Analysis
-
max time kernel
1798s -
max time network
1801s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
13-01-2023 12:52
Static task
static1
Behavioral task
behavioral1
Sample
hitb2.lua
Resource
win10v2004-20220812-en
General
-
Target
hitb2.lua
-
Size
136B
-
MD5
596e8b4c50fa6579495c12756c3b5f14
-
SHA1
de331021e0b2f8fcb792db5cef59472c1964b3bf
-
SHA256
ec80fee089dba5429a5dd568c14af8e3c23d04da0dbd66bb838d6070cc9a7027
-
SHA512
ccfd44c42c77d4248febb5ddca64a35c043564277f4e8280bff6d4425357329842d73e10fc50119dab17d6dfc5559e591132ec65bf7b066aae9d1e6911c5f0b1
Malware Config
Extracted
C:\Program Files\WinRAR\Rar.txt
-n@inclist.txt
Extracted
C:\Program Files\WinRAR\WhatsNew.txt
https
http
http://weirdsgn.com
http://icondesignlab.com
https://rarlab.com/themes/WinRAR_Classic_48x36.theme.rar
Extracted
revengerat
Guest
127.0.0.1:491
mzu.publicvm.com:491
RV_MUTEX-vTUKIWwiejYA
Signatures
-
Modifies system executable filetype association 2 TTPs 8 IoCs
Processes:
uninstall.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} uninstall.exe -
RevengeRAT
Remote-access trojan with a wide range of capabilities.
-
RevengeRat Executable 3 IoCs
Processes:
resource yara_rule behavioral1/memory/4260-179-0x000000000041CF3E-mapping.dmp revengerat behavioral1/memory/4260-178-0x0000000000400000-0x0000000000420000-memory.dmp revengerat behavioral1/memory/1484-242-0x000000000041CF3E-mapping.dmp revengerat -
XMRig Miner payload 7 IoCs
Processes:
resource yara_rule behavioral1/memory/4812-257-0x0000000000400000-0x0000000000DCB000-memory.dmp xmrig behavioral1/memory/4812-259-0x0000000000400000-0x0000000000DCB000-memory.dmp xmrig behavioral1/memory/4812-260-0x0000000000400000-0x0000000000DCB000-memory.dmp xmrig behavioral1/memory/4812-261-0x0000000000400000-0x0000000000DCB000-memory.dmp xmrig behavioral1/memory/4812-262-0x0000000000400000-0x0000000000DCB000-memory.dmp xmrig behavioral1/memory/4812-263-0x0000000000400000-0x0000000000DCB000-memory.dmp xmrig behavioral1/memory/4812-265-0x0000000000400000-0x0000000000DCB000-memory.dmp xmrig -
Blocklisted process makes network request 2 IoCs
Processes:
WScript.exeflow pid process 334 180 WScript.exe 341 180 WScript.exe -
Downloads MZ/PE file
-
Executes dropped EXE 19 IoCs
Processes:
winrar-x64-611.exeuninstall.exeWinRAR.exeChromeRecovery.exeWinRAR.exeWinRAR.exeWinRAR.exeWinRAR.exeRevenge-RAT v0.3.exeRevenge-RAT v0.3.exeRevenge.exeRevenge-RAT.exeFirefox.exeClient.exeClient.exeWinRAR.exeWinner Ratx.exeTiWorker.exeWinner Rat.exepid process 1180 winrar-x64-611.exe 4792 uninstall.exe 3988 WinRAR.exe 4880 ChromeRecovery.exe 2980 WinRAR.exe 2752 WinRAR.exe 1448 WinRAR.exe 2336 WinRAR.exe 3096 Revenge-RAT v0.3.exe 4492 Revenge-RAT v0.3.exe 2432 Revenge.exe 1912 Revenge-RAT.exe 4600 Firefox.exe 4892 Client.exe 5044 Client.exe 4492 WinRAR.exe 4596 Winner Ratx.exe 4812 TiWorker.exe 1448 Winner Rat.exe -
Modifies Windows Firewall 1 TTPs 3 IoCs
Processes:
netsh.exenetsh.exenetsh.exepid process 880 netsh.exe 3344 netsh.exe 3832 netsh.exe -
Registers COM server for autorun 1 TTPs 3 IoCs
Processes:
uninstall.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ = "C:\\Program Files\\WinRAR\\rarext.dll" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ThreadingModel = "Apartment" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32 uninstall.exe -
Checks computer location settings 2 TTPs 6 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Winner Ratx.exewinrar-x64-611.exeWinRAR.exeRevenge-RAT v0.3.exeRevenge-RAT.exeRegAsm.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation Winner Ratx.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation winrar-x64-611.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation WinRAR.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation Revenge-RAT v0.3.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation Revenge-RAT.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation RegAsm.exe -
Drops startup file 18 IoCs
Processes:
Firefox.exetaskmgr.exeWScript.exetaskmgr.exeRegAsm.exevbc.exeRegAsm.exevbc.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\58a6ba13706fbbb51abcd2626053c0e5.exe Firefox.exe File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\clwindows media centerert.vbs taskmgr.exe File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\cwindows media centerts.js taskmgr.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Revenge-RAT Builder.vbs WScript.exe File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\revenge-rat builder.vbs taskmgr.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\58a6ba13706fbbb51abcd2626053c0e5.exe Firefox.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CWindows Media Centerts.js RegAsm.exe File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\clwindows media centerert.vbs taskmgr.exe File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\cwindows media centerts.js taskmgr.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Media Centert.exe vbc.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ClWindows Media Centerert.vbs RegAsm.exe File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\58a6ba13706fbbb51abcd2626053c0e5.exe taskmgr.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CleWindows Media Centernt.exe RegAsm.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ClWindows Media Centerert.vbs RegAsm.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CWindows Media Centerts.js RegAsm.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Revenge-RAT Builder.vbs WScript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CleWindows Media Centernt.exe RegAsm.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Media Centert.exe vbc.exe -
Loads dropped DLL 2 IoCs
Processes:
Winner Rat.exepid process 2644 1448 Winner Rat.exe -
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
Firefox.exeRegAsm.exeRegAsm.exeWScript.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\58a6ba13706fbbb51abcd2626053c0e5 = "\"C:\\Windows\\Firefox.exe\" .." Firefox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\58a6ba13706fbbb51abcd2626053c0e5 = "\"C:\\Windows\\Firefox.exe\" .." Firefox.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Client = "C:\\Users\\Admin\\AppData\\Roaming\\Client.exe" RegAsm.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Client = "C:\\Users\\Admin\\AppData\\Roaming\\Client.exe" RegAsm.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\software\microsoft\windows\currentversion\run WScript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Revenge-RAT Builder = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\Revenge-RAT Builder.vbs\"" WScript.exe Key created \REGISTRY\MACHINE\software\WOW6432Node\microsoft\windows\currentversion\run WScript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Revenge-RAT Builder = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\Revenge-RAT Builder.vbs\"" WScript.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Drops file in System32 directory 6 IoCs
Processes:
Winner Ratx.exedescription ioc process File created C:\Windows\SysWOW64\TiWorker.exe Winner Ratx.exe File opened for modification C:\Windows\SysWOW64\TiWorker.exe Winner Ratx.exe File created C:\Windows\SysWOW64\config.json Winner Ratx.exe File opened for modification C:\Windows\SysWOW64\config.json Winner Ratx.exe File created C:\Windows\SysWOW64\MicrosoftWindows.xml Winner Ratx.exe File opened for modification C:\Windows\SysWOW64\MicrosoftWindows.xml Winner Ratx.exe -
Suspicious use of SetThreadContext 6 IoCs
Processes:
Revenge.exeRegAsm.exeClient.exeRegAsm.exeClient.exeRegAsm.exedescription pid process target process PID 2432 set thread context of 4260 2432 Revenge.exe RegAsm.exe PID 4260 set thread context of 4432 4260 RegAsm.exe RegAsm.exe PID 4892 set thread context of 1484 4892 Client.exe RegAsm.exe PID 1484 set thread context of 2496 1484 RegAsm.exe RegAsm.exe PID 5044 set thread context of 1648 5044 Client.exe RegAsm.exe PID 1648 set thread context of 2280 1648 RegAsm.exe RegAsm.exe -
