Analysis
-
max time kernel
1394s -
max time network
1396s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
14-01-2023 09:02
Static task
static1
Behavioral task
behavioral1
Sample
hitb2.lua
Resource
win10v2004-20220812-en
General
-
Target
hitb2.lua
-
Size
136B
-
MD5
596e8b4c50fa6579495c12756c3b5f14
-
SHA1
de331021e0b2f8fcb792db5cef59472c1964b3bf
-
SHA256
ec80fee089dba5429a5dd568c14af8e3c23d04da0dbd66bb838d6070cc9a7027
-
SHA512
ccfd44c42c77d4248febb5ddca64a35c043564277f4e8280bff6d4425357329842d73e10fc50119dab17d6dfc5559e591132ec65bf7b066aae9d1e6911c5f0b1
Malware Config
Extracted
C:\Program Files\WinRAR\Rar.txt
-n@inclist.txt
Extracted
C:\Program Files\WinRAR\WhatsNew.txt
https
http
http://weirdsgn.com
http://icondesignlab.com
https://rarlab.com/themes/WinRAR_Classic_48x36.theme.rar
Extracted
revengerat
Guest
127.0.0.1:333
127.0.0.1:3334
RV_MUTEX
Extracted
asyncrat
0.5.7B
Default
127.0.0.1:1921
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
true
-
install_file
ded.exe
-
install_folder
%AppData%
Signatures
-
Processes:
ded.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection ded.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" ded.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" ded.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" ded.exe -
Modifies system executable filetype association 2 TTPs 8 IoCs
Processes:
uninstall.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" uninstall.exe -
RevengeRAT
Remote-access trojan with a wide range of capabilities.
-
Suspicious use of NtCreateProcessExOtherParentProcess 3 IoCs
Processes:
taskmgr.exedescription pid process target process PID 704 created 1532 704 taskmgr.exe PentagonRAT Final Relase.exe PID 704 created 1532 704 taskmgr.exe PentagonRAT Final Relase.exe PID 704 created 1532 704 taskmgr.exe PentagonRAT Final Relase.exe -
Async RAT payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/176-320-0x0000010ED9930000-0x0000010ED9F96000-memory.dmp asyncrat behavioral1/memory/3836-328-0x0000000000740000-0x0000000000752000-memory.dmp asyncrat -
RevengeRat Executable 8 IoCs
Processes:
resource yara_rule behavioral1/memory/3016-251-0x0000000000710000-0x0000000000728000-memory.dmp revengerat behavioral1/memory/3016-255-0x0000000000710000-0x0000000000728000-memory.dmp revengerat behavioral1/memory/3016-258-0x0000000000710000-0x0000000000728000-memory.dmp revengerat behavioral1/memory/2944-263-0x0000000000400000-0x0000000000418000-memory.dmp revengerat behavioral1/memory/2084-290-0x0000000000400000-0x000000000040C000-memory.dmp revengerat behavioral1/memory/2084-291-0x00000000004078EE-mapping.dmp revengerat behavioral1/memory/3292-301-0x00000000004078EE-mapping.dmp revengerat behavioral1/memory/2220-311-0x00000000004078EE-mapping.dmp revengerat -
XMRig Miner payload 7 IoCs
Processes:
resource yara_rule behavioral1/memory/672-188-0x0000000000400000-0x0000000000DCB000-memory.dmp xmrig behavioral1/memory/672-190-0x0000000000400000-0x0000000000DCB000-memory.dmp xmrig behavioral1/memory/672-192-0x0000000000400000-0x0000000000DCB000-memory.dmp xmrig behavioral1/memory/672-193-0x0000000000400000-0x0000000000DCB000-memory.dmp xmrig behavioral1/memory/672-194-0x0000000000400000-0x0000000000DCB000-memory.dmp xmrig behavioral1/memory/672-195-0x0000000000400000-0x0000000000DCB000-memory.dmp xmrig behavioral1/memory/672-204-0x0000000000400000-0x0000000000DCB000-memory.dmp xmrig -
Adds policy Run key to start application 2 TTPs 4 IoCs
Processes:
Dllhost.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run Dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\InstallDir\\Dllhost.exe" Dllhost.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run Dllhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Java Update = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\InstallDir\\Dllhost.exe" Dllhost.exe -
Downloads MZ/PE file
-
Executes dropped EXE 37 IoCs
Processes:
winrar-x64-611.exeuninstall.exeChromeRecovery.exeWinRAR.exePentagonRAT Final Relasex.exeTiWorker.exePentagonRAT Final Relase.exempress.exe1507100101000115.exesvchost.exeDllhost.exeStUpdate.exesvchost.exeWinRAR.exeVirus Rat v8.0 Betax.exeVirus Rat v8.0 Beta.exedeeeed.exesvchost.exeWinRAR.exeRevenge-RAT v0.3x.exeRevenge-RAT v0.3.exeGoRC.exeResource Hacker.exedotNET_Reactor.exeClient.exeClient.exeClient.exeGoRC.exeResource Hacker.exededddddddd.exededddddddd.exededddddddd.exeWinRAR.exeAsyncRAT.exeAsyncRAT.exeAsyncClient.exeded.exepid process 528 winrar-x64-611.exe 4700 uninstall.exe 1196 ChromeRecovery.exe 1352 WinRAR.exe 3472 PentagonRAT Final Relasex.exe 672 TiWorker.exe 1532 PentagonRAT Final Relase.exe 4128 mpress.exe 1796 1507100101000115.exe 3088 svchost.exe 2024 Dllhost.exe 3532 StUpdate.exe 4912 svchost.exe 860 WinRAR.exe 3444 Virus Rat v8.0 Betax.exe 4924 Virus Rat v8.0 Beta.exe 4032 deeeed.exe 4728 svchost.exe 3900 WinRAR.exe 5016 Revenge-RAT v0.3x.exe 2908 Revenge-RAT v0.3.exe 3684 GoRC.exe 1520 Resource Hacker.exe 4164 dotNET_Reactor.exe 4552 Client.exe 3500 Client.exe 4348 Client.exe 4500 GoRC.exe 3488 Resource Hacker.exe 1976 dedddddddd.exe 4732 dedddddddd.exe 4344 dedddddddd.exe 2832 WinRAR.exe 176 AsyncRAT.exe 4632 AsyncRAT.exe 3836 AsyncClient.exe 4728 ded.exe -
Modifies Windows Firewall 1 TTPs 3 IoCs
Processes:
netsh.exenetsh.exenetsh.exepid process 4640 netsh.exe 2688 netsh.exe 3772 netsh.exe -
Registers COM server for autorun 1 TTPs 3 IoCs
Processes:
uninstall.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ = "C:\\Program Files\\WinRAR\\rarext.dll" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ThreadingModel = "Apartment" uninstall.exe -
Checks computer location settings 2 TTPs 10 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Revenge-RAT v0.3x.exeAsyncClient.exeVirus Rat v8.0 Betax.exePentagonRAT Final Relasex.exe1507100101000115.exesvchost.exeStUpdate.exedeeeed.exeRevenge-RAT v0.3.exewinrar-x64-611.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation Revenge-RAT v0.3x.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation AsyncClient.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation Virus Rat v8.0 Betax.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation PentagonRAT Final Relasex.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 1507100101000115.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation StUpdate.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation deeeed.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation Revenge-RAT v0.3.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation winrar-x64-611.exe -
Drops startup file 4 IoCs
Processes:
svchost.exeDllhost.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Name.exe svchost.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe Dllhost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe Dllhost.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Name.exe svchost.exe -
Loads dropped DLL 12 IoCs
Processes:
PentagonRAT Final Relase.exeexplorer.exeaspnet_compiler.exeaspnet_compiler.exepid process 3060 1532 PentagonRAT Final Relase.exe 1532 PentagonRAT Final Relase.exe 1532 PentagonRAT Final Relase.exe 1532 PentagonRAT Final Relase.exe 1532 PentagonRAT Final Relase.exe 1532 PentagonRAT Final Relase.exe 1532 PentagonRAT Final Relase.exe 1532 PentagonRAT Final Relase.exe 1620 explorer.exe 2084 aspnet_compiler.exe 3292 aspnet_compiler.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
ded.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features ded.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" ded.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
Dllhost.exesvchost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Adobe = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\InstallDir\\Dllhost.exe" Dllhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Adobe Update = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\InstallDir\\Dllhost.exe" Dllhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Name.exe = "C:\\Users\\Admin\\AppData\\Local\\Name.exe" svchost.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Drops file in System32 directory 17 IoCs
Processes:
