Analysis

  • max time kernel
    1394s
  • max time network
    1396s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-01-2023 09:02

General

  • Target

    hitb2.lua

  • Size

    136B

  • MD5

    596e8b4c50fa6579495c12756c3b5f14

  • SHA1

    de331021e0b2f8fcb792db5cef59472c1964b3bf

  • SHA256

    ec80fee089dba5429a5dd568c14af8e3c23d04da0dbd66bb838d6070cc9a7027

  • SHA512

    ccfd44c42c77d4248febb5ddca64a35c043564277f4e8280bff6d4425357329842d73e10fc50119dab17d6dfc5559e591132ec65bf7b066aae9d1e6911c5f0b1

Malware Config

Extracted

Path

C:\Program Files\WinRAR\Rar.txt

Ransom Note
User's Manual ~~~~~~~~~~~~~ RAR 6.11 console version ~~~~~~~~~~~~~~~~~~~~~~~~ =-=-=-=-=-=-=-=-=-=-=-=-=-=- Welcome to the RAR Archiver! -=-=-=-=-=-=-=-=-=-=-=-=-=-= Introduction ~~~~~~~~~~~~ RAR is a console application allowing to manage archive files in command line mode. RAR provides compression, encryption, data recovery and many other functions described in this manual. RAR supports only RAR format archives, which have .rar file name extension by default. ZIP and other formats are not supported. Even if you specify .zip extension when creating an archive, it will still be in RAR format. Windows users may install WinRAR, which supports more archive types including RAR and ZIP formats. WinRAR provides both graphical user interface and command line mode. While console RAR and GUI WinRAR have the similar command line syntax, some differences exist. So it is recommended to use this rar.txt manual for console RAR (rar.exe in case of Windows version) and winrar.chm WinRAR help file for GUI WinRAR (winrar.exe). Configuration file ~~~~~~~~~~~~~~~~~~ RAR and UnRAR for Unix read configuration information from .rarrc file in a user's home directory (stored in HOME environment variable) or in /etc directory. RAR and UnRAR for Windows read configuration information from rar.ini file, placed in the same directory as the rar.exe file. This file can contain the following string: switches=<any RAR switches separated by spaces> For example: switches=-m5 -s It is also possible to specify separate switch sets for individual RAR commands using the following syntax: switches_<command>=<any RAR switches separated by spaces> For example: switches_a=-m5 -s switches_x=-o+ Environment variable ~~~~~~~~~~~~~~~~~~~~ Default parameters may be added to the RAR command line by establishing an environment variable "RAR". For instance, in Unix following lines may be added to your profile: RAR='-s -md1024' export RAR RAR will use this string as default parameters in the command line and will create "solid" archives with 1024 MB sliding dictionary size. RAR handles options with priority as following: command line switches highest priority switches in the RAR variable lower priority switches saved in configuration file lowest priority Log file ~~~~~~~~ If switch -ilog is specified in the command line or configuration file, RAR will write informational messages about errors encountered while processing archives into a log file. Read the switch -ilog description for more details. The file order list for solid archiving - rarfiles.lst ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ rarfiles.lst contains a user-defined file list, which tells RAR the order in which to add files to a solid archive. It may contain file names, wildcards and special entry - $default. The default entry defines the place in order list for files not matched with other entries in this file. The comment character is ';'. In Windows this file should be placed in the same directory as RAR or in %APPDATA%\WinRAR directory, in Unix - to the user's home directory or in /etc. Tips to provide improved compression and speed of operation: - similar files should be grouped together in the archive; - frequently accessed files should be placed at the beginning. Normally masks placed nearer to the top of list have a higher priority, but there is an exception from this rule. If rarfiles.lst contains such two masks that all files matched by one mask are also matched by another, that mask which matches a smaller subset of file names will have higher priority regardless of its position in the list. For example, if you have *.cpp and f*.cpp masks, f*.cpp has a higher priority, so the position of 'filename.cpp' will be chosen according to 'f*.cpp', not '*.cpp'. RAR command line syntax ~~~~~~~~~~~~~~~~~~~~~~~ Syntax RAR <command> [ -<switches> ] <archive> [ <@listfiles...> ] [ <files...