Drops file in Program Files directory 64 IoCs
Processes:
chrome.exewinrar-x64-611.exeelevation_service.exedescription ioc process File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Themes\Teal.XML chrome.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\FastColoredTextBox.dll chrome.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\Aut2Exe\Icons\SETUP04.ICO chrome.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\dotNET_Reactor.exe chrome.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Icons\Facebook.ico chrome.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Icons\Internet explorer.ico chrome.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Icons\Vmware.ico chrome.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Icons\Windows.ico chrome.exe File opened for modification C:\Program Files\WinRAR\RarFiles.lst winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\WinRAR.exe winrar-x64-611.exe File opened for modification C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir776_1959984932\manifest.json elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Themes\THE MYSTERIES LEGACY.XML chrome.exe File opened for modification C:\Program Files\WinRAR\RarExtPackage.msix winrar-x64-611.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Revenge-RAT Client Source Code.rar chrome.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\Aut2Exe\Icons\AutoIt_Old1.ico chrome.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Plugin\TS.dll chrome.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\AForge.Video.dll chrome.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\IconLib.dll chrome.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\Aut2Exe\Icons\SETUP10.ICO chrome.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Plugin\KE.dll chrome.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Plugin\FM.dll chrome.exe File opened for modification C:\Program Files\WinRAR\Zip64.SFX winrar-x64-611.exe File opened for modification C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir776_1959984932\ChromeRecovery.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\Aut2Exe\Icons\AutoIt_Old3.ico chrome.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\Resource Hacker.exe chrome.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Icons\Word.ico chrome.exe File opened for modification C:\Program Files\WinRAR winrar-x64-611.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Themes\Dark Slate Blue.XML chrome.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\Aut2Exe\Icons\SETUP08.ICO chrome.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\Aut2Exe\Icons\SETUP11.ICO chrome.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Plugin\RD.dll chrome.exe File opened for modification C:\Program Files\WinRAR\RarExtInstaller.exe winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\WinRAR.chm winrar-x64-611.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\Aut2Exe\Aut2exe.exe chrome.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Icons\Apple.ico chrome.exe File created C:\Program Files\WinRAR\__tmp_rar_sfx_access_check_240622468 winrar-x64-611.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Themes\Tsunamii.XML chrome.exe File created C:\Program Files\WinRAR\WinRAR.chm winrar-x64-611.exe File created C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir776_1959984932\ChromeRecoveryCRX.crx elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Icons\Google Chrome.ico chrome.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\GeoIP.dat chrome.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Plugin\SM.dll chrome.exe File created C:\Program Files\WinRAR\Default64.SFX winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\Default64.SFX winrar-x64-611.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Themes\Black Currant.XML chrome.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Themes\Light Sea Green.XML chrome.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\Aut2Exe\Icons\SETUP01.ICO chrome.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\Aut2Exe\Icons\SETUP12.ICO chrome.exe File created C:\Program Files\WinRAR\WhatsNew.txt winrar-x64-611.exe File created C:\Program Files\WinRAR\Uninstall.lst winrar-x64-611.exe File created C:\Program Files\WinRAR\RarExt32.dll winrar-x64-611.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Themes\Default.XML chrome.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Theme Compiler.exe chrome.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\AHK\Ahk2Exe.exe chrome.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Icons\Application.ico chrome.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Icons\Archive.ico chrome.exe File opened for modification C:\Program Files\WinRAR\UnRAR.exe winrar-x64-611.exe File created C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png winrar-x64-611.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Themes\Ebony.XML chrome.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Icons\Ubuntu.ico chrome.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Plugin\PA.dll chrome.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Plugin\SPC.dll chrome.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\Aut2Exe\Icons\SETUP03.ICO chrome.exe -
Drops file in Windows directory 1 IoCs
Processes:
Revenge-RAT.exedescription ioc process File created C:\Windows\Firefox.exe Revenge-RAT.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4916 4492 WerFault.exe Revenge-RAT v0.3.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exetaskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 4228 schtasks.exe 5096 schtasks.exe 2136 schtasks.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Processes:
WinRAR.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\IESettingSync WinRAR.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" WinRAR.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch WinRAR.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" WinRAR.exe -
Modifies registry class 64 IoCs
Processes:
WinRAR.exeuninstall.exeWinRAR.exeOpenWith.exeWinRAR.exeWinRAR.exeWinRAR.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ WinRAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r03 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r23 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r04 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r04\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r12\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.uue\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.txz\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\ = "WinRAR ZIP archive" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.zip\ShellNew\FileName = "C:\\Program Files\\WinRAR\\zipnew.dat" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.001 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\DefaultIcon uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.rev uninstall.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ WinRAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r23\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.tlz\ = "WinRAR" uninstall.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r02\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r28 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.uu uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ThreadingModel = "Apartment" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA} uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.rar\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.zipx uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r10 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r13\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.tgz\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.gz\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.tzst\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\ = "WinRAR archive" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\DefaultIcon uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\ = "RAR recovery volume" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ WinRAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r09\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ WinRAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.lz uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shell\open uninstall.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ WinRAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r25\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.001\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r28\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.lzh\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.lha\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r21 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.lz\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ WinRAR.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
chrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exetaskmgr.exeFirefox.exepid process 4196 chrome.exe 4196 chrome.exe 2176 chrome.exe 2176 chrome.exe 804 chrome.exe 804 chrome.exe 2616 chrome.exe 2616 chrome.exe 2320 chrome.exe 2320 chrome.exe 4076 chrome.exe 4076 chrome.exe 908 chrome.exe 908 chrome.exe 3636 chrome.exe 3636 chrome.exe 3076 chrome.exe 3076 chrome.exe 2440 chrome.exe 2440 chrome.exe 3120 chrome.exe 3120 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4416 chrome.exe 4416 chrome.exe 3548 chrome.exe 3548 chrome.exe 2284 chrome.exe 2284 chrome.exe 2432 chrome.exe 2432 chrome.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 4600 Firefox.exe 4600 Firefox.exe 4600 Firefox.exe 4600 Firefox.exe -
Suspicious behavior: GetForegroundWindowSpam 6 IoCs
Processes:
WinRAR.exeWinRAR.exeWinRAR.exeWinRAR.exetaskmgr.exeWinRAR.exepid process 3988 WinRAR.exe 2980 WinRAR.exe 1448 WinRAR.exe 2336 WinRAR.exe 3540 taskmgr.exe 4492 WinRAR.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 31 IoCs
Processes:
chrome.exepid process 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe -
Suspicious use of AdjustPrivilegeToken 26 IoCs
Processes:
AUDIODG.EXERevenge.exeRegAsm.exetaskmgr.exeFirefox.exeClient.exeRegAsm.exeClient.exeRegAsm.exetaskmgr.exeTiWorker.exedescription pid process Token: 33 3320 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 3320 AUDIODG.EXE Token: SeDebugPrivilege 2432 Revenge.exe Token: SeDebugPrivilege 4260 RegAsm.exe Token: SeDebugPrivilege 3540 taskmgr.exe Token: SeSystemProfilePrivilege 3540 taskmgr.exe Token: SeCreateGlobalPrivilege 3540 taskmgr.exe Token: SeDebugPrivilege 4600 Firefox.exe Token: 33 4600 Firefox.exe Token: SeIncBasePriorityPrivilege 4600 Firefox.exe Token: 33 4600 Firefox.exe Token: SeIncBasePriorityPrivilege 4600 Firefox.exe Token: 33 4600 Firefox.exe Token: SeIncBasePriorityPrivilege 4600 Firefox.exe Token: SeDebugPrivilege 4892 Client.exe Token: SeDebugPrivilege 1484 RegAsm.exe Token: SeDebugPrivilege 5044 Client.exe Token: SeDebugPrivilege 1648 RegAsm.exe Token: 33 3540 taskmgr.exe Token: SeIncBasePriorityPrivilege 3540 taskmgr.exe Token: SeDebugPrivilege 940 taskmgr.exe Token: SeSystemProfilePrivilege 940 taskmgr.exe Token: SeCreateGlobalPrivilege 940 taskmgr.exe Token: 33 940 taskmgr.exe Token: SeIncBasePriorityPrivilege 940 taskmgr.exe Token: SeLockMemoryPrivilege 4812 TiWorker.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
chrome.exeWinRAR.exepid process 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 3988 WinRAR.exe 3988 WinRAR.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 3988 WinRAR.exe 3988 WinRAR.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
chrome.exetaskmgr.exepid process 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe -
Suspicious use of SetWindowsHookEx 45 IoCs
Processes:
OpenWith.exewinrar-x64-611.exeWinRAR.exeRevenge-RAT v0.3.exeRegAsm.exeRegAsm.exevbc.exevbc.exevbc.exevbc.exevbc.exevbc.exevbc.exevbc.exevbc.exevbc.exevbc.exevbc.exevbc.exevbc.exevbc.exevbc.exevbc.exevbc.exevbc.exevbc.exevbc.exevbc.exevbc.exevbc.exeRegAsm.exeRegAsm.exevbc.exevbc.exevbc.exevbc.exevbc.exevbc.exevbc.exevbc.exevbc.exeWinner Ratx.exeWinner Rat.exepid process 1584 OpenWith.exe 1180 winrar-x64-611.exe 1180 winrar-x64-611.exe 3988 WinRAR.exe 3988 WinRAR.exe 3096 Revenge-RAT v0.3.exe 4260 RegAsm.exe 4432 RegAsm.exe 3720 vbc.exe 448 vbc.exe 3040 vbc.exe 4952 vbc.exe 4736 vbc.exe 4060 vbc.exe 4936 vbc.exe 1628 vbc.exe 2324 vbc.exe 3356 vbc.exe 2168 vbc.exe 2004 vbc.exe 3148 vbc.exe 776 vbc.exe 3040 vbc.exe 4308 vbc.exe 1444 vbc.exe 2752 vbc.exe 4480 vbc.exe 3248 vbc.exe 3056 vbc.exe 3608 vbc.exe 5072 vbc.exe 2004 vbc.exe 1484 RegAsm.exe 2496 RegAsm.exe 3364 vbc.exe 1432 vbc.exe 1956 vbc.exe 3396 vbc.exe 3956 vbc.exe 3568 vbc.exe 3604 vbc.exe 1280 vbc.exe 772 vbc.exe 4596 Winner Ratx.exe 1448 Winner Rat.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 2176 wrote to memory of 2076 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 2076 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 2964 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 2964 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 2964 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 2964 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 2964 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 2964 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 2964 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 2964 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 2964 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 2964 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 2964 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 2964 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 2964 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 2964 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 2964 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 2964 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 2964 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 2964 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 2964 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 2964 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 2964 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 2964 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 2964 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 2964 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 2964 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 2964 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 2964 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 2964 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 2964 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 2964 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 2964 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 2964 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 2964 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 2964 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 2964 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 2964 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 2964 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 2964 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 2964 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 2964 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 4196 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 4196 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 2508 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 2508 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 2508 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 2508 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 2508 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 2508 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 2508 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 2508 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 2508 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 2508 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 2508 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 2508 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 2508 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 2508 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 2508 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 2508 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 2508 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 2508 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 2508 2176 chrome.exe chrome.exe PID 2176 wrote to memory of 2508 2176 chrome.exe chrome.