svchost.exePentagonRAT Final Relasex.exedescription ioc process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat svchost.exe File created C:\Windows\SysWOW64\MicrosoftWindows.xml PentagonRAT Final Relasex.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jcp svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jtx svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00002.jrs svchost.exe File opened for modification C:\Windows\SysWOW64\TiWorker.exe PentagonRAT Final Relasex.exe File opened for modification C:\Windows\SysWOW64\MicrosoftWindows.xml PentagonRAT Final Relasex.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.log svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSStmp.log svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00001.jrs svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.jfm svchost.exe File created C:\Windows\SysWOW64\TiWorker.exe PentagonRAT Final Relasex.exe File created C:\Windows\SysWOW64\config.json PentagonRAT Final Relasex.exe File opened for modification C:\Windows\SysWOW64\config.json PentagonRAT Final Relasex.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk svchost.exe -
Suspicious use of SetThreadContext 11 IoCs
Processes:
Client.exeClient.exeaspnet_compiler.exeClient.exeaspnet_compiler.exededddddddd.exeaspnet_compiler.exededddddddd.exeaspnet_compiler.exededddddddd.exeaspnet_compiler.exedescription pid process target process PID 4552 set thread context of 3016 4552 Client.exe aspnet_compiler.exe PID 3500 set thread context of 2944 3500 Client.exe aspnet_compiler.exe PID 2944 set thread context of 3444 2944 aspnet_compiler.exe aspnet_compiler.exe PID 4348 set thread context of 3308 4348 Client.exe aspnet_compiler.exe PID 3308 set thread context of 1088 3308 aspnet_compiler.exe aspnet_compiler.exe PID 1976 set thread context of 2084 1976 dedddddddd.exe aspnet_compiler.exe PID 2084 set thread context of 1764 2084 aspnet_compiler.exe aspnet_compiler.exe PID 4732 set thread context of 3292 4732 dedddddddd.exe aspnet_compiler.exe PID 3292 set thread context of 1880 3292 aspnet_compiler.exe aspnet_compiler.exe PID 4344 set thread context of 2220 4344 dedddddddd.exe aspnet_compiler.exe PID 2220 set thread context of 4868 2220 aspnet_compiler.exe aspnet_compiler.exe -
Drops file in Program Files directory 64 IoCs
Processes:
winrar-x64-611.exeelevation_service.exeuninstall.exedescription ioc process File created C:\Program Files\WinRAR\WhatsNew.txt winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\RarExtPackage.msix winrar-x64-611.exe File created C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png winrar-x64-611.exe File opened for modification C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir3040_252070865\ChromeRecovery.exe elevation_service.exe File opened for modification C:\Program Files\WinRAR\Default64.SFX winrar-x64-611.exe File created C:\Program Files\WinRAR\WinCon64.SFX winrar-x64-611.exe File created C:\Program Files\WinRAR\ReadMe.txt winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\ReadMe.txt winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\UnRAR.exe winrar-x64-611.exe File created C:\Program Files\WinRAR\WinRAR.exe winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\Descript.ion winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\WhatsNew.txt winrar-x64-611.exe File created C:\Program Files\WinRAR\RarFiles.lst winrar-x64-611.exe File created C:\Program Files\WinRAR\Uninstall.lst winrar-x64-611.exe File created C:\Program Files\WinRAR\Resources.pri winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\Rar.txt winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\Rar.exe winrar-x64-611.exe File opened for modification C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir3040_252070865\manifest.json elevation_service.exe File opened for modification C:\Program Files\WinRAR\WinCon64.SFX winrar-x64-611.exe File created C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir3040_252070865\ChromeRecoveryCRX.crx elevation_service.exe File created C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir3040_252070865\ChromeRecovery.exe elevation_service.exe File created C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir3040_252070865\_metadata\verified_contents.json elevation_service.exe File opened for modification C:\Program Files\WinRAR winrar-x64-611.exe File created C:\Program Files\WinRAR\RarExtInstaller.exe winrar-x64-611.exe File created C:\Program Files\WinRAR\RarExt.dll winrar-x64-611.exe File created C:\Program Files\WinRAR\Default.SFX winrar-x64-611.exe File created C:\Program Files\WinRAR\License.txt winrar-x64-611.exe File created C:\Program Files\WinRAR\Zip64.SFX winrar-x64-611.exe File created C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir3040_252070865\manifest.json elevation_service.exe File created C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png winrar-x64-611.exe File created C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png winrar-x64-611.exe File opened for modification C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir3040_252070865\_metadata\verified_contents.json elevation_service.exe File created C:\Program Files\WinRAR\Descript.ion winrar-x64-611.exe File created C:\Program Files\WinRAR\Rar.txt winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\RarExtInstaller.exe winrar-x64-611.exe File created C:\Program Files\WinRAR\Default64.SFX winrar-x64-611.exe File created C:\Program Files\WinRAR\__tmp_rar_sfx_access_check_240628906 winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\Zip.SFX winrar-x64-611.exe File created C:\Program Files\WinRAR\rarnew.dat uninstall.exe File opened for modification C:\Program Files\WinRAR\Order.htm winrar-x64-611.exe File created C:\Program Files\WinRAR\Uninstall.exe winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\Default.SFX winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\WinCon.SFX winrar-x64-611.exe File created C:\Program Files\WinRAR\Zip.SFX winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\Zip64.SFX winrar-x64-611.exe File created C:\Program Files\WinRAR\WinRAR.chm winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\License.txt winrar-x64-611.exe File created C:\Program Files\WinRAR\UnRAR.exe winrar-x64-611.exe File created C:\Program Files\WinRAR\7zxa.dll winrar-x64-611.exe File created C:\Program Files\WinRAR\RarExtPackage.msix winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\WinRAR.chm winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png winrar-x64-611.exe File created C:\Program Files\WinRAR\Rar.exe winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\Uninstall.exe winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\RarExt32.dll winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\Resources.pri winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\Uninstall.lst winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\WinRAR.exe winrar-x64-611.exe File opened for modification C:\Program Files\WinRAR\7zxa.dll winrar-x64-611.exe File created C:\Program Files\WinRAR\WinCon.SFX winrar-x64-611.exe File created C:\Program Files\WinRAR\zipnew.dat uninstall.exe File created C:\Program Files\WinRAR\Order.htm winrar-x64-611.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1108 3016 WerFault.exe aspnet_compiler.exe -
Checks SCSI registry key(s) 3 TTPs 15 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exetaskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 10 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
aspnet_compiler.exeaspnet_compiler.exeaspnet_compiler.exeaspnet_compiler.exeaspnet_compiler.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString aspnet_compiler.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString aspnet_compiler.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString aspnet_compiler.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\CENTRALPROCESSOR\0 aspnet_compiler.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\CENTRALPROCESSOR\0 aspnet_compiler.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString aspnet_compiler.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\CENTRALPROCESSOR\0 aspnet_compiler.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\CENTRALPROCESSOR\0 aspnet_compiler.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString aspnet_compiler.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\CENTRALPROCESSOR\0 aspnet_compiler.exe -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 2412 schtasks.exe 1400 schtasks.exe 3240 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 5052 timeout.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Processes:
WinRAR.exeexplorer.exeexplorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\IESettingSync WinRAR.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" WinRAR.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" WinRAR.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch WinRAR.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser explorer.exe -