> ] [ <path_to_extract\> ] Description Command is a single character or string specifying an action to be performed by RAR. Switches are designed to modify the way RAR performs such action. Other parameters are archive name and files to be archived or extracted. Listfiles are plain text files containing names of files to process. File names must start at the first column. It is possible to put comments to the listfile after // characters. For example, you can create backup.lst containing the following strings: c:\work\doc\*.txt //backup text documents c:\work\image\*.bmp //backup pictures c:\work\misc and then run: rar a backup @backup.lst If you wish to read file names from stdin (standard input), specify the empty listfile name (just @). By default, console RAR uses the single byte encoding in list files, but it can be redefined with -sc<charset>l switch. You can specify both usual file names and list files in the same command line. If neither files nor listfiles are specified, then *.* is implied and RAR will process all files. path_to_extract includes the destination directory name followed by a path separator character. For example, it can be c:\dest\ in Windows or data/ in Unix. It specifies the directory to place extracted files in 'x' and 'e' commands. This directory is created by RAR if it does not exist yet. Alternatively it can be set with -op<path> switch. Many RAR commands, such as extraction, test or list, allow to use wildcards in archive name. If no extension is specified in archive mask, RAR assumes .rar, so * means all archives with .rar extension. If you need to process all archives without extension, use *. mask. *.* mask selects all files. Wildcards in archive name are not allowed when archiving and deleting. In Unix you need to enclose RAR command line parameters containing wildcards in single or double quotes to prevent their expansion by Unix shell. For example, this command will extract *.asm files from all *.rar archives in current directory: rar e '*.rar' '*.asm' Command could be any of the following: a Add files to archive. Examples: 1) add all *.hlp files from the current directory to the archive help.rar: rar a help *.hlp 2) archive all files from the current directory and subdirectories to 362000 bytes size solid, self-extracting volumes and add the recovery record to each volume: rar a -r -v362 -s -sfx -rr save Because no file names are specified, all files (*) are assumed. 3) as a special exception, if directory name is specified as an argument and if directory name does not include file masks and trailing path separator, the entire contents of the directory and all subdirectories will be added to the archive even if switch -r is not specified. The following command will add all files from the directory Bitmaps and its subdirectories to the RAR archive Pictures.rar: rar a Pictures.rar Bitmaps 4) if directory name includes the trailing path separator, normal rules apply and you need to specify switch -r to process its subdirectories. The following command will add all files from directory Bitmaps, but not from its subdirectories, because switch -r is not specified: rar a Pictures.rar Bitmaps\* c Add archive comment. Comments are displayed while the archive is being processed. Comment length is limited to 256 KB. Examples: rar c distrib.rar Also comments may be added from a file using -z[file] switch. The following command adds a comment from info.txt file: rar c -zinfo.txt dummy ch Change archive parameters. This command can be used with most of archive modification switches to modify archive parameters. It is especially convenient for switches like -cl, -cu, -tl, which do not have a dedicated command. It is not able to recompress, encrypt or decrypt archive data and it cannot merge or create volumes. If used without any switches, 'ch' command just copies the archive data without modification. Example: Set archive time to latest file: rar ch -tl files.rar cw Write archive comment to specified file. Format of output file depends on -sc switch. If output file name is not specified, comment data will be sent to stdout. Examples: 1) rar cw arc comment.txt 2) rar cw -scuc arc unicode.txt 3) rar cw arc d Delete files from archive. If this command removes all files from archive, the empty archive is removed. e Extract files without archived paths. Extract files excluding their path component, so all files are created in the same destination directory. Use 'x' command if you wish to extract full pathnames. Example: rar e -or html.rar *.css css\ extract all *.css files from html.rar archive to 'css' directory excluding archived paths. Rename extracted files automatically in case several files have the same name. f Freshen files in archive. Updates