Token: SeShutdownPrivilege	3436	chrome.exe
Token: SeCreatePagefilePrivilege	3436	chrome.exe
Token: SeShutdownPrivilege	3436	chrome.exe
Token: SeCreatePagefilePrivilege	3436	chrome.exe
Token: SeShutdownPrivilege	3436	chrome.exe
Token: SeCreatePagefilePrivilege	3436	chrome.exe
Token: SeShutdownPrivilege	3436	chrome.exe
Token: SeCreatePagefilePrivilege	3436	chrome.exe
Token: SeShutdownPrivilege	3436	chrome.exe
Token: SeCreatePagefilePrivilege	3436	chrome.exe
Token: SeShutdownPrivilege	3436	chrome.exe
Token: SeCreatePagefilePrivilege	3436	chrome.exe
Token: SeShutdownPrivilege	3436	chrome.exe
Token: SeCreatePagefilePrivilege	3436	chrome.exe
Token: SeShutdownPrivilege	3436	chrome.exe
Token: SeCreatePagefilePrivilege	3436	chrome.exe
Token: SeShutdownPrivilege	3436	chrome.exe
Token: SeCreatePagefilePrivilege	3436	chrome.exe
Token: SeShutdownPrivilege	3436	chrome.exe
Token: SeCreatePagefilePrivilege	3436	chrome.exe
Token: SeShutdownPrivilege	3436	chrome.exe
Token: SeCreatePagefilePrivilege	3436	chrome.exe
Token: SeShutdownPrivilege	3436	chrome.exe
Token: SeCreatePagefilePrivilege	3436	chrome.exe
Token: SeShutdownPrivilege	3436	chrome.exe
Token: SeCreatePagefilePrivilege	3436	chrome.exe
Token: SeShutdownPrivilege	3436	chrome.exe
Token: SeCreatePagefilePrivilege	3436	chrome.exe
Token: SeShutdownPrivilege	3436	chrome.exe
Token: SeCreatePagefilePrivilege	3436	chrome.exe
Token: SeShutdownPrivilege	3436	chrome.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe
3436	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3436 wrote to memory of 3756	3436	chrome.exe	102
PID 3436 wrote to memory of 3756	3436	chrome.exe	102
PID 3436 wrote to memory of 3656	3436	chrome.exe	103
PID 3436 wrote to memory of 3656	3436	chrome.exe	103
PID 3436 wrote to memory of 3656	3436	chrome.exe	103
PID 3436 wrote to memory of 3656	3436	chrome.exe	103
PID 3436 wrote to memory of 3656	3436	chrome.exe	103
PID 3436 wrote to memory of 3656	3436	chrome.exe	103
PID 3436 wrote to memory of 3656	3436	chrome.exe	103
PID 3436 wrote to memory of 3656	3436	chrome.exe	103
PID 3436 wrote to memory of 3656	3436	chrome.exe	103
PID 3436 wrote to memory of 3656	3436	chrome.exe	103
PID 3436 wrote to memory of 3656	3436	chrome.exe	103
PID 3436 wrote to memory of 3656	3436	chrome.exe	103
PID 3436 wrote to memory of 3656	3436	chrome.exe	103
PID 3436 wrote to memory of 3656	3436	chrome.exe	103
PID 3436 wrote to memory of 3656	3436	chrome.exe	103
PID 3436 wrote to memory of 3656	3436	chrome.exe	103
PID 3436 wrote to memory of 3656	3436	chrome.exe	103
PID 3436 wrote to memory of 3656	3436	chrome.exe	103
PID 3436 wrote to memory of 3656	3436	chrome.exe	103
PID 3436 wrote to memory of 3656	3436	chrome.exe	103
PID 3436 wrote to memory of 3656	3436	chrome.exe	103
PID 3436 wrote to memory of 3656	3436	chrome.exe	103
PID 3436 wrote to memory of 3656	3436	chrome.exe	103
PID 3436 wrote to memory of 3656	3436	chrome.exe	103
PID 3436 wrote to memory of 3656	3436	chrome.exe	103
PID 3436 wrote to memory of 3656	3436	chrome.exe	103
PID 3436 wrote to memory of 3656	3436	chrome.exe	103
PID 3436 wrote to memory of 3656	3436	chrome.exe	103
PID 3436 wrote to memory of 3656	3436	chrome.exe	103
PID 3436 wrote to memory of 3656	3436	chrome.exe	103
PID 3436 wrote to memory of 1224	3436	chrome.exe	104
PID 3436 wrote to memory of 1224	3436	chrome.exe	104
PID 3436 wrote to memory of 4372	3436	chrome.exe	105
PID 3436 wrote to memory of 4372	3436	chrome.exe	105
PID 3436 wrote to memory of 4372	3436	chrome.exe	105
PID 3436 wrote to memory of 4372	3436	chrome.exe	105
PID 3436 wrote to memory of 4372	3436	chrome.exe	105
PID 3436 wrote to memory of 4372	3436	chrome.exe	105
PID 3436 wrote to memory of 4372	3436	chrome.exe	105
PID 3436 wrote to memory of 4372	3436	chrome.exe	105
PID 3436 wrote to memory of 4372	3436	chrome.exe	105
PID 3436 wrote to memory of 4372	3436	chrome.exe	105
PID 3436 wrote to memory of 4372	3436	chrome.exe	105
PID 3436 wrote to memory of 4372	3436	chrome.exe	105
PID 3436 wrote to memory of 4372	3436	chrome.exe	105
PID 3436 wrote to memory of 4372	3436	chrome.exe	105
PID 3436 wrote to memory of 4372	3436	chrome.exe	105
PID 3436 wrote to memory of 4372	3436	chrome.exe	105
PID 3436 wrote to memory of 4372	3436	chrome.exe	105
PID 3436 wrote to memory of 4372	3436	chrome.exe	105
PID 3436 wrote to memory of 4372	3436	chrome.exe	105
PID 3436 wrote to memory of 4372	3436	chrome.exe	105
PID 3436 wrote to memory of 4372	3436	chrome.exe	105
PID 3436 wrote to memory of 4372	3436	chrome.exe	105
PID 3436 wrote to memory of 4372	3436	chrome.exe	105
PID 3436 wrote to memory of 4372	3436	chrome.exe	105
PID 3436 wrote to memory of 4372	3436	chrome.exe	105
PID 3436 wrote to memory of 4372	3436	chrome.exe	105
PID 3436 wrote to memory of 4372	3436	chrome.exe	105
PID 3436 wrote to memory of 4372	3436	chrome.exe	105
PID 3436 wrote to memory of 4372	3436	chrome.exe	105
PID 3436 wrote to memory of 4372	3436	chrome.exe	105