Modifies registry class 64 IoCs
Processes:
PentagonRAT Final Relase.exeAsyncRAT.exeuninstall.exeRevenge-RAT v0.3.exeVirus Rat v8.0 Beta.exemspaint.exeexplorer.exeexplorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1" PentagonRAT Final Relase.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU AsyncRAT.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR uninstall.exe Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0\0\MRUListEx = 00000000ffffffff Revenge-RAT v0.3.exe Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\3\MRUListEx = ffffffff Virus Rat v8.0 Beta.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings mspaint.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.7z\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.tzst\ = "WinRAR" uninstall.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1" Revenge-RAT v0.3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bz2\ = "WinRAR" uninstall.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" PentagonRAT Final Relase.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1" Virus Rat v8.0 Beta.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r01\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r06 uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.tbz\ = "WinRAR" uninstall.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\HotKey = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1" explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r04 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r09 uninstall.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 PentagonRAT Final Relase.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags explorer.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell AsyncRAT.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} AsyncRAT.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" Revenge-RAT v0.3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r25\ = "WinRAR" uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.xz\ = "WinRAR" uninstall.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3 PentagonRAT Final Relase.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4" PentagonRAT Final Relase.exe Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 0100000000000000ffffffff Revenge-RAT v0.3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ = "WinRAR" uninstall.exe Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 010000000200000000000000ffffffff PentagonRAT Final Relase.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA} uninstall.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} PentagonRAT Final Relase.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" PentagonRAT Final Relase.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1" Revenge-RAT v0.3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV uninstall.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg PentagonRAT Final Relase.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1 explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ AsyncRAT.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA} uninstall.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295" PentagonRAT Final Relase.exe Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff Virus Rat v8.0 Beta.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0 Revenge-RAT v0.3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r14 uninstall.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\Rev = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202020202020202 AsyncRAT.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.r29 uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.zip uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.zip\ = "WinRAR.ZIP" uninstall.exe Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0 = 60003100000000002e569d50100050454e5441477e310000480009000400efbe2e5695502e56a0502e000000cc3002000000070000000000000000000000000000002febdb00500065006e007400610067006f006e00520041005400000018000000 PentagonRAT Final Relase.exe Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202020202 Revenge-RAT v0.3.exe Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 Revenge-RAT v0.3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.r18\ = "WinRAR" uninstall.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bz uninstall.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bz\ = "WinRAR" uninstall.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU PentagonRAT Final Relase.exe Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0 = 50003100000000000c5598a8100041646d696e003c0009000400efbe0c551d9c2e564b502e0000007de101000000010000000000000000000000000000003fc83000410064006d0069006e00000014000000 Revenge-RAT v0.3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell uninstall.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
explorer.exeexplorer.exepid process 1620 explorer.exe 4552 explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
chrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exePentagonRAT Final Relasex.exeDllhost.exepid process 764 chrome.exe 764 chrome.exe 3048 chrome.exe 3048 chrome.exe 2336 chrome.exe 2336 chrome.exe 4596 chrome.exe 4596 chrome.exe 4024 chrome.exe 4024 chrome.exe 1440 chrome.exe 1440 chrome.exe 4888 chrome.exe 4888 chrome.exe 2544 chrome.exe 2544 chrome.exe 976 chrome.exe 976 chrome.exe 5076 chrome.exe 5076 chrome.exe 1440 chrome.exe 1440 chrome.exe 1472 chrome.exe 1472 chrome.exe 1472 chrome.exe 1472 chrome.exe 3472 PentagonRAT Final Relasex.exe 3472 PentagonRAT Final Relasex.exe 3472 PentagonRAT Final Relasex.exe 3472 PentagonRAT Final Relasex.exe 3472 PentagonRAT Final Relasex.exe 3472 PentagonRAT Final Relasex.exe 3472 PentagonRAT Final Relasex.exe 3472 PentagonRAT Final Relasex.exe 2024 Dllhost.exe 2024 Dllhost.exe 2024 Dllhost.exe 2024 Dllhost.exe 2024 Dllhost.exe 2024 Dllhost.exe 2024 Dllhost.exe 2024 Dllhost.exe 2024 Dllhost.exe 2024 Dllhost.exe 2024 Dllhost.exe 2024 Dllhost.exe 2024 Dllhost.exe 2024 Dllhost.exe 2024 Dllhost.exe 2024 Dllhost.exe 2024 Dllhost.exe 2024 Dllhost.exe 2024 Dllhost.exe 2024 Dllhost.exe 2024 Dllhost.exe 2024 Dllhost.exe 2024 Dllhost.exe 2024 Dllhost.exe 2024 Dllhost.exe 2024 Dllhost.exe 2024 Dllhost.exe 2024 Dllhost.exe 2024 Dllhost.exe 2024 Dllhost.exe -
Suspicious behavior: GetForegroundWindowSpam 11 IoCs
Processes:
WinRAR.exePentagonRAT Final Relase.exeWinRAR.exeVirus Rat v8.0 Beta.exesvchost.exeWinRAR.exeRevenge-RAT v0.3.exeexplorer.exeWinRAR.exeAsyncRAT.exetaskmgr.exepid process 1352 WinRAR.exe 1532 PentagonRAT Final Relase.exe 860 WinRAR.exe 4924 Virus Rat v8.0 Beta.exe 4728 svchost.exe 3900 WinRAR.exe 2908 Revenge-RAT v0.3.exe 1620 explorer.exe 2832 WinRAR.exe 4632 AsyncRAT.exe 3004 taskmgr.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs
Processes:
chrome.exepid process 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe -
Suspicious use of AdjustPrivilegeToken 44 IoCs
Processes:
TiWorker.exeDllhost.exetaskmgr.exedeeeed.exesvchost.exetaskmgr.exeClient.exeClient.exeaspnet_compiler.exeClient.exeaspnet_compiler.exetaskmgr.exededddddddd.exeaspnet_compiler.exededddddddd.exeaspnet_compiler.exededddddddd.exeaspnet_compiler.exetaskmgr.exeRevenge-RAT v0.3.exeAsyncClient.exeded.exeAsyncRAT.exepowershell.exetaskmgr.exedescription pid process Token: SeLockMemoryPrivilege 672 TiWorker.exe Token: SeDebugPrivilege 2024 Dllhost.exe Token: SeDebugPrivilege 704 taskmgr.exe Token: SeSystemProfilePrivilege 704 taskmgr.exe Token: SeCreateGlobalPrivilege 704 taskmgr.exe Token: 33 704 taskmgr.exe Token: SeIncBasePriorityPrivilege 704 taskmgr.exe Token: SeDebugPrivilege 4032 deeeed.exe Token: SeDebugPrivilege 4728 svchost.exe Token: SeDebugPrivilege 1448 taskmgr.exe Token: SeSystemProfilePrivilege 1448 taskmgr.exe Token: SeCreateGlobalPrivilege 1448 taskmgr.exe Token: 33 1448 taskmgr.exe Token: SeIncBasePriorityPrivilege 1448 taskmgr.exe Token: SeDebugPrivilege 4552 Client.exe Token: SeDebugPrivilege 3500 Client.exe Token: SeDebugPrivilege 2944 aspnet_compiler.exe Token: SeDebugPrivilege 4348 Client.exe Token: SeDebugPrivilege 3308 aspnet_compiler.exe Token: SeDebugPrivilege 2440 taskmgr.exe Token: SeSystemProfilePrivilege 2440 taskmgr.exe Token: SeCreateGlobalPrivilege 2440 taskmgr.exe Token: 33 2440 taskmgr.exe Token: SeIncBasePriorityPrivilege 2440 taskmgr.exe Token: SeDebugPrivilege 1976 dedddddddd.exe Token: SeDebugPrivilege 2084 aspnet_compiler.exe Token: SeDebugPrivilege 4732 dedddddddd.exe Token: SeDebugPrivilege 3292 aspnet_compiler.exe Token: SeDebugPrivilege 4344 dedddddddd.exe Token: SeDebugPrivilege 2220 aspnet_compiler.exe Token: SeDebugPrivilege 2372 taskmgr.exe Token: SeSystemProfilePrivilege 2372 taskmgr.exe Token: SeCreateGlobalPrivilege 2372 taskmgr.exe Token: 33 2372 taskmgr.exe Token: SeIncBasePriorityPrivilege 2372 taskmgr.exe Token: SeDebugPrivilege 2908 Revenge-RAT v0.3.exe Token: SeDebugPrivilege 3836 AsyncClient.exe Token: SeDebugPrivilege 4728 ded.exe Token: SeDebugPrivilege 4728 ded.exe Token: SeDebugPrivilege 4632 AsyncRAT.exe Token: SeDebugPrivilege 2832 powershell.exe Token: SeDebugPrivilege 3004 taskmgr.exe Token: SeSystemProfilePrivilege 3004 taskmgr.exe Token: SeCreateGlobalPrivilege 3004 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