archived files older than files to add. This command will not add new files to the archive. i[i|c|h|t]=<string> Find string in archives. Supports following optional parameters: i - case insensitive search (default); c - case sensitive search; h - hexadecimal search; t - use ANSI, UTF-8, UTF-16 and OEM (Windows only) character tables; If no parameters are specified, it is possible to use the simplified command syntax i<string> instead of i=<string> It is allowed to specify 't' modifier with other parameters, for example, ict=string performs case sensitive search using all mentioned above character tables. Examples: 1) rar "ic=first level" -r c:\*.rar *.txt Perform case sensitive search of "first level" string in *.txt files in *.rar archives on the disk c: 2) rar ih=f0e0aeaeab2d83e3a9 -r e:\texts\*.rar Search for hex string f0 e0 ae ae ab 2d 83 e3 a9 in rar archives in e:\texts directory. k Lock archive. RAR cannot modify locked archives, so locking important archives prevents their accidental modification by RAR. Such protection might be especially useful in case of RAR commands processing archives in groups. This command is not intended or able to prevent modification by other tools or willful third party. It implements a safety measure only for accidental data change by RAR. Example: rar k final.rar l[t[a],b] List archive contents [technical [all], bare]. 'l' command lists archived file attributes, size, date, time and name, one file per line. If file is encrypted, line starts from '*' character. 'lt' displays the detailed file information in multiline mode. This information includes file checksum value, host OS, compression options and other parameters. 'lta' provide the detailed information not only for files, but also for service headers like NTFS streams or file security data. 'lb' lists bare file names with path, one per line, without any additional information. You can use -v switch to list contents of all volumes in volume set: rar l -v vol.part1.rar Commands 'lt', 'lta' and 'lb' are equal to 'vt', 'vta' and 'vb' correspondingly. m[f] Move to archive [files only]. Moving files and directories results in the files and directories being erased upon successful completion of the packing operation. Directories will not be removed if 'f' modifier is used and/or '-ed' switch is applied. p Print file to stdout. Send unpacked file data to stdout. Informational messages are suppressed with this command, so they are not mixed with file data. r Repair archive. Archive repairing is performed in two stages. First, the damaged archive is searched for a recovery record (see 'rr' command). If archive contains the previously added recovery record and if damaged data area is continuous and smaller than error correction code size in recovery record, chance of successful archive reconstruction is high. When this stage has been completed, a new archive is created, named as fixed.arcname.rar, where 'arcname' is the original (damaged) archive name. If broken archive does not contain a recovery record or if archive is not completely recovered due to major damage, second stage is performed. During this stage only the archive structure is reconstructed and it is impossible to recover files which fail checksum validation, it is still possible, however, to recover undamaged files, which were inaccessible due to the broken archive structure. Mostly this is useful for non-solid archives. This stage is never efficient for archives with encrypted file headers, which can be repaired only if recovery record is present. When the second stage is completed, the reconstructed archive is saved as rebuilt.arcname.rar, where 'arcname' is the original archive name. By default, repaired archives are created in the current directory, but you can append an optional destpath\ parameter to specify another destination directory. Example: rar r buggy.rar c:\fixed\ repair buggy.rar and place the result to 'c:\fixed' directory. rc Reconstruct missing and damaged volumes using recovery volumes (.rev files). You need to specify any existing .rar or .rev volume as the archive name. Example: rar rc backup.part03.rar Read 'rv' command description for information about recovery volumes. rn Rename archived files. The command syntax is: rar rn <arcname> <srcname1> <destname1> ... <srcnameN> <destnameN> For example, the following command: rar rn data.rar readme.txt readme.bak info.txt info.bak will rename readme.txt to readme.bak and info.txt to info.bak in the archive data.rar. It is allowed to use wildcards in the source and destination names for simple name transformations
Emails