C:\Users\Admin\AppData\Local\Temp\Beta_0.6.exe
"C:\Users\Admin\AppData\Local\Temp\Beta_0.6.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:8

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff9e78ecc40,0x7ff9e78ecc4c,0x7ff9e78ecc58
  2⤵
  PID:3756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2100,i,9885589454169703331,5877774250704299502,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:3656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1932,i,9885589454169703331,5877774250704299502,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=2144 /prefetch:3
  2⤵
  PID:1224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2288,i,9885589454169703331,5877774250704299502,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=2264 /prefetch:8
  2⤵
  PID:4372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3180,i,9885589454169703331,5877774250704299502,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:1084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3208,i,9885589454169703331,5877774250704299502,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:1404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3752,i,9885589454169703331,5877774250704299502,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=4676 /prefetch:1
  2⤵
  PID:4448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4896,i,9885589454169703331,5877774250704299502,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=4904 /prefetch:8
  2⤵
  PID:3740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5004,i,9885589454169703331,5877774250704299502,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=5016 /prefetch:8
  2⤵
  PID:4536
- C:\Program Files\Google\Chrome\Application\123.0.6312.106\Installer\setup.exe
  "C:\Program Files\Google\Chrome\Application\123.0.6312.106\Installer\setup.exe" --reenable-autoupdates --system-level
  2⤵
  - Drops file in Program Files directory
  PID:1852
- - C:\Program Files\Google\Chrome\Application\123.0.6312.106\Installer\setup.exe
    "C:\Program Files\Google\Chrome\Application\123.0.6312.106\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0x284,0x288,0x28c,0x260,0x290,0x7ff650754698,0x7ff6507546a4,0x7ff6507546b0
    3⤵
    - Drops file in Program Files directory
    PID:4932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=5124,i,9885589454169703331,5877774250704299502,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=4824 /prefetch:1
  2⤵
  PID:436