chrome.exeWinRAR.exeDllhost.exepid process 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 1352 WinRAR.exe 1352 WinRAR.exe 1352 WinRAR.exe 1352 WinRAR.exe 1352 WinRAR.exe 1352 WinRAR.exe 1352 WinRAR.exe 2024 Dllhost.exe 2024 Dllhost.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
chrome.exetaskmgr.exepid process 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 3048 chrome.exe 704 taskmgr.exe 704 taskmgr.exe 704 taskmgr.exe 704 taskmgr.exe 704 taskmgr.exe 704 taskmgr.exe 704 taskmgr.exe 704 taskmgr.exe 704 taskmgr.exe 704 taskmgr.exe 704 taskmgr.exe 704 taskmgr.exe 704 taskmgr.exe 704 taskmgr.exe 704 taskmgr.exe 704 taskmgr.exe 704 taskmgr.exe 704 taskmgr.exe 704 taskmgr.exe 704 taskmgr.exe 704 taskmgr.exe 704 taskmgr.exe 704 taskmgr.exe 704 taskmgr.exe 704 taskmgr.exe 704 taskmgr.exe 704 taskmgr.exe 704 taskmgr.exe 704 taskmgr.exe 704 taskmgr.exe 704 taskmgr.exe 704 taskmgr.exe 704 taskmgr.exe 704 taskmgr.exe 704 taskmgr.exe 704 taskmgr.exe 704 taskmgr.exe 704 taskmgr.exe 704 taskmgr.exe 704 taskmgr.exe -
Suspicious use of SetWindowsHookEx 31 IoCs
Processes:
OpenWith.exewinrar-x64-611.exeWinRAR.exePentagonRAT Final Relasex.exePentagonRAT Final Relase.exeVirus Rat v8.0 Betax.exeVirus Rat v8.0 Beta.exedeeeed.exesvchost.exeRevenge-RAT v0.3x.exeRevenge-RAT v0.3.exeilasm.exeResource Hacker.exeexplorer.exeilasm.exeResource Hacker.exeexplorer.exeAsyncRAT.exemspaint.exeOpenWith.exepid process 1420 OpenWith.exe 528 winrar-x64-611.exe 528 winrar-x64-611.exe 1352 WinRAR.exe 1352 WinRAR.exe 3472 PentagonRAT Final Relasex.exe 1532 PentagonRAT Final Relase.exe 3444 Virus Rat v8.0 Betax.exe 4924 Virus Rat v8.0 Beta.exe 4924 Virus Rat v8.0 Beta.exe 4032 deeeed.exe 4728 svchost.exe 5016 Revenge-RAT v0.3x.exe 2908 Revenge-RAT v0.3.exe 4956 ilasm.exe 1520 Resource Hacker.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 1620 explorer.exe 2908 Revenge-RAT v0.3.exe 2908 Revenge-RAT v0.3.exe 1720 ilasm.exe 3488 Resource Hacker.exe 4552 explorer.exe 4552 explorer.exe 4632 AsyncRAT.exe 4392 mspaint.exe 3620 OpenWith.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 3048 wrote to memory of 4672 3048 chrome.exe chrome.exe PID 3048 wrote to memory of 4672 3048 chrome.exe chrome.exe PID 3048 wrote to memory of 4592 3048 chrome.exe chrome.exe PID 3048 wrote to memory of 4592 3048 chrome.exe chrome.exe PID 3048 wrote to memory of 4592 3048 chrome.exe chrome.exe PID 3048 wrote to memory of 4592 3048 chrome.exe chrome.exe PID 3048 wrote to memory of 4592 3048 chrome.exe chrome.exe PID 3048 wrote to memory of 4592 3048 chrome.exe chrome.exe PID 3048 wrote to memory of 4592 3048 chrome.exe chrome.exe PID 3048 wrote to memory of 4592 3048 chrome.exe chrome.exe PID 3048 wrote to memory of 4592 3048 chrome.exe chrome.exe PID 3048 wrote to memory of 4592 3048 chrome.exe chrome.exe PID 3048 wrote to memory of 4592 3048 chrome.exe chrome.exe PID 3048 wrote to memory of 4592 3048 chrome.exe chrome.exe PID 3048 wrote to memory of 4592 3048 chrome.exe chrome.exe PID 3048 wrote to memory of 4592 3048 chrome.exe chrome.exe PID 3048 wrote to memory of 4592 3048 chrome.exe chrome.exe PID 3048 wrote to memory of 4592 3048 chrome.exe chrome.exe PID 3048 wrote to memory of 4592 3048 chrome.exe chrome.exe PID 3048 wrote to memory of 4592 3048 chrome.exe chrome.exe PID 3048 wrote to memory of 4592 3048 chrome.exe chrome.exe PID 3048 wrote to memory of 4592 3048 chrome.exe chrome.exe PID 3048 wrote to memory of 4592 3048 chrome.exe chrome.exe PID 3048 wrote to memory of 4592 3048 chrome.exe chrome.exe PID 3048 wrote to memory of 4592 3048 chrome.exe chrome.exe PID 3048 wrote to memory of 4592 3048 chrome.exe chrome.exe PID 3048 wrote to memory of 4592 3048 chrome.exe chrome.exe PID 3048 wrote to memory of 4592 3048 chrome.exe chrome.exe PID 3048 wrote to memory of 4592 3048 chrome.exe chrome.exe PID 3048 wrote to memory of 4592 3048 chrome.exe chrome.exe PID 3048 wrote to memory of 4592 3048 chrome.exe chrome.exe PID 3048 wrote to memory of 4592 3048 chrome.exe chrome.exe PID 3048 wrote to memory of 4592 3048 chrome.exe chrome.exe PID 3048 wrote to memory of 4592 3048 chrome.exe chrome.exe PID 3048 wrote to memory of 4592 3048 chrome.exe chrome.exe PID 3048 wrote to memory of 4592 3048 chrome.exe chrome.exe PID 3048 wrote to memory of 4592 3048 chrome.exe chrome.exe PID 3048 wrote to memory of 4592 3048 chrome.exe chrome.exe PID 3048 wrote to memory of 4592 3048 chrome.exe chrome.exe PID 3048 wrote to memory of 4592 3048 chrome.exe chrome.exe PID 3048 wrote to memory of 4592 3048 chrome.exe chrome.exe PID 3048 wrote to memory of 4592 3048 chrome.exe chrome.exe PID 3048 wrote to memory of 764 3048 chrome.exe chrome.exe PID 3048 wrote to memory of 764 3048 chrome.exe chrome.exe PID 3048 wrote to memory of 4080 3048 chrome.exe chrome.exe PID 3048 wrote to memory of 4080 3048 chrome.exe chrome.exe PID 3048 wrote to memory of 4080 3048 chrome.exe chrome.exe PID 3048 wrote to memory of 4080 3048 chrome.exe chrome.exe PID 3048 wrote to memory of 4080 3048 chrome.exe chrome.exe PID 3048 wrote to memory of 4080 3048 chrome.exe chrome.exe PID 3048 wrote to memory of 4080 3048 chrome.exe chrome.exe PID 3048 wrote to memory of 4080 3048 chrome.exe chrome.exe PID 3048 wrote to memory of 4080 3048 chrome.exe chrome.exe PID 3048 wrote to memory of 4080 3048 chrome.exe chrome.exe PID 3048 wrote to memory of 4080 3048 chrome.exe chrome.exe PID 3048 wrote to memory of 4080 3048 chrome.exe chrome.exe PID 3048 wrote to memory of 4080 3048 chrome.exe chrome.exe PID 3048 wrote to memory of 4080 3048 chrome.exe chrome.exe PID 3048 wrote to memory of 4080 3048 chrome.exe chrome.exe PID 3048 wrote to memory of 4080 3048 chrome.exe chrome.exe PID 3048 wrote to memory of 4080 3048 chrome.exe chrome.exe PID 3048 wrote to memory of 4080 3048 chrome.exe chrome.exe PID 3048 wrote to memory of 4080 3048 chrome.exe chrome.exe PID 3048 wrote to memory of 4080 3048 chrome.exe chrome.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\hitb2.lua1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9f3874f50,0x7ff9f3874f60,0x7ff9f3874f702⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1640 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2028 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2280 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2844 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3048 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3508 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4352 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4624 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4652 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4640 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4432 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4760 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4616 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3292 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4496 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3516 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3668 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6012 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4876 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5580 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4968 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4656 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5112 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6060 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5232 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6288 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6148 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6368 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6356 /prefetch:82⤵