-n@inclist.txt

Extracted

Path

C:\Program Files\WinRAR\WhatsNew.txt

Ransom Note
WinRAR - What's new in the latest version Version 6.11 1. Added support for Gz archives with large archive comments. Previously the extraction command failed to unpack gz archives if comment size exceeded 16 KB. 2. Archive comments in gz archives are displayed in the comment window and recognized by "Show information" command. Large comments are shown partially. Previous versions didn't display Gzip comments. 3. Reserved device names followed by file extension, such as aux.txt, are extracted as is in Windows 11 even without "Allow potentially incompatible names" option or -oni command line switch. Unlike previous Windows versions, Windows 11 treats such names as usual files. Device names without extension, such as aux, still require these options to be unpacked as is regardless of Windows version. 4. Switch -mes can be also used to suppress the password prompt and abort when adding files to encrypted solid archive. 5. Additional measures to prevent extracting insecure links are implemented. 6. Bugs fixed: a) if password exceeding 127 characters was entered when unpacking an encrypted archive with console RAR, text after 127th character could be erroneously recognized as user's input by different prompts issued later; b) wrong archived file time could be displayed in overwrite prompt when extracting a file from ZIP archive. It happened if such archive included extended file times and was created in another time zone. It didn't affect the actual file time, which was set properly upon extraction. Version 6.10 1. WinRAR can unpack contents of .zst and .zipx archives utilizing Zstandard algorithm. 2. Added support of Windows 11 Explorer context menus. Beginning from Windows 11, an application can add only a single top level command or submenu to Explorer context menu. If "Cascaded context menus" in "Integration settings" dialog is on, this single item is a submenu storing all necessary WinRAR commands. If this option is off, only one extraction command for archives and one archiving command for usual files are available. You can select these commands with "Context menu items..." button in "Integration settings" dialog. 3. "Legacy context menus" option in "Settings/Integration" dialog can be used in Windows 11 if WinRAR commands are missing in "Show more options" Windows legacy context menu or in context menus of third party file managers. If WinRAR commands are already present here, keep "Legacy context menus" option turned off to prevent duplicating them. This option is not available in Windows 10 and older. 4. Windows XP is not supported anymore. Minimum required operating system version is Windows Vista. 5. "Close" item is added to "When done" list on "Advanced" page of archiving dialog. It closes WinRAR window, when archiving is done. 6. "When done" list is added to "Options" page of extraction dialog. It allows to select an action like turning a computer off or closing WinRAR after completing extraction. 7. Switch -si can be used when extracting or testing to read archive data from stdin, such as: type docs.rar | rar x -si -o+ -pmypwd dummy docs\ Even though the archive name is ignored with this switch, an arbitrary dummy archive name has to specified in the command line. Operations requiring backward seeks are unavailable in this mode. It includes displaying archive comments, testing the recovery record, utilizing the quick open information, processing multivolume archives. Prompts requiring user interaction are not allowed. Use -o[+|-|r], -p<pwd> or -mes switches to suppress such prompts. 8. New -ep4<path> switch excludes the path prefix when archiving or extracting if this path is found in the beginning of archived name. Path is compared with names already prepared to store in archive, without drive letters and leading path separators. For example: rar a -ep4texts\books archive c:\texts\books\technical removes "text\books" from archived names, so they start from 'technical'. 9. New -mes switch skips encrypted files when extracting or testing. It replaces the former -p- switch. 10. New -op<path> switch sets the destination folder for 'x' and 'e' extraction commands. Unlike <path_to_extract\> command line parameter, this switch also accepts paths without trailing path separator character. 11. If 'p' command is used to print a file to stdout, informational messages are suppressed automatically to prevent them mixing with file data. 12. "Generate archive name by mask" option and switch -ag treat only first two 'M' characters after 'H' as minutes. Previously any amount of such characters was considered as minutes. It makes possible to place the time field before the date, like -agHHMM-DDMMYY. Previous versions considered all 'M' in this string as minutes. 13. Maximum allowed size of RAR5 recovery record is increased to 1000% of protected data size. Maximum number of RAR5 recovery volumes can be 10 times larger than protected RAR volumes. Previous WinRAR versions are not able to use the recovery record to repair broken archives if recovery record size exceeds 99%. Similarly, previous versions cannot use recovery volumes if their number is equal or larger than number of RAR volumes. 14. Warning is issued if entered password exceeds the allowed limit of 127 characters and is truncated. Previously such passwords had been truncated silently. 15. If archive includes reserved device names, the underscore character is inserted in the beginning of such names when extracting. For example, aux.txt is converted to _aux.txt. It is done to prevent compatibility problems with software unable to process such names. You can use "Allow potentially incompatible names" option in "Advanced" part of extraction dialog or command line -oni switch to avoid this conversion. 16. WinRAR attempts to reset the file cache before testing an archive. It helps to verify actual data written to disk instead of reading a cached copy. 17. Multiple -v<size> switches specifying different sizes for different volumes are now allowed also for ZIP archives: WinRAR a -v100k -v200k -v300k arcname.zip Previously multiple -v<size> switches were supported only for RAR archives. 18. Switches -sl<size> and -sm<size> can be used in WinRAR.exe command line mode when extracting archives in any supported formats, provided that such archive includes unpacked file sizes. Previously these switches could filter files by size only in RAR and ZIP archives. 19. Newer folder selection dialog is invoked when pressing "Browse" button in WinRAR "Settings/Paths" page, "Repair" and "Convert" commands, also as in few other similar places. Previously a simpler XP style folder selection dialog was opened. 20. When restoring from tray after completing an operation, WinRAR window is positioned under other opened windows, to not interfere with current user activities. 21. "650 MB CD" is removed and "2 GB volumes" is added to the list of predefined volume sizes in "Define volume sizes" dialog invoked from WinRAR "Settings/Compression". 