C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"
1⤵
PID:1088

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1200

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff9e8fb46f8,0x7ff9e8fb4708,0x7ff9e8fb4718
  2⤵
  PID:428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,2546783308584297345,17547013922238391244,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,2546783308584297345,17547013922238391244,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,2546783308584297345,17547013922238391244,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:8
  2⤵
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2546783308584297345,17547013922238391244,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2546783308584297345,17547013922238391244,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2546783308584297345,17547013922238391244,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2546783308584297345,17547013922238391244,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,2546783308584297345,17547013922238391244,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5504 /prefetch:8
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,2546783308584297345,17547013922238391244,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5504 /prefetch:8
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2546783308584297345,17547013922238391244,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2546783308584297345,17547013922238391244,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2546783308584297345,17547013922238391244,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4176 /prefetch:1
  2⤵
  PID:3496

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3156

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 ce27b45e223c4121a2fed89c1d4c3fe44007538ca755cf6800ac09199f1a9736
MD5 3989145aba3e2a939b4d55caf50cb972
SHA1 368bf04b0ca4a1110010be7e265b5a334e3a1411
SHA512 e412843a5c5f641d91d57fcaaec381829258e30b111ffdc196a9862775d0cd3e229e2943255d3f188fad6b1a3b95c02940251f79215be2652a8e63649a1038ba
MD5 SHA1 SHA512