-
C:\Users\Admin\Downloads\winrar-x64-611.exe"C:\Users\Admin\Downloads\winrar-x64-611.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\WinRAR\uninstall.exe"C:\Program Files\WinRAR\uninstall.exe" /setup3⤵
- Modifies system executable filetype association
- Executes dropped EXE
- Registers COM server for autorun
- Drops file in Program Files directory
- Modifies registry class
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3164 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3152 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3064 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5816 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3188 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3216 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5112 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6740 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5104 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5452 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3176 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6492 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3244 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3228 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5892 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5640 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3468 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6724 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5328 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3056 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4628 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\PentagonRAT.zip"2⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5256 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4356 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4592 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2116 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1028 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4920 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6220 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3684 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5660 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4456 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2528 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1272 /prefetch:82⤵
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\Virus Rat v8.0 Beta.zip"2⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3268 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2116 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6720 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4476 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5184 /prefetch:82⤵
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\Revenge-RAT v0.3.zip"2⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5184 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5000 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3680 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5128 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=812 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=85 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4580 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=86 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=87 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=88 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=896 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=89 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2352 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4428 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=90 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6184 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=92 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5644 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4792 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=96 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4512 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2956 /prefetch:82⤵
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\COMPILED.zip"2⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe"1⤵
- Drops file in Program Files directory
-
C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir3040_252070865\ChromeRecovery.exe"C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir3040_252070865\ChromeRecovery.exe" --appguid={8A69D345-D564-463c-AFF1-A69D9E530F96} --browser-version=89.0.4389.114 --sessionid={082c4652-12cf-4d00-8e96-9e514ff1dd12} --system2⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\PentagonRAT\PentagonRAT Final Relasex.exe"C:\Users\Admin\Desktop\PentagonRAT\PentagonRAT Final Relasex.exe"1⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /End /TN "Microsoft\Windows\MUI\WindowsUpdate" & schtasks /End /TN "WindowsUpdate" & exit2⤵
-
C:\Windows\system32\schtasks.exeschtasks /End /TN "Microsoft\Windows\MUI\WindowsUpdate"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /End /TN "WindowsUpdate"3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /Delete /TN "WindowsUpdate" /F & exit2⤵
-
C:\Windows\system32\schtasks.exeschtasks /Delete /TN "WindowsUpdate" /F3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="System" dir=out action=allow program="%windir%\SysWOW64\TiWorker.exe" enable=yes & exit2⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="System" dir=out action=allow program="C:\Windows\SysWOW64\TiWorker.exe" enable=yes3⤵
- Modifies Windows Firewall
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="System" dir=in action=allow program="%windir%\SysWOW64\TiWorker.exe" enable=yes & exit2⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="System" dir=in action=allow program="C:\Windows\SysWOW64\TiWorker.exe" enable=yes3⤵
- Modifies Windows Firewall
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /Create /XML "%windir%\SysWOW64\MicrosoftWindows.xml" /TN "Microsoft\Windows\MUI\WindowsUpdate" /F & exit2⤵
-
C:\Windows\system32\schtasks.exeschtasks /Create /XML "C:\Windows\SysWOW64\MicrosoftWindows.xml" /TN "Microsoft\Windows\MUI\WindowsUpdate" /F3⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /Change /TN "Microsoft\Windows\MUI\WindowsUpdate" /TR "%windir%\SysWOW64\TiWorker.exe" & schtasks /Run /TN "Microsoft\Windows\MUI\WindowsUpdate" & exit2⤵
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "Microsoft\Windows\MUI\WindowsUpdate" /TR "C:\Windows\SysWOW64\TiWorker.exe"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /Run /TN "Microsoft\Windows\MUI\WindowsUpdate"3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c certutil –addstore –f root MicrosoftWindows.crt & exit2⤵
-
C:\Windows\system32\certutil.execertutil –addstore –f root MicrosoftWindows.crt3⤵
-
C:\Users\Admin\Desktop\PentagonRAT\PentagonRAT Final Relase.exe"C:\Users\Admin\Desktop\PentagonRAT\PentagonRAT Final Relase.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.execmd.exe /C UPX\mpress.exe -s "C:\Users\Admin\Downloads\1507100101000115.exe"3⤵
-
C:\Users\Admin\Desktop\PentagonRAT\UPX\mpress.exeUPX\mpress.exe -s "C:\Users\Admin\Downloads\1507100101000115.exe"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\TiWorker.exeC:\Windows\SysWOW64\TiWorker.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Downloads\1507100101000115.exe"C:\Users\Admin\Downloads\1507100101000115.exe"1⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\InstallDir\Dllhost.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\InstallDir\Dllhost.exe"3⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SYSTEM32\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\InstallDir\Dllhost.exe" "Dllhost.exe" ENABLE4⤵
- Modifies Windows Firewall
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /sc minute /mo 1 /tn StUpdate /tr C:\Users\Admin\AppData\Local\Temp/StUpdate.exe4⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\StUpdate.exeC:\Users\Admin\AppData\Local\Temp/StUpdate.exe1⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"2⤵
- Executes dropped EXE