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\hitb2.lua1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa67474f50,0x7ffa67474f60,0x7ffa67474f702⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1672 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2040 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2304 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2960 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3164 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3764 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4500 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4612 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4772 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2952 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5412 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5520 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5488 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4516 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3576 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5908 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5896 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4776 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4512 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6216 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4548 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6200 /prefetch:82⤵
-
C:\Users\Admin\Downloads\winrar-x64-611.exe"C:\Users\Admin\Downloads\winrar-x64-611.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\WinRAR\uninstall.exe"C:\Program Files\WinRAR\uninstall.exe" /setup3⤵
- Modifies system executable filetype association
- Executes dropped EXE
- Registers COM server for autorun
- Modifies registry class
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6480 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6488 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=968 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3028 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3512 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1564 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6532 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2540 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2064 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3324 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5692 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5316 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=212 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6044 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4588 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5644 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6844 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\Revenge-RAT v0.0.3.5 BETA.rar"2⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=7036 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7064 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3512 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3512 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7060 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2764 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7104 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6764 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5676 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6332 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4452 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5172 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5536 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4836 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4652 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7368 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5500 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7376 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7432 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4664 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2356 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5132 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4732 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5488 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7404 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4876 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6460 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6400 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=78 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7716 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=79 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6044 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=80 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1028 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7756 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=82 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7748 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7768 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=84 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7884 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=85 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=86 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=87 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1604 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=88 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7116 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=90 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7108 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=89 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8132 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8140 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:82⤵
- Drops file in Program Files directory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5556 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\Revenge-RAT_v0.3.rar"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\AppData\Local\Temp\Rar$DIa2980.37387\Revenge-RAT Client Source Code.rar"3⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5140 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7304 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=904 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3380 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5140 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7244 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7592 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7636 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7936 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3080 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7884 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1604 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6692 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7812 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4464 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6984 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=110 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7096 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=111 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7080 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=112 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6412 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7868 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=114 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7628 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5964 /prefetch:82⤵