22. "Rename" command selects the file name part up to the final dot. Previously it selected the entire name. 23. If SFX archive size exceeds 4 GB, an error message is issued during compression, immediately after exceeding this threshold. Previously this error was reported only after completing compression. Executables of such size cannot be started by Windows. 24. Command line -en switch is not supported anymore. It created RAR4 archives without the end of archive record. End of archive record permits to gracefully skip external data like digital signatures. 25. Bugs fixed: a) when editing a file inside of .rar or .zip archive, WinRAR created a new SFX archive instead of updating an existing archive if "Create SFX archive" option was set in the default compression profile; b) the total progress could be displayed incorrectly when using -oi, -f, -u switches or appropriate GUI options; c) "Find files" command with "Use all tables" option and command line "it" commands failed to find strings in UTF-16 encoding. Version 6.02 1. ZIP SFX module refuses to process SFX commands stored in archive comment if such comment is resided after beginning of Authenticode digital signature. It is done to prevent possible attacks with inclusion of ZIP archive into the signature body. We already prohibited extracting contents of such malformed archives in WinRAR 6.01. We are thankful to Jacob Thompson - Mandiant Advantage Labs for reporting this issue. 2. WinRAR uses https instead of http in the web notifier window, home page and themes links. It also implements additional checks within the web notifier. This is done to prevent a malicious web page from executing existing files on a user's computer. Such attack is only possible if the intruder has managed to spoof or otherwise control user's DNS records. Some other factors are also involved in limiting the practical application of this attack. We would like to express our gratitude to Igor Sak-Sakovskiy for bringing this issue to our attention. 3. Where appropriate, SFX archive displays the additional line with detailed error information provided by operating system. For example, previously such archive would display "Cannot create file" message alone. Now this message is followed by a detailed reason like access denied or file being used by another process. In the past this extended error information was available in WinRAR, but not in SFX archives. 4. Switch -idn hides archived names also in 'v' and 'l' commands. It can be useful if only the archive type or total information is needed. 5. If -ibck -ri<priority> switches are used together, WinRAR process sets the priority specified in -ri switch. Previous versions ignored -ri and set the priority to low in the presence of -ibck switch. 6. When using "File/Change drive" command, WinRAR saves the last folder of previous drive and restores it if that drive is selected again later. 7. Name of unpacking file is now included into WinRAR incorrect password warning for RAR5 archives. It can be helpful when unpacking a non-solid archive containing files encrypted with different passwords. 8. Bugs fixed: a) "Convert archives" command issued erroneous "The specified password is incorrect" message after succesfully converting RAR archive with encrypted file names if new password was set and archive was opened in WinRAR shell; b) if command progress window was resized up and then quickly resized down to original dimensions, window contents could be positioned incorrectly. Version 6.01 1. Ctrl+A keyboard shortcut selects the entire text in WinRAR comment window. 2. If -idn switch is used together with -t or -df in console RAR when archiving, it additionally disables "Deleting <filename>" or "Testing <filename>" messages, normally issued by these switches. Also -idn disables folder creation messages when extracting a file to non-existing folder. 3. WinRAR and ZIP SFX module refuse to extract contents of ZIP SFX archives if ZIP central directory is resided after beginning of Authenticode digital signature. It is done to prevent possible attacks with inclusion of ZIP archive into signature body. 4. Bugs fixed: a) "Convert archives" command could incorrectly convert Unicode comments in RAR archives. b) if two archive information windows had been opened from Explorer context menu, the compression ratio bar in the first window could erroneously display a value for second archive. It did not affect the ratio and other text details at the right of window. Only the vertical bar at the left could be updated to a wrong value; c) if "Wait if other WinRAR copies are active" option was enabled in extraction dialog, "Waiting for another WinRAR copy" title was not set in command progress window while waiting; d) when extracting a symbolic link, previous versions did not overwrite existing symbolic links even if user requested it in overwrite prompt. Version 6.00 1. "Ignore" and "Ignore All" options are added to read error prompt. "Ignore" allows to continue processing with already read file part only and "Ignore All" does it for all future read errors. For example, if you archive a file, which portion is locked by another process, and if "Ignore" is selected in read error prompt, only a part of file preceding the unreadable region will be saved into archive. It can help to avoid interrupting lengthy archiving operations, though be aware that files archived with "Ignore" are incomplete. If switch -y is specified, "Ignore" is applied to all files by default. Previously available "Retry" and "Quit" options are still present in read error prompt as well. 2. Exit code 12 is returned in the command line mode in case of read errors. This code is returned for all options in the read error prompt, including a newly introduced "Ignore" option. Previously more common fatal error code 2 was returned for read errors. 3. If several archives are selected, "Extract archives to" option group in "Options" page of extraction dialog can be used to place extracted files to specified destination folder, to separate subfolders in destination folder, to separate subfolders in archive folders and directly to archive folders. It replaces "Extract archives to subfolders" option and available only if multiple archives are selected. 4. New -ad2 switch places extracted files directly to archive's own folder. Unlike -ad1, it does not create a separate subfolder for each unpacked archive. 5. "Additional switches" option in "Options" page of archiving and extraction dialogs allows to specify WinRAR command line switches. It might be useful if there is no option in WinRAR graphical interface matching a switch. Use this feature only if you are familiar with WinRAR command line syntax and clearly understand what specified switches are intended for. 6. Compression parameters in "Benchmark" command are changed to 32 MB dictionary and "Normal" method. They match RAR5 default mode and more suitable to estimate the typical performance of recent WinRAR versions than former 4 MB "Best" intended for RAR4 format. Latest "Benchmark" results cannot be compared with previous versions directly. New parameters set produces different values, likely lower because of eight times larger dictionary size. 7. When unpacking a part of files from solid volume set, WinRAR attempts to skip volumes in the beginning and
URLs