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\Desktop\Virus Rat v8.0 Beta\Virus Rat v8.0 Betax.exe"C:\Users\Admin\Desktop\Virus Rat v8.0 Beta\Virus Rat v8.0 Betax.exe"1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Desktop\Virus Rat v8.0 Beta\Virus Rat v8.0 Beta.exe"C:\Users\Admin\Desktop\Virus Rat v8.0 Beta\Virus Rat v8.0 Beta.exe"2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\deeeed.exe"C:\Users\Admin\Downloads\deeeed.exe"1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Desktop\Revenge-RAT v0.3\Revenge-RAT v0.3x.exe"C:\Users\Admin\Desktop\Revenge-RAT v0.3\Revenge-RAT v0.3x.exe"1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Desktop\Revenge-RAT v0.3\Revenge-RAT v0.3.exe"C:\Users\Admin\Desktop\Revenge-RAT v0.3\Revenge-RAT v0.3.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe" /QUIET "C:\Users\Admin\AppData\Local\Temp\RV.IL" /output:"C:\Users\Admin\Downloads\Client.exe" /resource:Extensions\Admin.res3⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCFFC.tmp" "Extensions\Admin.res"4⤵
-
C:\Users\Admin\Desktop\Revenge-RAT v0.3\Extensions\GoRC.exeExtensions\GoRC /r Extensions\Information.rc3⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\Revenge-RAT v0.3\Extensions\Resource Hacker.exe"Extensions\Resource Hacker" -addoverwrite C:\Users\Admin\Downloads\Client.exe,C:\Users\Admin\Downloads\Client.exe,C:\Users\Admin\Desktop\Revenge-RAT v0.3\Extensions\Information.res,VERSIONINFO,1,3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Desktop\Revenge-RAT v0.3\Extensions\dotNET_Reactor.exe"C:\Users\Admin\Desktop\Revenge-RAT v0.3\Extensions\dotNET_Reactor.exe" dotNET_Reactor.exe -file "C:\Users\Admin\Downloads\Client.exe" -antitamp[1] -suppressildasm[1] -obfuscate_public_types[1] -stringencryption[1] -obfuscation[1] -targetfile "C:\Users\Admin\Downloads\Client.exe"3⤵
- Executes dropped EXE
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe" /select,C:\Users\Admin\Downloads\Client.exe3⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe" /QUIET "C:\Users\Admin\AppData\Local\Temp\RV.IL" /output:"C:\Users\Admin\Downloads\dedddddddd.exe"3⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Desktop\Revenge-RAT v0.3\Extensions\GoRC.exeExtensions\GoRC /r Extensions\Information.rc3⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\Revenge-RAT v0.3\Extensions\Resource Hacker.exe"Extensions\Resource Hacker" -addoverwrite C:\Users\Admin\Downloads\dedddddddd.exe,C:\Users\Admin\Downloads\dedddddddd.exe,C:\Users\Admin\Desktop\Revenge-RAT v0.3\Extensions\Information.res,VERSIONINFO,1,3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe" /select,C:\Users\Admin\Downloads\dedddddddd.exe3⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\Client.exe"C:\Users\Admin\Downloads\Client.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3016 -s 2364⤵
- Program crash
-
C:\Users\Admin\Downloads\Client.exe"C:\Users\Admin\Downloads\Client.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe"3⤵
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Client.exe"C:\Users\Admin\AppData\Roaming\Client.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe"5⤵
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe"6⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3016 -ip 30161⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\dedddddddd.exe"C:\Users\Admin\Downloads\dedddddddd.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe"3⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe"4⤵
-
C:\Users\Admin\Downloads\dedddddddd.exe"C:\Users\Admin\Downloads\dedddddddd.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe"5⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe"6⤵
-
C:\Users\Admin\Downloads\dedddddddd.exe"C:\Users\Admin\Downloads\dedddddddd.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe"7⤵
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe"8⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Desktop\AsyncRAT v0.5.7B\AsyncRAT.exe"C:\Users\Admin\Desktop\AsyncRAT v0.5.7B\AsyncRAT.exe"1⤵
- Executes dropped EXE
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Users\Admin\Desktop\AsyncRAT v0.5.7B\AsyncRAT.exe"C:\Users\Admin\Desktop\AsyncRAT v0.5.7B\AsyncRAT.exe"1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Users\Admin\Downloads\AsyncClient.exe"C:\Users\Admin\Downloads\AsyncClient.exe"1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "ded" /tr '"C:\Users\Admin\AppData\Roaming\ded.exe"' & exit2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "ded" /tr '"C:\Users\Admin\AppData\Roaming\ded.exe"'3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp10EB.tmp.bat""2⤵
-
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\ded.exe"C:\Users\Admin\AppData\Roaming\ded.exe"3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\AsyncRAT v0.5.7B\ClientsFolder\33CA0180DF26E595063F\RemoteDesktop\IMG_01-14-2023 10;24;44.jpeg" /ForceBootstrapPaint3D1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc1⤵
- Drops file in System32 directory
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\WinRAR\Uninstall.exeFilesize
412KB
MD592667e28583a9489e3cf4f1a7fd6636e
SHA1faa09990ba4daae970038ed44e3841151d6e7f28
SHA2569147293554ad43920bcf763ffd6e1183c36b9f8156dc220548426a187a5f2959
SHA51263555a15f153df59b2ca2ab56cd20d71420eb5c9977bcf774723d8484157172b027f71fb2f7a4692aecc6e471f50beec2e0f7a43e57449714caede1e9684c0b8
-
C:\Program Files\WinRAR\WinRAR.exeFilesize
2.3MB
MD50b114fc0f4b6d49f57b3b01dd9ea6a8c
SHA123e1480c3ff3a54e712d759e9325d362bf52fabd
SHA256f0f312fe14599d7379aa247c1d0cc6100db45bfe7f277113134a8157950bcacd
SHA512e31c3a3da5e72a9d72e245d6e5dcc7c92e4cfcbb6bdbb61061e0586e29f77e8b42a81a0bba99ce45e148a2423907878fb858c40cc1008ef9d90fb8e4e2fcd573
-
C:\Users\Admin\Desktop\AddLimit.csvFilesize
796KB
MD5e71b687a319f5689cb1727a0fda835df
SHA1334df9bf24e9b88d5c852c9099027b883e51e192
SHA256064403802c27d0ffe184c43dd880c02d97c9aac15495d46f4a582e01874431ce
SHA5120f8dd7920621f5cbcd7d3d2552da531f841aebd9cbe76bf1d302639a8e001c443cc914536ad00c74a84322914f46c3a6b3a0c7ccb08e3074159f2c694fe934f0
-
C:\Users\Admin\Desktop\ApproveSync.vswFilesize
619KB
MD52b6d846535ce76b8f211d92b70d40e52
SHA1af70bff41d56ffca5de20ff6b619110f27919694
SHA25615535750feac5f77abcf16faa1d8a0d309dd5909372e3efc61cf62c46f51e857
SHA512b95f858145d75b40615e8addb461f10eb01ba916c6df6adb01a449880916615dd4cb88561523f5b73e0751ac3eefdc635f5ed36878cce9769d47602e84fef8a4
-
C:\Users\Admin\Desktop\ClearSync.DVR-MSFilesize
644KB
MD528609bb9b8b41dd880a89bb9e138e709
SHA1cdc1fe3b486761e24945b4c8e8fe22e15f256b64
SHA2569bd6b81a5a1852977df169962b17e689bc68ab3ceb9cec88db42295ebef44541
SHA5124b166646a702b16df6ce2d682957cd23e5d592672478117ca4d74f530b8f50b32e5713714aa0e4c256540542aa086bb4f0b91516a193a946947337070e68e02b
-
C:\Users\Admin\Desktop\CopyCheckpoint.jsFilesize
771KB
MD5a479d4d714830930e1d7187cd717a8fd
SHA11a2ac4695b23a0c1b8684b13111b50e912bcb629
SHA256f09fd5aecb92002b24e98beb0869aee40c264a18d99e23cccb8c59bda2bcb741
SHA512dd9e70a7d4c5558999840634c3f94a8246639b17f2bf78fb8ff3be02c78d5507fcfc2fe20d5e223db9e807e858586c9c5c34e166596747ed6ef82b8aa33d656d
-
C:\Users\Admin\Desktop\EditCompare.mppFilesize
973KB
MD559ec7692b978434ce2e2b3dd8e0fcf63
SHA13cd8a7f7c0db3bccdaa19b97a8520a9acae531dc
SHA2568f93884138e3522c8860213495ed2ddf627926c5d62550dd8de0446dc0b5da97
SHA5121cb38f37deecce3ddffacacec316e88b5f403f97d83e37d1a16da40b2ac1f7a94eefaba455e00bb544e58cbe642e4aebe417d5534a1bdd9ae4bc13e03f429e4a
-
C:\Users\Admin\Desktop\EnterTrace.DVR-MSFilesize
897KB
MD5020fa54a436e7a559c47357e99c128bb
SHA12aab4c7b617470077f3e7015fba587345b6e6429
SHA256e1ee017622a1dcf878a92eb9fbdf120f932d8035ed978da4ab85ab65fc1e8078
SHA5122125eb97940ce0e3db9b062daa9bf87fdc78291253750fa7c1de5d753fd01f25e5aa3ebc16ebc4a0d1d328421ba5001769c87170a13b253c8560c2723793ee99
-
C:\Users\Admin\Desktop\ExitResize.wmaFilesize
518KB
MD5d18470946208452ceaf90873c7d6a529
SHA1bf4980b336661b295bf60d800b2dda76a248b2cc
SHA256717356c8d1f32d2b9fa92d015a8dc1d60eadfa680becbccd341d9d7448a85a13
SHA512d043c97ea7827968d54dc7e060811b928b9867afd5fdc308c824da5515b30cc6ab57b363b4631950366297e1a6ba37596a03e50a9e28b487bcfeda8a32865141
-
C:\Users\Admin\Desktop\ExitWrite.zipFilesize
391KB
MD5db896322c1cffa015e70ec4b102c2624
SHA16b50ad513ad0e5d6f864333f071ac5a5cf530cdc
SHA25696e72b70d248fad85cb14f281587fb78a77f088b32e03ec6e55201e1ed21f670
SHA51233f3007e33f9100185f907e007212078d28c9f247d722050c150b4012a099754813aa881164d81ec63a4a43fc675b71250fba5171599e497e34ce2ae894a8180
-
C:\Users\Admin\Desktop\ExpandUndo.dwfxFilesize
417KB
MD515e2c6eb8e3ca8ad7941c295651f9069
SHA193c78e9790c3e3c717f6d07ce2ecfe38e1bb19c8
SHA2566de7abf2a11cf31836c315d623d871fad43b5f8dad99b3ff4b0b6e2dc7fe664b
SHA5124f5f8d9a40782e43b953abe50c1de18162c97119ebe8bfb847ba0ce069ab386c0a1ea10eed6828d99b9121ec42d88d8b512d7a0dc2c7a5831c1f30b5a5abcf8e
-
C:\Users\Admin\Desktop\InvokeRegister.txtFilesize
948KB
MD537ea1029625fabaa347ed0fbe2681bd0
SHA1895463e782e2860813f2e4fab5df6fd1a328c9d4