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\wiRAT v0.1.5F.zip"2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7208 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1548 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7560 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4844 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4936 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6724 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4756 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5432 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1668,14667747295412224246,15087030401616150962,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3504 /prefetch:82⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x300 0x4941⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe"1⤵
- Drops file in Program Files directory
-
C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir776_1959984932\ChromeRecovery.exe"C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir776_1959984932\ChromeRecovery.exe" --appguid={8A69D345-D564-463c-AFF1-A69D9E530F96} --browser-version=89.0.4389.114 --sessionid={0c4be24d-9ca5-4a51-8614-57d9bb499656} --system2⤵
- Executes dropped EXE
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Desktop\Revenge-RAT Client Source Code.rar"1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\Revenge-RAT_v0.3.rar"1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Users\Admin\Desktop\rev\Revenge-RAT v0.3.exe"C:\Users\Admin\Desktop\rev\Revenge-RAT v0.3.exe"1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v0.3.exe"C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v0.3.exe"2⤵
- Executes dropped EXE
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4492 -s 9843⤵
- Program crash
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Revenge-RAT Builder.vbs"2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\Revenge.exe"C:\Users\Admin\AppData\Local\Temp\Revenge.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"4⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\-tn2yv0q.cmdline"4⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFC8.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc9CE3531C30B744F18E3379F0ACEAA42.TMP"5⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\2ja7zwxz.cmdline"4⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES11EB.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc9763FB29561A4009BF347F8C8CFB6381.TMP"5⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\kd8ygblb.cmdline"4⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES144C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcDB3E978379AF4FCA987BCC578D3F396.TMP"5⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\9bc6dxvk.cmdline"4⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES15E2.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc7D6692FA4F5342F79E4F1B316BF4DA2.TMP"5⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\kbb6gvpe.cmdline"4⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES170B.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4124CDD783BF49C5BAF97A28D266AEC0.TMP"5⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\3s8ctchn.cmdline"4⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1815.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc910D77B7A5C74AC49658DC8D9064C923.TMP"5⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ixc_ahm4.cmdline"4⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES18F0.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc116FCED394044B248945F7B99B44F25F.TMP"5⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\u62qtzr8.cmdline"4⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES19BB.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc9A59504CBD9645D9866E16C42F83E834.TMP"5⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\4oruj7wp.cmdline"4⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1AD4.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE7634E0278424A2587ABCBA6C1548C6E.TMP"5⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\jseo5zuc.cmdline"4⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1BCE.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc5138C1284CA7417A9C465A554FD1716C.TMP"5⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\xixlc_bo.cmdline"4⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1CD8.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB2EEA43B79F24A73A3293D602891B1F.TMP"5⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\51olpz6h.cmdline"4⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1DD2.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc88030BAF5D514D3183D8CFB79FC796E.TMP"5⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\lnslequq.cmdline"4⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1EBC.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc6A922EA760542F197E422D955819A6A.TMP"5⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\f1t7jtf9.cmdline"4⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1FD5.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc46A4B60ED2B479A859260B68A8329E6.TMP"5⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ilaht4gp.cmdline"4⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES20CF.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc110D786B2FC4731A9E56A78B8D7963C.TMP"5⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\fpynfv4h.cmdline"4⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES21C9.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc64CCDE5F4F8148FD83137927BA39B631.TMP"5⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\8hlshiex.cmdline"4⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES22A4.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE18DBAA3B5A4AAC84E1DBDC2AD886A7.TMP"5⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\bzdyvxv7.cmdline"4⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES23FC.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE3D570E5436E42BBAC1CA71FAC43D653.TMP"5⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\4lmbplv0.cmdline"4⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES24D7.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc7B915F585F364553BE4D41AC19DE337.TMP"5⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ukqeuvlg.cmdline"4⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES25C1.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc306A56B6DD884C01836C8C083BE7C2.TMP"5⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\gn17p_9s.cmdline"4⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES267C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc7668EB639E254640B4E91DD4F4EE51AC.TMP"5⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\gm8ai7sg.cmdline"4⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\f9tislqh.cmdline"4⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2803.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc665389EAE2674D9A8CD756F382FE5F.TMP"5⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\udtk_jy-.cmdline"4⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES28FD.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc6A80E1191B7C417B82E5294B297C51A8.TMP"5⤵
-
C:\Users\Admin\AppData\Roaming\Client.exe"C:\Users\Admin\AppData\Roaming\Client.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"5⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\-hkhv5mt.cmdline"6⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\h1zlakoy.cmdline"6⤵
- Drops startup file