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001
Size 210KB
SHA256 b70465f707e42b41529b4e6d592f136d9eb307c39d040d147ad3c42842b723e7
MD5 5ac828ee8e3812a5b225161caf6c61da
SHA1 86e65f22356c55c21147ce97903f5dbdf363649f
SHA512 87472912277ae0201c2a41edc228720809b8a94599c54b06a9c509ff3b4a616fcdd10484b679fa0d436e472a8fc062f4b9cf7f4fa274dde6d10f77d378c06aa6
SSDEEP 3072:VPjy61QwpL6y2f60/fSWAOZC3jQuYaSBeAtl7qU6Mh3Ijw0O9YK+rOCpeGMrqD4/:ZeX+L6M0/qW5pBdtlVr3Is0O9JG09nAY
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 216B
SHA256 07756473e2bafd1ac665f5ee1b6bc8b265f230507c61fb24447fff2a1074b4a3
MD5 ddd0e5eaea2c2e2512cba118d28041da
SHA1 568b46d8515981746f7d654c367fe91759dffb85
SHA512 af90872b21dfc2b2152cd0f77ee7c6018ac8ce7c964afd9cd4579eb31762fe11c8147bb1f4c0433ce5971b0ad2e1072bf0fa0674b0d38b5bb8f0337c813ca994
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 216B
SHA256 b1ebe68b5c83426be04302dddd5b9658878f91a5bfab6c7c71a2c56e796a5c17
MD5 c5773382fddaac789841bd1eb513835b
SHA1 1e4271009975de602dc1055379937062b02b8d62
SHA512 2100389c4664e3612f8335980ed1f964e1ef42d739376ba0eed40e7bf71c512ccab3151006a51b9a656266e51ceca2a4db4c4b84786e4f9498504d200f65ea69
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 216B
SHA256 15b7f9a81b39d59e954cc6c85b76e96b19d2f494405b608ffbc1f2419f7c6abe
MD5 4599373e15377344d2e6bf98f55e839a
SHA1 9ba9f7c83b48a71fca85e77ab3afa8b71c52a63f
SHA512 01e1d70fd914194bcc961dcc04da900aeb9f91e9bebab4ac7dfdbf522726d242e092663ac6d35c2b66601fd3cc11ae138ad91baf5bcc6a50732e0d2cc3e4ba93
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 59601259a8ae2e8f1676c00a249834ae5269ab002cde9a3722c017d416afb62b
MD5 0d43da0e48153496e87fc7057ce14caf
SHA1 6ed5c4baf50e38afa377213b2ff9600ebddbc890
SHA512 70e322293a7e93c35e1848294065de1dfeec22de2e565183061c374617b935638a676855445cfdcabb97b5e67d4e3dbee05a2b7d507ad6076cab7ed48c06fe5e
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 04c8179e0ba84a649b52ab366f55a9f02d4b12902529abd68404de1968402423
MD5 b0a020c0f267f968ea05bcc8c25a33c9
SHA1 e67350def1da9ca494ae9f23f02fbea2d4a31918
SHA512 f665122be29b185e00f7b49141d0fc28d64a3bc305b4a7906668b9d1b45b5ffd8994493614b1b8fed0ae15d946e98fbd0eee231c0300d4ab11531746415f6eb5
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 354B
SHA256 9617bcf55daedfc93a0341aab59c1fb128c038d4cc3a8a7bf5478a5212b25a9a
MD5 96d9b090b28ba89eb201d11af37b8e9c
SHA1 a27736bca0480f59239efcf36da622653fd76e52
SHA512 15806c3cb44682a032f2dda6592d6e5c84fb11fa220cc22b329597266d3789ded3bdc32df3756ac73f8944f335158932f6a4b965bca7952f34040422fb9b218e
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 ee3f8e899bf30630a4cad5b698e48461317801c919bb23b047692b389ab22df2
MD5 f4ab68847abc8f18ae1f12cca03f50fe
SHA1 f0cdaf2085d4f509bbe6ebc8f2e328484e1381bf
SHA512 d739fdb0769ac6dd3f3ec95f00130b6cb3d15a0d355f79e9a2b6ef32bbe0b1c2c854d4d4a99eed4e0753311c87b60c07cdb6dd2602e0d7d5b437ed5e9f5849b9
SSDEEP 192:y8X1kTGeNHHV+FCj6eQcxkw0lFTPo6yIsnVdg4:y8X2/nGu6ehkv4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 b2d58904fbe39972fe6a908cd588a8578b50fe9891cdb9df06bbfd522bd6637a