SHA256eb4684ac2ca2e0c57d7a9625e54887bcf916771ad283f7e0c0bf2caf9af1b101
SHA512e66e30ded42fcf2c412b3e5d183eb69f22df39f1971d3cac28663bf01274f2192b2075ddc05f8b6f81d0cbd2585325944ad064c6f1373dc59a3e67fabb50c9e0
-
C:\Users\Admin\Desktop\InvokeStep.wmfFilesize
594KB
MD5822ebf2e98e82b50d7ccdee045e198e4
SHA1769a32cff271c1a8655571ab42adca77b8fe94bd
SHA2562c27d824995852263fefcd1139b16bbbd2797b1a4545d701436a196f18e4946c
SHA512ad2380cd55394487b08fcdefaacad8cd7f1f8dd48cc3b72c018571f13bd9d350f18aae288035063633e002492a67ee6e58172dc1215d2888454347e05b64f5ca
-
C:\Users\Admin\Desktop\JoinRevoke.bmpFilesize
922KB
MD5390213c81022216736d60b3dba52a3e5
SHA103ffa52b867caa1a491d5a2f153b5a3e1e1878c0
SHA2562127190aad23445241f26a611afb02fbb9177df7459efa45ca144ad1e6098e85
SHA5122364e17c8640986c74af5d7eb3fce0c648d07ca15f3d0bab4569a4d3a47758b581d6b021eb78065b1de0a9995495c6eb838034550b8adb3cd8d267ab3649b853
-
C:\Users\Admin\Desktop\PingRemove.wplFilesize
695KB
MD55d4097abcdda504502f7c1ba639a1a35
SHA1d3b779bbb0ffe2c28c28be0d27328f0137f0bff8
SHA256e949d78d5cbfac35e327508141641d395c45bc55dda853aaacf32907c3b2a9c8
SHA51244bea2fc2bf2950932a7c1831aaf9be3a4dedb82b24b4623327286bb2dfdfccbf3688ddeb8a315e674c713df6717d0672d42bf520258ccefa8b6e6513e9fd5c7
-
C:\Users\Admin\Desktop\RedoSet.pdfFilesize
568KB
MD57f5e42d408bb12d30382036d49edddf6
SHA13e8cf811d2ce2aa50a8def961613178e19952043
SHA25663349ee9914eb9c0d31339b3a4a6db1f270d118d46a59dcee63d14595aa86bbe
SHA51221b713efa99ea0035b4b2ed399fb974dc2923623930b1e5291d244330dc21a119b92d046a2cee6acca5e01b74bc36b28c8971662d43febe62d14957f0ed954a0
-
C:\Users\Admin\Desktop\RegisterBlock.kixFilesize
821KB
MD5b8cb669b185c33ac1b211a12589c5774
SHA1928939bcab0a518b4e97d51372de7d4af8a94ea2
SHA256216155af2367a2ec483300ce69ef24d3c9d8ea8e6588c20ae7b118a97cfec0bd
SHA51227bc9123fda75116b6cd6ad9ba372fb7d753f143c3d4de120d0f0754d831d084237bf8c0dc953e0e62d3ba1c5c3b371eb01b78f47ad7a9dc68647c01d5bc730e
-
C:\Users\Admin\Desktop\RegisterInstall.mhtmlFilesize
493KB
MD559bf387286b91a1d8825ea76205e72ca
SHA1e2d94262401f38c20a478cbc1c40e8e4483cff1a
SHA256790b7bd5e0afacdee646844eb1b49cee916bb146c6b41c7b51e8e4a63210562c
SHA512b100986c422f7dd57672aab46cc57f6a0c62a8b20748f87e9327dfbd8da64021de49c89fc530bb04f6fb881919013feb910715b1a0ad10e211d0dc57d168dc47
-
C:\Users\Admin\Desktop\RegisterUndo.M2VFilesize
543KB
MD54cdd68fa1dc395f05377d371070957e3
SHA10ab1af082d126d2c625b2dcf5423e83fc022e404
SHA25694cb958ecdc2af7bcb59b63b89253bc92b52ec758c04e683015a59da79349e3b
SHA51268c27fa47b5069edcd743e10212ef607d3b53673d62197980b95f91bf38bad58e979b5168918dde57b10f854bb14633e4c4224ba6adc99b1d10c053ccc71e5cf
-
C:\Users\Admin\Desktop\ResolveOptimize.ttfFilesize
847KB
MD57b9b4085882914ce30c654db0edcc014
SHA1290a9e6df890ab9791fbd4bf06b63db0b6e014ff
SHA256310360984f2513beade9d9dce601f9eec8033ff574f992ae9abc9ab6ac1f4d2e
SHA5122a8a99180ac3ec6b1842c40414960496a805a2f9d0bc852a954894ccaafc4200534bb3e42630f85244bc6c0ee170db11aad8b6c29fa40890e3b56eff3bc45eab
-
C:\Users\Admin\Desktop\ResolveRegister.dwfxFilesize
341KB
MD51ae393e4316753488a93fa20d9e3ff73
SHA1b6b3165c92db3c6a6610b62bbd280df2b47351b5
SHA256382616e6ada06119ed59521b3fc194d2467a1fbdfa7ebe2b9c0d1f0a236daa07
SHA512147734d3b11f76f2a61ddcd14f6874088dcc9b726b3faa0ece4e9848158b1afe537ca298a472ab8d812f2cfa0144beaf605e41d4faafe19a9073cbf653622641
-
C:\Users\Admin\Desktop\ShowSync.jtxFilesize
872KB
MD5a78a857c0d6e050501f2a5e68f0479eb
SHA117111014b93c30a4692ad8876fc21f029c664682
SHA256b0737d934a68c708859546ddfb76f4a4c3334084d367938c5bf6a5aec587323c
SHA51210d0adceb8c57482dbca64eab838911a2159a917608f824ff3530cf8f212600378a65bc21f34117e14badd9a9cb95da0be184b7c6e146cb22349ec5438a1b755
-
C:\Users\Admin\Desktop\SkipUnpublish.aiffFilesize
366KB
MD5b294c0b81d93d70f6f35be055a88d7ea
SHA1e4c51aeb324d0e5a33634be734379ad71548978a
SHA256de37d4abe692d61f9c815d6ec0c35d4d3904ff42a00d4102125473221d4e65b4
SHA5129ea08488c0ad98f0fa9dcabee400aab5b20291ba7844c501088c511fffdbf863effe572ab81158160dc22eab428717e1ed4c3709d3978db7f5b7cb1fb3a0276b
-
C:\Users\Admin\Desktop\StepJoin.crwFilesize
1.3MB
MD5d35f367d1be26728c3158f4da8f96671
SHA14ecd238246da475d7881e897ab2c90a5d04de5cd
SHA256debc4738869fb685627018e177729ac93a8fd1e638ce0942299541a9e3e736ad
SHA5125715d0c8396538e5ad65b1244eaa0eef6b609dc187698a3614a832dce37c0238b773d885b2e930ef6fde5adfc115040a75bd90fd26328375144b5cd0d324eddb
-
C:\Users\Admin\Desktop\TestPush.nfoFilesize
442KB
MD5b4a5a944a0e3499c57be15e481588669
SHA1ee7e18c923dfb9c89b98f3cea113f2314792f7a5
SHA256d1e40bc5a9a496a5b729298451e71d8d384c48ac17cec5b7c3f7679216abf4cd
SHA512cac9f5232a306311bce760cc66571279ffdc87b718133fc74fbd834bce29fa30aca737be789854709d5e9ea3d951a0c42e88241ff217fe4ca4d83b11b5b8a300
-
C:\Users\Admin\Desktop\UnblockFind.mhtmlFilesize
720KB
MD52231675eefc10821710e13d0c2915cc8
SHA1c24693c1eaa391e4268653dd289f84dddca5a154
SHA256e174a1890431c5853850bb86fee87dc1d0d1f80c167d80ad4bc47cd318be7323
SHA512d09f0ec6cff2b18c3647d30f43446f55bf1caf4556419fbcbbd2640ccf98b44acf7b619e568f7585e02bb1a1d4a6a5c2f9e9c8affa89461e8bb48127c2e21752
-
C:\Users\Admin\Desktop\UnpublishPublish.dllFilesize
467KB
MD54d057c0c56dc4a527e2224bd9ab69691
SHA1f09ed677a9fe0460a60f6a89c2db01aa13a9119c
SHA256ef217a9401c14c174484d2a271baba16736c1e6b159471c4d4f0171ecd69a926
SHA51202490341175278c2a7906e789e233080172ba09074299ccefb080a9661610334c9452dfcb1aa46ebaf3d943053d4adb3fecd5e05f40a378024f353859f43d857
-
C:\Users\Admin\Desktop\UpdatePop.ppsFilesize
745KB
MD537ac8643d0d2ba85f5a65b81d9c286fc
SHA13bdba97d77d40498b3bd0ecb23592e7a24e5170e
SHA256dfd225605739e5e1fa60c793a05daad0f15bed812d67623f03a4365772c197d0
SHA5128388e4320b8af446ca5fd83fb336c0a93d3f3c81a8b43567894812776d39265412d71ce25b8e52986d0da663cd1ce9e510fc7494e933898ac373fdcf5b6f2f67
-
C:\Users\Admin\Desktop\WriteWatch.docxFilesize
670KB
MD54ae4ac1e75acf6f6b0442a92a55578e2
SHA115c0cb32292fcac66fc779d556eea2f78461f67e
SHA25698e3a4f650b5a11262958040204bda7507ba66851c1dc6cc80bb398df9956965
SHA512e7c2dfe4dbfdc6749a31f2d7b17c63e27df3ba833251099014a62dc084509a787e69757e282b589d631f72baadac2c18054517a05898040a694141cdf010f017
-
C:\Users\Admin\Downloads\winrar-x64-611.exeFilesize
3.3MB
MD58a6217d94e1bcbabdd1dfcdcaa83d1b3
SHA199b81b01f277540f38ea3e96c9c6dc2a57dfeb92
SHA2563023edb4fc3f7c2ebad157b182b62848423f6fa20d180b0df689cbb503a49684
SHA512a8f6f6fdfa9d754a577b7dd885a938fb9149f113baa2afb6352df622cdb73242175a06cd567e971fd3de93a126ba05b78178d5d512720d8fdb87ececce2cbf54
-
C:\Users\Admin\Downloads\winrar-x64-611.exeFilesize
3.3MB
MD58a6217d94e1bcbabdd1dfcdcaa83d1b3
SHA199b81b01f277540f38ea3e96c9c6dc2a57dfeb92
SHA2563023edb4fc3f7c2ebad157b182b62848423f6fa20d180b0df689cbb503a49684
SHA512a8f6f6fdfa9d754a577b7dd885a938fb9149f113baa2afb6352df622cdb73242175a06cd567e971fd3de93a126ba05b78178d5d512720d8fdb87ececce2cbf54
-
\??\pipe\crashpad_3048_JVMTBWQKQXILAOCYMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/176-320-0x0000010ED9930000-0x0000010ED9F96000-memory.dmpFilesize
6.4MB
-
memory/176-321-0x00007FF9EFD20000-0x00007FF9F07E1000-memory.dmpFilesize
10.8MB
-
memory/176-322-0x0000010EF76E0000-0x0000010EF76EA000-memory.dmpFilesize
40KB
-
memory/176-323-0x00007FF9EFD20000-0x00007FF9F07E1000-memory.dmpFilesize
10.8MB
-
memory/176-324-0x0000010EF4940000-0x0000010EF4952000-memory.dmpFilesize
72KB
-
memory/176-325-0x00007FF9EFD20000-0x00007FF9F07E1000-memory.dmpFilesize
10.8MB
-
memory/528-160-0x0000000000000000-mapping.dmp
-
memory/672-190-0x0000000000400000-0x0000000000DCB000-memory.dmpFilesize
9.8MB
-
memory/672-185-0x0000000000400000-0x0000000000DCB000-memory.dmpFilesize
9.8MB
-
memory/672-193-0x0000000000400000-0x0000000000DCB000-memory.dmpFilesize
9.8MB
-
memory/672-189-0x0000000000400000-0x0000000000DCB000-memory.dmpFilesize
9.8MB
-
memory/672-188-0x0000000000400000-0x0000000000DCB000-memory.dmpFilesize
9.8MB
-
memory/672-187-0x0000000000400000-0x0000000000DCB000-memory.dmpFilesize
9.8MB
-
memory/672-194-0x0000000000400000-0x0000000000DCB000-memory.dmpFilesize
9.8MB
-
memory/672-204-0x0000000000400000-0x0000000000DCB000-memory.dmpFilesize
9.8MB
-
memory/672-192-0x0000000000400000-0x0000000000DCB000-memory.dmpFilesize
9.8MB
-
memory/672-195-0x0000000000400000-0x0000000000DCB000-memory.dmpFilesize
9.8MB
-
memory/860-224-0x0000000000000000-mapping.dmp
-
memory/1088-280-0x0000000074EC0000-0x0000000075471000-memory.dmpFilesize
5.7MB
-
memory/1088-279-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1088-278-0x0000000000000000-mapping.dmp
-
memory/1196-167-0x0000000000000000-mapping.dmp
-
memory/1352-168-0x0000000000000000-mapping.dmp
-
memory/1400-217-0x0000000000000000-mapping.dmp
-