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC02C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc6E721585160409196702ECB234D4A4.TMP"7⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Clientdhdh" /tr "C:\Users\Admin\AppData\Roaming\Client.exe"6⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\5pc8ii8u.cmdline"6⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC4FF.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcBA5783E16001494B9BC9E26A60874E5.TMP"7⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\gjxwtyz6.cmdline"6⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC750.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB56B94673E324BE296D8C11D6E92BB9F.TMP"7⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ocpelicc.cmdline"6⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC935.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD4E4C016EE94D318B9CCF4D9BADA162.TMP"7⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\v3eifowi.cmdline"6⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCA2F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcDB63CF6541F47FE938ED34FE3DCBF2.TMP"7⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\6uqxzbej.cmdline"6⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCB19.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc8488ECD6C9B94683A9BB13F578BD69E.TMP"7⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ecli4fod.cmdline"6⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCC03.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcC95D31C381C74A5CBFA8152CBF5AFDA9.TMP"7⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\bgt0ogma.cmdline"6⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCD1D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc21E474CB26694142A842B94D5B893431.TMP"7⤵
-
C:\Users\Admin\AppData\Local\Temp\Revenge-RAT.exe"C:\Users\Admin\AppData\Local\Temp\Revenge-RAT.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in Windows directory
-
C:\Windows\Firefox.exe"C:\Windows\Firefox.exe"3⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Windows\Firefox.exe" "Firefox.exe" ENABLE4⤵
- Modifies Windows Firewall
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 408 -p 4492 -ip 44921⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops startup file
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Roaming\Client.exeC:\Users\Admin\AppData\Roaming\Client.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"2⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\wubpoguv.cmdline"3⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ftw3szxh.cmdline"3⤵
- Drops startup file
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDDA2.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc5B7423EBC7546CF99787831AE5E9DE8.TMP"4⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Clientdhdh" /tr "C:\Users\Admin\AppData\Roaming\Client.exe"3⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\v4yvclao.cmdline"3⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\afcf1hnn.cmdline"3⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\qmcl2woh.cmdline"3⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\fyalbnex.cmdline"3⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\cvj28xfi.cmdline"3⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\1twz_urf.cmdline"3⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\f4mpzhuh.cmdline"3⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\fvjhecqw.cmdline"3⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\vbgdzyju.cmdline"3⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\1p9ii7gb.cmdline"3⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\rotssfcy.cmdline"3⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\2iwt4xvw.cmdline"3⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\mrdiv7v_.cmdline"3⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\5-ljrjve.cmdline"3⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\p0nk3l5m.cmdline"3⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\k8kecb4w.cmdline"3⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\g0ad96f9.cmdline"3⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\nsrk1vji.cmdline"3⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ekqu5eye.cmdline"3⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\2rydogls.cmdline"3⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\yghvueab.cmdline"3⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\vgwvvs2w.cmdline"3⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\dnwwh0ez.cmdline"3⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\jbwsv2qd.cmdline"3⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\0nd4b_ds.cmdline"3⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\wjrtugu5.cmdline"3⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\kct6kjhp.cmdline"3⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\cjy_pcon.cmdline"3⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\iacuyvq4.cmdline"3⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\w16nyrpo.cmdline"3⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\rwtqcrde.cmdline"3⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\tpjw-el1.cmdline"3⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\qyssleeh.cmdline"3⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\sdmlssdj.cmdline"3⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\u86yneqh.cmdline"3⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\pacbrx5k.cmdline"3⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ptiwtwfz.cmdline"3⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\2nuzwoym.cmdline"3⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\dphtmx6a.cmdline"3⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\l2lft9qy.cmdline"3⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\1yzkuepv.cmdline"3⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\xpbmfak6.cmdline"3⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\f2_nbdiy.cmdline"3⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\wj_fdvrc.cmdline"3⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\mu7hcuyz.cmdline"3⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops startup file
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Desktop\wiRAT v0.1.5F\Winner Ratx.exe"C:\Users\Admin\Desktop\wiRAT v0.1.5F\Winner Ratx.exe"1⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /End /TN "Microsoft\Windows\MUI\WindowsUpdate" & schtasks /End /TN "WindowsUpdate" & exit2⤵
-
C:\Windows\system32\schtasks.exeschtasks /End /TN "Microsoft\Windows\MUI\WindowsUpdate"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /End /TN "WindowsUpdate"3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /Delete /TN "WindowsUpdate" /F & exit2⤵
-
C:\Windows\system32\schtasks.exeschtasks /Delete /TN "WindowsUpdate" /F3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="System" dir=out action=allow program="%windir%\SysWOW64\TiWorker.exe" enable=yes & exit2⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="System" dir=out action=allow program="C:\Windows\SysWOW64\TiWorker.exe" enable=yes3⤵
- Modifies Windows Firewall
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="System" dir=in action=allow program="%windir%\SysWOW64\TiWorker.exe" enable=yes & exit2⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="System" dir=in action=allow program="C:\Windows\SysWOW64\TiWorker.exe" enable=yes3⤵
- Modifies Windows Firewall
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /Create /XML "%windir%\SysWOW64\MicrosoftWindows.xml" /TN "Microsoft\Windows\MUI\WindowsUpdate" /F & exit2⤵
-
C:\Windows\system32\schtasks.exeschtasks /Create /XML "C:\Windows\SysWOW64\MicrosoftWindows.xml" /TN "Microsoft\Windows\MUI\WindowsUpdate" /F3⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /Change /TN "Microsoft\Windows\MUI\WindowsUpdate" /TR "%windir%\SysWOW64\TiWorker.exe" & schtasks /Run /TN "Microsoft\Windows\MUI\WindowsUpdate" & exit2⤵