https

http

http://weirdsgn.com

http://icondesignlab.com

https://rarlab.com/themes/WinRAR_Classic_48x36.theme.rar

Extracted

Family

revengerat

Botnet

Guest

C2

127.0.0.1:333

127.0.0.1:3334

Mutex

RV_MUTEX

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

127.0.0.1:1921

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    true

  • install_file

    ded.exe

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs
  • Modifies system executable filetype association 2 TTPs 8 IoCs
  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

  • Suspicious use of NtCreateProcessExOtherParentProcess 3 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Async RAT payload 2 IoCs
  • RevengeRat Executable 8 IoCs
  • XMRig Miner payload 7 IoCs
  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 37 IoCs
  • Modifies Windows Firewall 1 TTPs 3 IoCs
  • Registers COM server for autorun 1 TTPs 3 IoCs
  • Checks computer location settings 2 TTPs 10 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 4 IoCs
  • Loads dropped DLL 12 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Drops file in System32 directory 17 IoCs
  • Suspicious use of SetThreadContext 11 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 15 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 10 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 12 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 11 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs
  • Suspicious use of AdjustPrivilegeToken 44 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 31 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\hitb2.lua
    1⤵
      PID:2828
    • C:\Windows\system32\OpenWith.exe
      C:\Windows\system32\OpenWith.exe -Embedding
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:1420
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      1⤵
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:3048
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9f3874f50,0x7ff9f3874f60,0x7ff9f3874f70
        2⤵
          PID:4672
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1640 /prefetch:2
          2⤵
            PID:4592
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2028 /prefetch:8
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:764
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2280 /prefetch:8
            2⤵
              PID:4080
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2844 /prefetch:1
              2⤵
                PID:1492
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3048 /prefetch:1
                2⤵
                  PID:5088
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3508 /prefetch:1
                  2⤵
                    PID:3448
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4352 /prefetch:8
                    2⤵
                      PID:4888
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4624 /prefetch:8
                      2⤵
                        PID:4576
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4652 /prefetch:8
                        2⤵
                          PID:1656
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4640 /prefetch:8
                          2⤵
                            PID:3524
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4432 /prefetch:8
                            2⤵
                              PID:3372
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:1
                              2⤵
                                PID:2544
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4760 /prefetch:8
                                2⤵
                                  PID:1312
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4616 /prefetch:8
                                  2⤵
                                    PID:976
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3292 /prefetch:8
                                    2⤵
                                      PID:4596
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4496 /prefetch:1
                                      2⤵
                                        PID:3100
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3516 /prefetch:1
                                        2⤵
                                          PID:4716
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1
                                          2⤵
                                            PID:3020
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3668 /prefetch:8
                                            2⤵
                                              PID:216
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6012 /prefetch:8
                                              2⤵
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:2336
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4876 /prefetch:8
                                              2⤵
                                                PID:992
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5580 /prefetch:8
                                                2⤵
                                                  PID:4968
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4968 /prefetch:8
                                                  2⤵
                                                    PID:1964
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4656 /prefetch:8
                                                    2⤵
                                                      PID:1276
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5112 /prefetch:8
                                                      2⤵
                                                        PID:4700
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
                                                        2⤵
                                                          PID:3924
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6060 /prefetch:8
                                                          2⤵
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:4596
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
                                                          2⤵
                                                            PID:1844
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
                                                            2⤵
                                                              PID:3720
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5232 /prefetch:8
                                                              2⤵
                                                                PID:5080
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6288 /prefetch:8
                                                                2⤵
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                PID:4024
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6148 /prefetch:8
                                                                2⤵
                                                                  PID:1264
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6368 /prefetch:8
                                                                  2⤵
                                                                    PID:3624
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6356 /prefetch:8
                                                                    2⤵
                                                                      PID:4740
                                                                    • C:\Users\Admin\Downloads\winrar-x64-611.exe
                                                                      "C:\Users\Admin\Downloads\winrar-x64-611.exe"
                                                                      2⤵
                                                                      • Executes dropped EXE
                                                                      • Checks computer location settings
                                                                      • Drops file in Program Files directory
                                                                      • Suspicious use of SetWindowsHookEx
                                                                      PID:528
                                                                      • C:\Program Files\WinRAR\uninstall.exe
                                                                        "C:\Program Files\WinRAR\uninstall.exe" /setup
                                                                        3⤵
                                                                        • Modifies system executable filetype association
                                                                        • Executes dropped EXE
                                                                        • Registers COM server for autorun
                                                                        • Drops file in Program Files directory
                                                                        • Modifies registry class
                                                                        PID:4700
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3164 /prefetch:8
                                                                      2⤵
                                                                        PID:3140
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3152 /prefetch:8
                                                                        2⤵
                                                                          PID:5088
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3064 /prefetch:8
                                                                          2⤵
                                                                            PID:1264
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5816 /prefetch:8
                                                                            2⤵
                                                                              PID:4024
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3188 /prefetch:8
                                                                              2⤵
                                                                                PID:3448
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3216 /prefetch:8
                                                                                2⤵
                                                                                  PID:2164
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5112 /prefetch:8
                                                                                  2⤵
                                                                                    PID:3988
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6740 /prefetch:8
                                                                                    2⤵
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    PID:1440
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5104 /prefetch:8
                                                                                    2⤵
                                                                                      PID:1940
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
                                                                                      2⤵
                                                                                        PID:1492
                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5452 /prefetch:8
                                                                                        2⤵
                                                                                          PID:2436
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3176 /prefetch:8
                                                                                          2⤵
                                                                                            PID:3924
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
                                                                                            2⤵
                                                                                              PID:4184
                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6492 /prefetch:1
                                                                                              2⤵
                                                                                                PID:904
                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
                                                                                                2⤵
                                                                                                  PID:532
                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3244 /prefetch:8
                                                                                                  2⤵
                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                  PID:4888
                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3228 /prefetch:8
                                                                                                  2⤵
                                                                                                    PID:2304
                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5892 /prefetch:8