MD5 44b6fb4b871ef2a4a630cbbb2ca71512
SHA1 d94f6cb7bf7359ab5924532341c9173aa3bc6d90
SHA512 fece33d622c93b87dff5b6eafa26c43331eef4da6cd4676ebd89ebbddf501822a7d63249c8ae8b646ee4adc879953208bf4d0b38e3b677c5d6ce2740e6c05023
SSDEEP 192:y8X1kTzeNHHV+Fw1seWxkw0lFxPo6yIsnVdg4:y8X2KnGWseik14
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 613573e82c13d74d1a10d82240df92bda0882deac5f831b4fef45bc6a5fb4a4b
MD5 4c83c215efa0df8752675d268b7d10c9
SHA1 1820de536816e26cecc57d7872501098c526b15f
SHA512 afe012be2516cd4e920da490124304dca5c32cfadbd1784df7256a643fe2b23e2d97eafc8ac5f060346c8559a18d7a42c475c4109732a1e353322fb576ed546f
SSDEEP 192:y8X1kTpeNHHV+FFAkeZxkw0lFxPo6yIsnVdg4:y8X2snGake/k14
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 1d9fb297c1eef258467070747ab92fd1912b97494c52be8701c9bb55cba799b0
MD5 c536ea698849e03ac2eb3eb0af90f4f7
SHA1 2fd25d4ed99734b199efe78d4cf25331142f9067
SHA512 b9b435e5d8456ffa98340cf9270242da20bc65613393a03d0a5d75f99d8d43d0cc049d33607ca48d3829946ac52f8732825a609a95987f071e9160dc5836e290
SSDEEP 192:y8X1kTkeNHHV+FVciercxkw0lFTPo6yIsnVdg4:y8X25nGiieIkv4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 16f08508dbff5d2126f5fe3702d968bdbc9a9920144b9b76a7024d8d0e35092b
MD5 60eab9642e23ba2d886eae6315d35c5b
SHA1 1fdbd35e9996456462a7e68e4c1eab5705a2da0b
SHA512 5657521588369d697e36038bd41416ce3f2b1f4831aaf0274c3257d590f15a8afd742ebc71bdbfd7a38e0eb965fde0c233566060b3068784009ea3522b4d4197
SSDEEP 192:y8X1kTQeNHHV+FDpsehvxkw0lFVPo6yIsnVdg4:y8X2lnGNsezkV4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 f7211f95dae13752ba5fe2bfbab27cb73f5fae8f9d71e400d5cea9ea6e078c14
MD5 60f78efbdd66601017d9a1c7a8c957de
SHA1 eea8fe73ec1a50a06a15f769430fa3d466cf1cf8
SHA512 fad43f5a8757fcdd5b54e0b1c8850637b5f5c7302d06b0b1f466134b55c30086ad45d6906c319d39bf6a5d22b7cd5a116259018f54f8a9d78bf931e9169779fa
SSDEEP 192:y8X1kT8eNHHV+FNfg8eZvxkw0lF8do6yIsnVdg4:y8X2xnGN48e7ks4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 2ec3f9b47a6367b7222febf4260e5a5f4f2077639b912d217162ed439deca9ba
MD5 361192a11348404e7984d5c3ef917069
SHA1 d308fd6ec80fb3c3460df37017bda74831838103
SHA512 16b895d73e6729ff68232fa27423b08a662a32ca1c92a4559754804a9510173203695a8576dee6e5b6c3ecc65cf216dadd928580005620c5047cc1efe48f9e7f
SSDEEP 192:y8X1kTJeNHHV+FH1Gedvxkw0lFVPo6yIsnVdg4:y8X2knGVGevkV4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 15KB
SHA256 3a344c394e5bf62732873178b9338c82b3fe21cd83dd94ba08f1049853d813b9
MD5 62418d95712361955e67a732eda6fbfb
SHA1 2cc78f721e799f7be5d260cc4922c48a5eda2b1f
SHA512 1b7409f074f29f6961e562d7a4b04e2055c51c253a587e43ff4e758d4917e29fae6ce3492968ba95e132151fdfd5e44d8fdee213dc2775bf1d20d4e4b0d28e08
SSDEEP 384:/bmp7pLhLcsBXqXRm1kXqKf/pUZNCgVLH2HfP36rUl6HGXdoJ/A:/6p7pLhL9N4Rm1kXqKf/pUZNCgVLH2HN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 188KB
SHA256 e34009e46002e73992d3b05e289f298e950ce79410222993d1543ed7a6ee46be
MD5 67b89e36a39623066008c619ff468161
SHA1 1e372621fe6a6e65d12d35b808fbb8e88f4d9714