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\MUI\WindowsUpdate" /TR "C:\Windows\SysWOW64\TiWorker.exe"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /Run /TN "Microsoft\Windows\MUI\WindowsUpdate"3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c certutil –addstore –f root MicrosoftWindows.crt & exit2⤵
-
C:\Windows\system32\certutil.execertutil –addstore –f root MicrosoftWindows.crt3⤵
-
C:\Users\Admin\Desktop\wiRAT v0.1.5F\Winner Rat.exe"C:\Users\Admin\Desktop\wiRAT v0.1.5F\Winner Rat.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\TiWorker.exeC:\Windows\SysWOW64\TiWorker.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\WinRAR\Rar.txtFilesize
107KB
MD58933d6e810668af29d7ba8f1c3b2b9ff
SHA1760cbb236c4ca6e0003582aaefd72ff8b1c872aa
SHA256cd3ba458c88bdf8924ebb404c8505d627e6ac7aadc6e351562c1894019604fc7
SHA512344d737228483add83d5f2b31ae9582ca78013dc4be967f2cdafca24145970e3cb46d75373996150a3c9119ebc81ce9ac50e16696c17a4dea65c9571ef8e745e
-
C:\Program Files\WinRAR\Uninstall.exeFilesize
412KB
MD592667e28583a9489e3cf4f1a7fd6636e
SHA1faa09990ba4daae970038ed44e3841151d6e7f28
SHA2569147293554ad43920bcf763ffd6e1183c36b9f8156dc220548426a187a5f2959
SHA51263555a15f153df59b2ca2ab56cd20d71420eb5c9977bcf774723d8484157172b027f71fb2f7a4692aecc6e471f50beec2e0f7a43e57449714caede1e9684c0b8
-
C:\Program Files\WinRAR\WhatsNew.txtFilesize
95KB
MD5d4c768c52ee077eb09bac094f4af8310
SHA1c56ae6b4464799fcdc87c5ff5a49ac1ad43482b1
SHA2568089dfbebdf2142c7f60f5c12098859417b3c997f0b24b696ccaa78a50f3726c
SHA5125b794b19b5ff10f7356a46f02204d0df3183037bc89d32e3f2c2978ea8f90ac6367fcb225b476cb7c8a3035d82ca1e328791271d3a58b40b9759d4b65e83f847
-
C:\Program Files\WinRAR\WinRAR.chmFilesize
314KB
MD581b236ef16aaa6a3936fd449b12b82a2
SHA1698acb3c862c7f3ecf94971e4276e531914e67bc
SHA256d37819e64ecb61709fcf3435eb9bed790f75163057e36fb94a3465ca353ccc5e
SHA512968fe20d6fe6879939297b8683da1520a1e0d2b9a5107451fca70b91802492e243976f56090c85eb9f38fca8f74134b8b6aa133ba2e2806d763c9f8516ace769
-
C:\Program Files\WinRAR\WinRAR.exeFilesize
2.3MB
MD50b114fc0f4b6d49f57b3b01dd9ea6a8c
SHA123e1480c3ff3a54e712d759e9325d362bf52fabd
SHA256f0f312fe14599d7379aa247c1d0cc6100db45bfe7f277113134a8157950bcacd
SHA512e31c3a3da5e72a9d72e245d6e5dcc7c92e4cfcbb6bdbb61061e0586e29f77e8b42a81a0bba99ce45e148a2423907878fb858c40cc1008ef9d90fb8e4e2fcd573
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\CachesMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Users\Admin\Desktop\CompareHide.vdxFilesize
619KB
MD5df8caa1b961ee49d5be55afde54c8c3b
SHA1a1ef5b5edec31412d718c2d2ce785fb777a43f2f
SHA2566b02ab30d5da106fe34384076f4f7b6904dd71c5390a6c9a45ef58d61542a1bb
SHA512269f15c2fb2625cc3bf8841b62342f8bdca5e60a9e987d5c2a7fe23457a149311293589e8f24f68c19165d3a99094ad1a192cddc5f0fac5b1f041cc67ad64e57
-
C:\Users\Admin\Desktop\CompleteCompare.lnkFilesize
675KB
MD5e1d324ba57bea4e58374720a989c6fdc
SHA16d387109697167da621e8cf773179ba55f0dae85
SHA256afadcfccf544baf36e88feb0de0af35ce490de17f6d980045d9339f4a12cdff3
SHA51212a576f92cf711a983eab6cf20a034602a25d705deb6a6f02c0e9db1512d0beedfeed6c2af35aed8bb403ba58273d627e2ca78e259e932c650095ea2eee3992b
-
C:\Users\Admin\Desktop\ConvertToResolve.htmFilesize
535KB
MD5e65e6f1942a76a2dc0ec8970206efb76
SHA150dcd2c1040f1ddb1672ceaad6f2b177ac757f07
SHA2560b822819d0154167395b7ac8761954541f0e4d9437da248815c8d6daa23e1143
SHA51262aa9394b598c074db794098ce6b3740b65da8aa8fd9f757956a772f71cc475fcdae78697c87f24b00f257bdaf6bb428865988079a845b9c26f37b0a465276a5
-
C:\Users\Admin\Desktop\ConvertToShow.gifFilesize
788KB
MD517be6b5e6b10b1c2ed04fdc9ebb63ea7
SHA17ed9bcbe59961edd2741a0e7034e7ea19ea1e6d8
SHA2561023258955d839708bd46c52c1cc0482ee0f0dc960a7656d724b7d9b478ac23e
SHA512abb45f8bc7cfaac6df43a244ba44fadd801477e4212c574106626d74564aabd342500da51291b2900cdcae65c0b5288a727ae3232e3cb23572b17d63dcb93412
-
C:\Users\Admin\Desktop\ConvertUninstall.ps1xmlFilesize
394KB
MD5016146d2b387710b6c3e2793b3d4dbd0
SHA1d05555fe67ef8ed0afa569140a5db79f79fc57b5
SHA256425c6a68b3ba98a3d142ada16b81496c08c12edf4ba1913b10841e4087746b88
SHA51271239a561766c104c2d697d09e092e3d1fe6dcf50143e66cffbbfd6dafdd46ab7de8d54d3fcbcd542c15fe1541fe9f84287454ef3ead34c7d172999aae07d4f5
-
C:\Users\Admin\Desktop\DebugJoin.htmFilesize
478KB
MD5b1cb0caea5ec5294d419aa48a9e19dc2
SHA1e66af53b5a7a8b4f84bd4b3f3bee518c3989e0e9
SHA25679e390fee5ce52cfce3501351b674f509036adaf549815db803274062a77c560
SHA5123d7102be6ebd905383d88f9306031e60a4d981b5773697963294e4f0ae49add63d9067b2e75ae5f12815ed0d6782c6824fd8523d9dd7f49e11dfc6a7284a9421
-
C:\Users\Admin\Desktop\DismountWatch.wmaFilesize
591KB
MD5bbafab521865ff2f6027ee319811465c
SHA1209b3b8f82fb28f696478cf759b6a1bb681ae71b
SHA256f6be75fab3a32a1174bf780698fc61b677d6897d8074ee725d8259d915d2dc0b
SHA512c86da30d536222a3f70da2eca6e5b0e3a78f46d861b790668b0f04d1cf0e76e427cfeba9c21b2d726d1cd1d553c417db06c013d36550ad83ce08c44f6734f320
-
C:\Users\Admin\Desktop\FormatConnect.cmdFilesize
506KB
MD53dd88605235a397d4f4d7be5de72fbec
SHA1976dbca0dbdfcef7f23fab6c06e451129ced5811
SHA256f61148a3ab133b5550956d5f9048e7aeca5efcc133ee317e69094f2fb85442a3
SHA512f1d9a3c416eab0e1456d8957346d85aa579c7c5dedf9a84c289f27148e5eb1f7cd92ded02623029b21da37c7a385a99fd05be90ea0010c6b6147dd7c4dabfc06
-
C:\Users\Admin\Desktop\GrantCompress.tifFilesize
366KB
MD54cb537aed6c7a18287e5d84f4245c5eb
SHA18e63c709514d3eabdbd82dcd7871b470e46de52a
SHA2563dcbe14083f0ecb9dc3e56a30b8c36c207586a0bbcafbe16896d6531515bcb04
SHA512cdaba677f5761ca9ad698779517500bca0080e812ef58864ca0ab60ad704519a63651d03da89a9679ab164b1abfca84adb89bbf077c138f93b821b2626c42f5c
-
C:\Users\Admin\Desktop\NewEdit.odsFilesize
732KB
MD5618bdf814dc055c3700894c44f10cfe2
SHA1e52006646526c02ae2bebd2d1afecf0ffc871919
SHA2568a94c0bbd1ea1bee0b367380dce9166f0b7d3e58e97cb1b8c69abaf154354dbc
SHA5127dd82753ef07dbd111890fb78d709da3f07aa1042dcc5c75f2df39a11ebd5b57a1806f30151b33ee81cccae43153e2a26c2261ac9411a4991c03e1e748b54132
-
C:\Users\Admin\Desktop\PingStart.htmlFilesize
309KB
MD534f4d669f39b0a140c96132c0dfd215d
SHA153536af05eb3aabaa71fe04d1376720736a3bc8f
SHA25670e92ce84cc6512ef02a71698eed688284e8c06fc6f9934902aa0c710d763598
SHA512a467d5eab96755899ff36eab58c8082dd9a9f1308fdd462d3b9e39f8731802b7f9ea6be54fb5f33aec0f5f1f93ecafb6fdbe7dcc6294f04222f739474f7f39f0
-
C:\Users\Admin\Desktop\PushPing.zipFilesize
422KB
MD5771ce0bd1e6c462dcb8b2810a0f9981f
SHA137101649267d6b509bdf4c6d86d777f33146d267
SHA2560be097621f58b0fd26fc72f8eb828b24bd4daf46cb8dd94e0e3dff86899876b2
SHA512691486455b503edc5fee85c0efc5c0b1f4f0f8a52b69f08df758525d0cbf5b7c19ca6bd66043f4b9540a4db2cc97b0c25efb0b472c0a4dbe5ccb28e46e823a0c
-
C:\Users\Admin\Desktop\ReceiveJoin.jpeFilesize
1.1MB
MD59ea91ac9e2b05afdadfc953038d937c6
SHA14fd1d6d30c8fa4fc459b20a2a9ca987b335d771a
SHA25622b53a152e407d43495bfb78e8239064283b4e9f9b09eeddca95b462f75b4abf
SHA512afc8d6d737bd0dee41f7dd6bc0d36c16428f64ae0cbdb878e43ef80e9a81356bf0058b417529036e007908377bdc29e0944772cf3c874210e3c043104611ac43
-
C:\Users\Admin\Desktop\RegisterReset.clrFilesize
281KB
MD570527e10a48a47e5017f4171514643ef
SHA17dc2a6f56c72dcc60e566eee72c963355de7ac0a
SHA2566255cf73ec2e779ccd18b97860da75ac646b7dcc4e29c7c16498aa06f2c22d85
SHA512a3fa8fc4f374452e6e4e91a07ad8f54a577c1023991337953bba005ebcaa00fe97bd93ddcff54b370b57d8b66d90820f5d04811f7cf91662b87c8ccf6631bdb1
-
C:\Users\Admin\Desktop\ResizeRevoke.eprtxFilesize
647KB
MD5bd3eb838a47cab8ef06355bce71224f2
SHA143572f283d14fb018c9182d0f283148fde2c5563
SHA256845282495c2796ce5fff6bad1aa89745e6e38c0a1251fd9c26939b61e253244b
SHA5126c80c26a3b85a335337593c6225d244ae56e8e8db1871ad6ec3486da99949e6f8f01345b3d7419f2821c79a897107308c888326a69065c09ca3f5edcb2ea757c
-
C:\Users\Admin\Desktop\ResolvePing.vbFilesize
704KB
MD5ea46b4c8eecbc6efa7e62dad5c14e181
SHA1017fc63425d7d82972380c043f4984ba235fcbde
SHA2561797f31af61e604132f72b1b4f53d45e81028be3328d71f632973879cedca90a
SHA512aa533539216cf8472640aa3405ff1d1ecb0b2c80079cf4baf01fb129b9bdebbe0d794e2721137ce90c515276a3c2bcba90cd8b7b3bb9f3475c38ac13dc373692
-
C:\Users\Admin\Desktop\RevokeDisconnect.tifFilesize
563KB
MD502a6b4e2f33652156ce4b12e9e434662
SHA15fb5973ff5a804f047c0c7adffb3423416128902