                                                                                                    2⤵
                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                    PID:2544
                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5640 /prefetch:8
                                                                                                    2⤵
                                                                                                      PID:3176
                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3468 /prefetch:8
                                                                                                      2⤵
                                                                                                        PID:376
                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6724 /prefetch:8
                                                                                                        2⤵
                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                        PID:976
                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
                                                                                                        2⤵
                                                                                                          PID:4872
                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5328 /prefetch:8
                                                                                                          2⤵
                                                                                                            PID:1404
                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3056 /prefetch:8
                                                                                                            2⤵
                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                            PID:5076
                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4628 /prefetch:8
                                                                                                            2⤵
                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                            PID:1440
                                                                                                          • C:\Program Files\WinRAR\WinRAR.exe
                                                                                                            "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\PentagonRAT.zip"
                                                                                                            2⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Modifies Internet Explorer settings
                                                                                                            • Suspicious behavior: GetForegroundWindowSpam
                                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                            PID:1352
                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5256 /prefetch:8
                                                                                                            2⤵
                                                                                                              PID:3536
                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4356 /prefetch:2
                                                                                                              2⤵
                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                              PID:1472
                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8
                                                                                                              2⤵
                                                                                                                PID:4256
                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4592 /prefetch:8
                                                                                                                2⤵
                                                                                                                  PID:1324
                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2116 /prefetch:8
                                                                                                                  2⤵
                                                                                                                    PID:4960
                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1028 /prefetch:8
                                                                                                                    2⤵
                                                                                                                      PID:3540
                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4920 /prefetch:8
                                                                                                                      2⤵
                                                                                                                        PID:2360
                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6220 /prefetch:8
                                                                                                                        2⤵
                                                                                                                          PID:5028
                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3684 /prefetch:8
                                                                                                                          2⤵
                                                                                                                            PID:2276
                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:8
                                                                                                                            2⤵
                                                                                                                              PID:1444
                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5660 /prefetch:8
                                                                                                                              2⤵
                                                                                                                                PID:2072
                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4456 /prefetch:8
                                                                                                                                2⤵
                                                                                                                                  PID:4624
                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2528 /prefetch:8
                                                                                                                                  2⤵
                                                                                                                                    PID:4832
                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1272 /prefetch:8
                                                                                                                                    2⤵
                                                                                                                                      PID:1240
                                                                                                                                    • C:\Program Files\WinRAR\WinRAR.exe
                                                                                                                                      "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\Virus Rat v8.0 Beta.zip"
                                                                                                                                      2⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                      PID:860
                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3268 /prefetch:8
                                                                                                                                      2⤵
                                                                                                                                        PID:3472
                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2116 /prefetch:8
                                                                                                                                        2⤵
                                                                                                                                          PID:3904
                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6720 /prefetch:8
                                                                                                                                          2⤵
                                                                                                                                            PID:1804
                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4476 /prefetch:8
                                                                                                                                            2⤵
                                                                                                                                              PID:4740
                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5184 /prefetch:8
                                                                                                                                              2⤵
                                                                                                                                                PID:2252
                                                                                                                                              • C:\Program Files\WinRAR\WinRAR.exe
                                                                                                                                                "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\Revenge-RAT v0.3.zip"
                                                                                                                                                2⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                                PID:3900
                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5184 /prefetch:8
                                                                                                                                                2⤵
                                                                                                                                                  PID:3852
                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5000 /prefetch:8
                                                                                                                                                  2⤵
                                                                                                                                                    PID:1120
                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3680 /prefetch:8
                                                                                                                                                    2⤵
                                                                                                                                                      PID:4584
                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5128 /prefetch:8
                                                                                                                                                      2⤵
                                                                                                                                                        PID:5008
                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=812 /prefetch:8
                                                                                                                                                        2⤵
                                                                                                                                                          PID:364
                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=85 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4580 /prefetch:1
                                                                                                                                                          2⤵
                                                                                                                                                            PID:1296
                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=86 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:1
                                                                                                                                                            2⤵