memory/1480-173-0x0000000000000000-mapping.dmp
-
memory/1520-243-0x0000000000000000-mapping.dmp
-
memory/1532-202-0x00000000069B0000-0x0000000006A06000-memory.dmpFilesize
344KB
-
memory/1532-206-0x000000000F2B0000-0x000000000F302000-memory.dmpFilesize
328KB
-
memory/1532-201-0x0000000006850000-0x000000000685A000-memory.dmpFilesize
40KB
-
memory/1532-196-0x0000000000000000-mapping.dmp
-
memory/1532-197-0x0000000000FB0000-0x0000000001E0A000-memory.dmpFilesize
14.4MB
-
memory/1532-198-0x0000000006760000-0x00000000067FC000-memory.dmpFilesize
624KB
-
memory/1532-199-0x0000000006E20000-0x00000000073C4000-memory.dmpFilesize
5.6MB
-
memory/1532-200-0x0000000006910000-0x00000000069A2000-memory.dmpFilesize
584KB
-
memory/1532-219-0x0000000006870000-0x0000000006E14000-memory.dmpFilesize
5.6MB
-
memory/1532-218-0x000000000C3A0000-0x000000000C3AE000-memory.dmpFilesize
56KB
-
memory/1532-220-0x0000000006870000-0x0000000006E14000-memory.dmpFilesize
5.6MB
-
memory/1532-203-0x00000000068C0000-0x00000000068FE000-memory.dmpFilesize
248KB
-
memory/1532-205-0x000000000ED20000-0x000000000F214000-memory.dmpFilesize
5.0MB
-
memory/1720-284-0x0000000000000000-mapping.dmp
-
memory/1764-295-0x0000000074EC0000-0x0000000075471000-memory.dmpFilesize
5.7MB
-
memory/1764-292-0x0000000000000000-mapping.dmp
-
memory/1796-211-0x00007FF9EE510000-0x00007FF9EEF46000-memory.dmpFilesize
10.2MB
-
memory/1880-304-0x0000000074EC0000-0x0000000075471000-memory.dmpFilesize
5.7MB
-
memory/1880-302-0x0000000000000000-mapping.dmp
-
memory/1976-289-0x00007FF9DB0F0000-0x00007FF9DBB26000-memory.dmpFilesize
10.2MB
-
memory/1976-288-0x0000000000000000-mapping.dmp
-
memory/2024-214-0x0000000000000000-mapping.dmp
-
memory/2024-215-0x00007FF9EE510000-0x00007FF9EEF46000-memory.dmpFilesize
10.2MB
-
memory/2044-330-0x0000000000000000-mapping.dmp
-
memory/2084-291-0x00000000004078EE-mapping.dmp
-
memory/2084-294-0x0000000074EC0000-0x0000000075471000-memory.dmpFilesize
5.7MB
-
memory/2084-296-0x0000000074EC0000-0x0000000075471000-memory.dmpFilesize
5.7MB
-
memory/2084-299-0x0000000074EC0000-0x0000000075471000-memory.dmpFilesize
5.7MB
-
memory/2084-290-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/2108-186-0x0000000000000000-mapping.dmp
-
memory/2220-311-0x00000000004078EE-mapping.dmp
-
memory/2220-315-0x0000000074EC0000-0x0000000075471000-memory.dmpFilesize
5.7MB
-
memory/2220-316-0x0000000074EC0000-0x0000000075471000-memory.dmpFilesize
5.7MB
-
memory/2280-178-0x0000000000000000-mapping.dmp
-
memory/2412-181-0x0000000000000000-mapping.dmp
-
memory/2688-179-0x0000000000000000-mapping.dmp
-
memory/2820-183-0x0000000000000000-mapping.dmp
-
memory/2832-319-0x0000000000000000-mapping.dmp
-
memory/2908-238-0x000001EF5EAA9000-0x000001EF5EAAF000-memory.dmpFilesize
24KB
-
memory/2908-237-0x00007FF9EF5C0000-0x00007FF9F0081000-memory.dmpFilesize
10.8MB
-
memory/2908-269-0x000001EF61680000-0x000001EF61696000-memory.dmpFilesize
88KB
-
memory/2908-234-0x0000000000000000-mapping.dmp
-
memory/2908-239-0x000001EF5EAA9000-0x000001EF5EAAF000-memory.dmpFilesize
24KB
-
memory/2908-236-0x00007FF9EF5C0000-0x00007FF9F0081000-memory.dmpFilesize
10.8MB
-
memory/2908-317-0x00007FF9EF5C0000-0x00007FF9F0081000-memory.dmpFilesize
10.8MB
-
memory/2908-318-0x000001EF5EAA9000-0x000001EF5EAAF000-memory.dmpFilesize
24KB
-
memory/2908-235-0x000001EF436D0000-0x000001EF44494000-memory.dmpFilesize
13.8MB
-
memory/2944-270-0x0000000074EC0000-0x0000000075471000-memory.dmpFilesize
5.7MB
-
memory/2944-272-0x0000000074EC0000-0x0000000075471000-memory.dmpFilesize
5.7MB
-
memory/2944-267-0x0000000074EC0000-0x0000000075471000-memory.dmpFilesize
5.7MB
-
memory/2944-263-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/2944-260-0x0000000000000000-mapping.dmp
-
memory/3000-350-0x000002F6285B0000-0x000002F6285C0000-memory.dmpFilesize
64KB
-
memory/3000-351-0x000002F629120000-0x000002F629130000-memory.dmpFilesize
64KB
-
memory/3016-255-0x0000000000710000-0x0000000000728000-memory.dmpFilesize
96KB
-
memory/3016-258-0x0000000000710000-0x0000000000728000-memory.dmpFilesize
96KB
-
memory/3016-249-0x0000000000000000-mapping.dmp
-
memory/3016-251-0x0000000000710000-0x0000000000728000-memory.dmpFilesize
96KB
-
memory/3088-213-0x00007FF9EE510000-0x00007FF9EEF46000-memory.dmpFilesize
10.2MB
-
memory/3088-212-0x0000000000000000-mapping.dmp
-
memory/3292-247-0x0000000000000000-mapping.dmp
-
memory/3292-308-0x0000000074EC0000-0x0000000075471000-memory.dmpFilesize
5.7MB
-
memory/3292-301-0x00000000004078EE-mapping.dmp
-
memory/3292-305-0x0000000074EC0000-0x0000000075471000-memory.dmpFilesize
5.7MB
-
memory/3292-306-0x0000000074EC0000-0x0000000075471000-memory.dmpFilesize
5.7MB
-
memory/3292-300-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/3308-282-0x0000000074EC0000-0x0000000075471000-memory.dmpFilesize
5.7MB
-
memory/3308-281-0x0000000074EC0000-0x0000000075471000-memory.dmpFilesize
5.7MB
-
memory/3308-273-0x0000000000000000-mapping.dmp
-
memory/3308-283-0x0000000074EC0000-0x0000000075471000-memory.dmpFilesize
5.7MB
-
memory/3416-176-0x0000000000000000-mapping.dmp
-
memory/3444-268-0x0000000074EC0000-0x0000000075471000-memory.dmpFilesize
5.7MB
-
memory/3444-265-0x0000000000000000-mapping.dmp
-
memory/3488-286-0x0000000000000000-mapping.dmp
-
memory/3496-175-0x0000000000000000-mapping.dmp
-
memory/3500-264-0x0000000074EC0000-0x0000000075471000-memory.dmpFilesize
5.7MB
-
memory/3500-259-0x0000000000000000-mapping.dmp
-
memory/3532-221-0x00007FF9EE510000-0x00007FF9EEF46000-memory.dmpFilesize
10.2MB
-
memory/3548-172-0x0000000000000000-mapping.dmp
-
memory/3684-242-0x0000000000000000-mapping.dmp
-
memory/3772-216-0x0000000000000000-mapping.dmp
-
memory/3836-329-0x00000000050C0000-0x0000000005126000-memory.dmpFilesize
408KB
-
memory/3836-328-0x0000000000740000-0x0000000000752000-memory.dmpFilesize
72KB
-
memory/3900-233-0x0000000000000000-mapping.dmp
-
memory/4028-241-0x0000000000000000-mapping.dmp
-
memory/4032-227-0x0000000074EC0000-0x0000000075471000-memory.dmpFilesize
5.7MB
-
memory/4032-229-0x0000000074EC0000-0x0000000075471000-memory.dmpFilesize
5.7MB
-
memory/4032-207-0x0000000000000000-mapping.dmp
-
memory/4128-208-0x0000000000000000-mapping.dmp
-
memory/4128-209-0x0000000000400000-0x000000000043B000-memory.dmpFilesize
236KB
-
memory/4128-210-0x0000000000400000-0x000000000043B000-memory.dmpFilesize
236KB
-
memory/4148-287-0x0000000000000000-mapping.dmp
-
memory/4164-244-0x0000000000000000-mapping.dmp
-
memory/4164-245-0x0000000074EC0000-0x0000000075471000-memory.dmpFilesize
5.7MB
-
memory/4164-246-0x0000000074EC0000-0x0000000075471000-memory.dmpFilesize
5.7MB
-
memory/4344-307-0x0000000000000000-mapping.dmp
-
memory/4344-309-0x00007FF9DB0F0000-0x00007FF9DBB26000-memory.dmpFilesize
10.2MB
-
memory/4348-276-0x0000000074EC0000-0x0000000075471000-memory.dmpFilesize
5.7MB
-
memory/4348-271-0x0000000000000000-mapping.dmp
-
memory/4444-180-0x0000000000000000-mapping.dmp
-
memory/4500-285-0x0000000000000000-mapping.dmp
-
memory/4516-174-0x0000000000000000-mapping.dmp
-
memory/4552-252-0x0000000074EC0000-0x0000000075471000-memory.dmpFilesize
5.7MB
-
memory/4552-248-0x0000000000000000-mapping.dmp
-
memory/4576-191-0x0000000000000000-mapping.dmp
-
memory/4632-326-0x00007FF9EFD20000-0x00007FF9F07E1000-memory.dmpFilesize
10.8MB
-
memory/4632-327-0x00007FF9EFD20000-0x00007FF9F07E1000-memory.dmpFilesize
10.8MB
-
memory/4640-177-0x0000000000000000-mapping.dmp
-
memory/4700-164-0x0000000000000000-mapping.dmp
-
memory/4728-231-0x0000000074EC0000-0x0000000075471000-memory.dmpFilesize
5.7MB
-
memory/4728-230-0x0000000074EC0000-0x0000000075471000-memory.dmpFilesize
5.7MB
-
memory/4728-228-0x0000000000000000-mapping.dmp
-
memory/4728-232-0x0000000074EC0000-0x0000000075471000-memory.dmpFilesize
5.7MB
-
memory/4732-298-0x00007FF9DB0F0000-0x00007FF9DBB26000-memory.dmpFilesize
10.2MB
-
memory/4732-297-0x0000000000000000-mapping.dmp
-
memory/4868-314-0x0000000074EC0000-0x0000000075471000-memory.dmpFilesize
5.7MB
-
memory/4868-312-0x0000000000000000-mapping.dmp
-
memory/4884-171-0x0000000000000000-mapping.dmp
-
memory/4912-222-0x0000000000000000-mapping.dmp
-
memory/4912-223-0x00007FF9EE510000-0x00007FF9EEF46000-memory.dmpFilesize
10.2MB
-
memory/4924-225-0x0000000000000000-mapping.dmp
-
memory/4924-226-0x00007FF9E0370000-0x00007FF9E0DA6000-memory.dmpFilesize
10.2MB
-
memory/4928-184-0x0000000000000000-mapping.dmp
-
memory/4956-240-0x0000000000000000-mapping.dmp
-
memory/4992-331-0x0000000000000000-mapping.dmp
-
memory/5032-182-0x0000000000000000-mapping.dmp
-
memory/5052-332-0x0000000000000000-mapping.dmp