SHA512 00ae498ac0635f1c6b1385db76c9abf3dd4ad7426b94ac142910e3d748cc67597555430fffebacb409523af5c57198b35b57483ff7abb9d20f935dc8aa870d8c
SSDEEP 3072:PMij8XnmOKhIj2rUur7y1GU/2qqz8zr15CbQD1t1qj7ajgwyRnXq49di:Uij8XnQICrU53/2qqz8zr1Aok7ajJyRg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 188KB
SHA256 b4f83ce8b09e3e62eac1112e35fe1e65a5bec6ea72bf3e4dbac2548471796b47
MD5 e327554914f43de3ea7073057a65d541
SHA1 11a6dae36b83de5c3e6527a82f13edaf229eec15
SHA512 f06b453a802a623d56178f3df86bc3e1bca3ff16885b2cdec40e2bf855837bbb7a60590cedf38d8ae17f6c53c9bfacc141f1c89c16b735bfa598f333627c7cc5
SSDEEP 3072:6Mij8XnmOKhIj2rUur7y1GU/2qqz8zr15CbQD1t1qj7ajgwyRnXq49di:Hij8XnQICrU53/2qqz8zr1Aok7ajJyRg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 188KB
SHA256 8b8b16b59a1724fcffda83d60683e01d1670c843d21dff3b4a2d1dc3d49cb6b0
MD5 e8f75a4afdc0e2e8dc7baa2ff103ccfb
SHA1 5bb57deac87467c23ac9c9f33047ff77cb883a1f
SHA512 1672808c36ae59c8148f1656d78ae87d1302e7b50bd0e9d51bb45c89536704d79848b1532f882e2df76c24a77659b18012f1bdc0e1d7d4ce9c501028a20397a6
SSDEEP 3072:/Mij8XnmOKhIj2rUur7y1GU/2qqz8zr15CbQD1t1qj7ajgwyRnXq49di:Eij8XnQICrU53/2qqz8zr1Aok7ajJyRg
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 4fed8b6a79cb040f70b177813d9c0e316d09b2e4a394334ddd298462d8067918
MD5 95e2dcaccb55026f7557507d32b1e0bc
SHA1 b5b62367068c0df1c775312c0012d20b9a2abe7d
SHA512 8e17dfdf62c60007ffb92f062fab1321c223329e4c07bd3e6b4363ad87b70c00d49cc4f4d948a421049622c963c54b8ed218510e9f2f5e1e78864cd49c7e10a2
SSDEEP 3:MsEllllkEthXllkl2zEBnl:/M/xT02zmnl
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 fb87b758c2b98989df851380293ff6786cb9a5cf2b3a384cec70d9f3eb064499
MD5 a499254d6b5d91f97eb7a86e5f8ca573
SHA1 03dbfebfec8c94a9c06f9b0cd81ebe0a2b8be3d1
SHA512 d7adcc76d0470bcd68d7644de3c8d2b6d61df8485979a4752ceea3df4d85bd1c290f72b3d8d5c8d639d5a10afa48d80e457f76b44dd8107ac97eb80fd98c7b0c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 71fb546b5d2210a56e90b448ee10120cd92c518c8f79fb960f01b918f89f2b00
MD5 bafce9e4c53a0cb85310891b6b21791b
SHA1 5d70027cc137a7cbb38f5801b15fd97b05e89ee2
SHA512 c0e4d3eccc0135ac92051539a18f64b8b8628cfe74e5b019d4f8e1dcbb51a9b49c486a1523885fe6be53da7118c013852e753c26a5490538c1e721fd0188836c
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 b3773e660d5f7d7575e58d235c0fb05061ff109584e64f675d248ed66f5fa93c
MD5 9ac9b42a030eef01419437b7f9ee1d65
SHA1 4bd9c9af0c80205478d1d5fb2d500bee96c21d84
SHA512 bb89df7fe9ad5420c093d5451b7774a12f0154c0baceabde8035fdd3b1136f6de651cee7ea8834dbc261a0f507547e63ae8b9d4d0ef721678e89859bede46e65
SSDEEP 96:n7k4K16DALwpvWMoiVmdeHG/oSXA5UWQyV+VDCziEwb:n7kfkcLGWMX2A5ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

memory/8-1-0x0000025509400000-0x0000025509624000-memory.dmp

Download

memory/8-3-0x00007FF9EB9D3000-0x00007FF9EB9D5000-memory.dmp

Download

memory/8-2-0x00007FF9EB9D0000-0x00007FF9EC491000-memory.dmp

Download

memory/8-4-0x00007FF9EB9D0000-0x00007FF9EC491000-memory.dmp

Download

memory/8-0-0x00007FF9EB9D3000-0x00007FF9EB9D5000-memory.dmp

Download