SHA2568b535621a0f6cd4c4827c678f97ac24c4235d8c99e8e5c41bff0704529faaa56
SHA5126237599b7234949ab8d6e327bf41729bbbf6c31ace5e657bcb416f2a2e60777fe11a3bd41c6199d146881b7de64bfb92e4d178860c3f946940aea0efb31dbf81
-
C:\Users\Admin\Desktop\StepClose.sndFilesize
450KB
MD5e8864dd51b58525cfce3c82d8f689b31
SHA1d50fa9e50c418c0a1ee90c129cedb18a77b01e0f
SHA256be705f1e317009536789e3d4183dfc40c942ce11757fb16289ef1cd232096713
SHA51260b0be705c707f9b7ce14875e86b2cbd2f1f045e626ee3875d99cdc1e76c7652c58e66d1dbce14b2d9b330d2d099406137b1f8212808d4250607fef637c28560
-
C:\Users\Admin\Desktop\SuspendPing.mpgFilesize
760KB
MD575a938ddfcdb32a4e6b68998577d1a56
SHA117fb0aede0baba2ec616476106a1b0572521c610
SHA256b649a0c86f5ab266fa543da026815b61bfa5e9a94c417d457cbf802820a9a6f7
SHA512623a63e9265a57149a839769e2e25d50606fc6063dce394620ae181ae36949f8642c8526bf5ccf7262907916917e44a100f65792b0b5feff53840acce2d4f1c3
-
C:\Users\Admin\Desktop\SwitchNew.xmlFilesize
337KB
MD5a99be5608900cfe5e3c8532414a16b44
SHA1b7337b51e0c96de93c3850b602d28adb63032a97
SHA2565b21edf6969233d00b7a94e9bd37b49cfaf802da81bbbd500fa622c2a4db00cf
SHA5129fba929c7196ac76aec050167333749c22c147e267c0d159f010f3b8eb8f592aed69c824e6adfef6cac14abd871dc8d8ab7f636ff3b5854e16f6d8e308432611
-
C:\Users\Admin\Downloads\winrar-x64-611.exeFilesize
3.3MB
MD58a6217d94e1bcbabdd1dfcdcaa83d1b3
SHA199b81b01f277540f38ea3e96c9c6dc2a57dfeb92
SHA2563023edb4fc3f7c2ebad157b182b62848423f6fa20d180b0df689cbb503a49684
SHA512a8f6f6fdfa9d754a577b7dd885a938fb9149f113baa2afb6352df622cdb73242175a06cd567e971fd3de93a126ba05b78178d5d512720d8fdb87ececce2cbf54
-
C:\Users\Admin\Downloads\winrar-x64-611.exeFilesize
3.3MB
MD58a6217d94e1bcbabdd1dfcdcaa83d1b3
SHA199b81b01f277540f38ea3e96c9c6dc2a57dfeb92
SHA2563023edb4fc3f7c2ebad157b182b62848423f6fa20d180b0df689cbb503a49684
SHA512a8f6f6fdfa9d754a577b7dd885a938fb9149f113baa2afb6352df622cdb73242175a06cd567e971fd3de93a126ba05b78178d5d512720d8fdb87ececce2cbf54
-
\??\pipe\crashpad_2176_SGRWFYHWGVEOGONTMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/180-171-0x0000000000000000-mapping.dmp
-
memory/332-208-0x0000000000000000-mapping.dmp
-
memory/448-193-0x0000000000000000-mapping.dmp
-
memory/632-235-0x0000000000000000-mapping.dmp
-
memory/776-217-0x0000000000000000-mapping.dmp
-
memory/1180-153-0x0000000000000000-mapping.dmp
-
memory/1444-223-0x0000000000000000-mapping.dmp
-
memory/1448-266-0x000000000129A000-0x000000000129F000-memory.dmpFilesize
20KB
-
memory/1448-264-0x00007FFA54DC0000-0x00007FFA557F6000-memory.dmpFilesize
10.2MB
-
memory/1448-267-0x000000000129A000-0x000000000129F000-memory.dmpFilesize
20KB
-
memory/1484-242-0x000000000041CF3E-mapping.dmp
-
memory/1484-248-0x0000000074CA0000-0x0000000075251000-memory.dmpFilesize
5.7MB
-
memory/1484-246-0x0000000074CA0000-0x0000000075251000-memory.dmpFilesize
5.7MB
-
memory/1484-249-0x0000000074CA0000-0x0000000075251000-memory.dmpFilesize
5.7MB
-
memory/1532-228-0x0000000000000000-mapping.dmp
-
memory/1628-205-0x0000000000000000-mapping.dmp
-
memory/1648-253-0x0000000074B50000-0x0000000075101000-memory.dmpFilesize
5.7MB
-
memory/1648-255-0x0000000074B50000-0x0000000075101000-memory.dmpFilesize
5.7MB
-
memory/1748-230-0x0000000000000000-mapping.dmp
-
memory/1844-196-0x0000000000000000-mapping.dmp
-
memory/1912-177-0x0000000074CA0000-0x0000000075251000-memory.dmpFilesize
5.7MB
-
memory/1912-186-0x0000000074CA0000-0x0000000075251000-memory.dmpFilesize
5.7MB
-
memory/1912-173-0x0000000000000000-mapping.dmp
-
memory/2004-213-0x0000000000000000-mapping.dmp
-
memory/2004-236-0x0000000000000000-mapping.dmp
-
memory/2168-211-0x0000000000000000-mapping.dmp
-
memory/2252-206-0x0000000000000000-mapping.dmp
-
memory/2280-254-0x0000000074B50000-0x0000000075101000-memory.dmpFilesize
5.7MB
-
memory/2280-252-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/2324-207-0x0000000000000000-mapping.dmp
-
memory/2432-224-0x0000000000000000-mapping.dmp
-
memory/2432-172-0x0000000000000000-mapping.dmp
-
memory/2432-176-0x00007FFA502F0000-0x00007FFA50D26000-memory.dmpFilesize
10.2MB
-
memory/2496-243-0x0000000000000000-mapping.dmp
-
memory/2496-245-0x0000000074CA0000-0x0000000075251000-memory.dmpFilesize
5.7MB
-
memory/2752-169-0x0000000000000000-mapping.dmp
-
memory/2752-225-0x0000000000000000-mapping.dmp
-
memory/2884-194-0x0000000000000000-mapping.dmp
-
memory/2980-168-0x0000000000000000-mapping.dmp
-
memory/3040-195-0x0000000000000000-mapping.dmp
-
memory/3040-219-0x0000000000000000-mapping.dmp
-
memory/3056-231-0x0000000000000000-mapping.dmp
-
memory/3148-215-0x0000000000000000-mapping.dmp
-
memory/3224-204-0x0000000000000000-mapping.dmp
-
memory/3248-229-0x0000000000000000-mapping.dmp
-
memory/3356-209-0x0000000000000000-mapping.dmp
-
memory/3364-202-0x0000000000000000-mapping.dmp
-
memory/3608-233-0x0000000000000000-mapping.dmp
-
memory/3720-191-0x0000000000000000-mapping.dmp
-
memory/3832-189-0x0000000000000000-mapping.dmp
-
memory/3868-216-0x0000000000000000-mapping.dmp
-
memory/3968-237-0x0000000000000000-mapping.dmp
-
memory/3988-164-0x0000000000000000-mapping.dmp
-
memory/4060-201-0x0000000000000000-mapping.dmp
-
memory/4172-232-0x0000000000000000-mapping.dmp
-
memory/4260-188-0x0000000074CA0000-0x0000000075251000-memory.dmpFilesize
5.7MB
-
memory/4260-239-0x0000000074CA0000-0x0000000075251000-memory.dmpFilesize
5.7MB
-
memory/4260-179-0x000000000041CF3E-mapping.dmp
-
memory/4260-178-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/4260-182-0x0000000074CA0000-0x0000000075251000-memory.dmpFilesize
5.7MB
-
memory/4308-221-0x0000000000000000-mapping.dmp
-
memory/4432-183-0x0000000074CA0000-0x0000000075251000-memory.dmpFilesize
5.7MB
-
memory/4432-180-0x0000000000000000-mapping.dmp
-
memory/4480-227-0x0000000000000000-mapping.dmp
-
memory/4492-184-0x00007FFA62FF0000-0x00007FFA63AB1000-memory.dmpFilesize
10.8MB
-
memory/4492-175-0x00007FFA62FF0000-0x00007FFA63AB1000-memory.dmpFilesize
10.8MB
-
memory/4492-174-0x0000019B891E0000-0x0000019B89FA4000-memory.dmpFilesize
13.8MB
-
memory/4492-170-0x0000000000000000-mapping.dmp
-
memory/4572-218-0x0000000000000000-mapping.dmp
-
memory/4600-190-0x0000000074CA0000-0x0000000075251000-memory.dmpFilesize
5.7MB
-
memory/4600-187-0x0000000074CA0000-0x0000000075251000-memory.dmpFilesize
5.7MB
-
memory/4600-247-0x0000000074CA0000-0x0000000075251000-memory.dmpFilesize
5.7MB
-
memory/4600-185-0x0000000000000000-mapping.dmp
-
memory/4612-214-0x0000000000000000-mapping.dmp
-
memory/4612-192-0x0000000000000000-mapping.dmp
-
memory/4736-222-0x0000000000000000-mapping.dmp
-
memory/4736-199-0x0000000000000000-mapping.dmp
-
memory/4752-212-0x0000000000000000-mapping.dmp
-
memory/4792-157-0x0000000000000000-mapping.dmp
-
memory/4792-220-0x0000000000000000-mapping.dmp
-
memory/4804-198-0x0000000000000000-mapping.dmp
-
memory/4812-263-0x0000000000400000-0x0000000000DCB000-memory.dmpFilesize
9.8MB
-
memory/4812-260-0x0000000000400000-0x0000000000DCB000-memory.dmpFilesize
9.8MB
-
memory/4812-262-0x0000000000400000-0x0000000000DCB000-memory.dmpFilesize
9.8MB
-
memory/4812-261-0x0000000000400000-0x0000000000DCB000-memory.dmpFilesize
9.8MB
-
memory/4812-265-0x0000000000400000-0x0000000000DCB000-memory.dmpFilesize
9.8MB
-
memory/4812-259-0x0000000000400000-0x0000000000DCB000-memory.dmpFilesize
9.8MB
-
memory/4812-256-0x0000000000400000-0x0000000000DCB000-memory.dmpFilesize
9.8MB
-
memory/4812-258-0x0000000000400000-0x0000000000DCB000-memory.dmpFilesize
9.8MB
-
memory/4812-257-0x0000000000400000-0x0000000000DCB000-memory.dmpFilesize
9.8MB
-
memory/4816-210-0x0000000000000000-mapping.dmp
-
memory/4872-200-0x0000000000000000-mapping.dmp
-
memory/4880-167-0x0000000000000000-mapping.dmp
-
memory/4892-240-0x00007FFA54DC0000-0x00007FFA557F6000-memory.dmpFilesize
10.2MB
-
memory/4892-238-0x0000000000000000-mapping.dmp
-
memory/4924-226-0x0000000000000000-mapping.dmp
-
memory/4936-203-0x0000000000000000-mapping.dmp
-
memory/4952-197-0x0000000000000000-mapping.dmp
-
memory/5044-250-0x00007FFA54DC0000-0x00007FFA557F6000-memory.dmpFilesize
10.2MB
-
memory/5072-234-0x0000000000000000-mapping.dmp