                                                                                                                                                              PID:2052
                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=87 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
                                                                                                                                                              2⤵
                                                                                                                                                                PID:3124
                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=88 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=896 /prefetch:1
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:4904
                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=89 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2352 /prefetch:1
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:4420
                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4428 /prefetch:8
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:1264
                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=90 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6184 /prefetch:1
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:2132
                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=92 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:4524
                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5644 /prefetch:8
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:1900
                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4792 /prefetch:8
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:1404
                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:8
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:2252
                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=96 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4512 /prefetch:1
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:2800
                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1632,2273470321757577155,7403182386907205888,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2956 /prefetch:8
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:1140
                                                                                                                                                                                  • C:\Program Files\WinRAR\WinRAR.exe
                                                                                                                                                                                    "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\COMPILED.zip"
                                                                                                                                                                                    2⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                                                                    PID:2832
                                                                                                                                                                                • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                                                  1⤵
                                                                                                                                                                                    PID:4396
                                                                                                                                                                                  • C:\Windows\System32\rundll32.exe
                                                                                                                                                                                    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                                                                                                                    1⤵
                                                                                                                                                                                      PID:5032
                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe
                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe"
                                                                                                                                                                                      1⤵
                                                                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                                                                      PID:3040
                                                                                                                                                                                      • C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir3040_252070865\ChromeRecovery.exe
                                                                                                                                                                                        "C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir3040_252070865\ChromeRecovery.exe" --appguid={8A69D345-D564-463c-AFF1-A69D9E530F96} --browser-version=89.0.4389.114 --sessionid={082c4652-12cf-4d00-8e96-9e514ff1dd12} --system
                                                                                                                                                                                        2⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        PID:1196
                                                                                                                                                                                    • C:\Users\Admin\Desktop\PentagonRAT\PentagonRAT Final Relasex.exe
                                                                                                                                                                                      "C:\Users\Admin\Desktop\PentagonRAT\PentagonRAT Final Relasex.exe"
                                                                                                                                                                                      1⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                      PID:3472
                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c schtasks /End /TN "Microsoft\Windows\MUI\WindowsUpdate" & schtasks /End /TN "WindowsUpdate" & exit
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:4884
                                                                                                                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                            schtasks /End /TN "Microsoft\Windows\MUI\WindowsUpdate"
                                                                                                                                                                                            3⤵
                                                                                                                                                                                              PID:3548
                                                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                              schtasks /End /TN "WindowsUpdate"
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:1480
                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c schtasks /Delete /TN "WindowsUpdate" /F & exit
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:4516
                                                                                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                  schtasks /Delete /TN "WindowsUpdate" /F
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                    PID:3496
                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="System" dir=out action=allow program="%windir%\SysWOW64\TiWorker.exe" enable=yes & exit
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:3416
                                                                                                                                                                                                    • C:\Windows\system32\netsh.exe
                                                                                                                                                                                                      netsh advfirewall firewall add rule name="System" dir=out action=allow program="C:\Windows\SysWOW64\TiWorker.exe" enable=yes
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                      • Modifies Windows Firewall
                                                                                                                                                                                                      PID:4640
                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="System" dir=in action=allow program="%windir%\SysWOW64\TiWorker.exe" enable=yes & exit
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:2280
                                                                                                                                                                                                      • C:\Windows\system32\netsh.exe
                                                                                                                                                                                                        netsh advfirewall firewall add rule name="System" dir=in action=allow program="C:\Windows\SysWOW64\TiWorker.exe" enable=yes
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                        • Modifies Windows Firewall
                                                                                                                                                                                                        PID:2688
                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c schtasks /Create /XML "%windir%\SysWOW64\MicrosoftWindows.xml" /TN "Microsoft\Windows\MUI\WindowsUpdate" /F & exit
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:4444
                                                                                                                                                                                                        • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                          schtasks /Create /XML "C:\Windows\SysWOW64\MicrosoftWindows.xml" /TN "Microsoft\Windows\MUI\WindowsUpdate" /F
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                                                                          PID:2412
                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c schtasks /Change /TN "Microsoft\Windows\MUI\WindowsUpdate" /TR "%windir%\SysWOW64\TiWorker.exe" & schtasks /Run /TN "Microsoft\Windows\MUI\WindowsUpdate" & exit
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:5032
                                                                                                                                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                            schtasks /Change /TN "Microsoft\Windows\MUI\WindowsUpdate" /TR "C:\Windows\SysWOW64\TiWorker.exe"
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                              PID:2820
                                                                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                              schtasks /Run /TN "Microsoft\Windows\MUI\WindowsUpdate"
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                PID:4928
                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c certutil –addstore –f root MicrosoftWindows.crt & exit
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:2108
                                                                                                                                                                                                                • C:\Windows\system32\certutil.exe
                                                                                                                                                                                                                  certutil –addstore –f root MicrosoftWindows.crt
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                    PID:4576
                                                                                                                                                                                                                • C:\Users\Admin\Desktop\PentagonRAT\PentagonRAT Final Relase.exe
                                                                                                                                                                                                                  "C:\Users\Admin\Desktop\PentagonRAT\PentagonRAT Final Relase.exe"
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                  • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                  PID:1532
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    cmd.exe /C UPX\mpress.exe -s "C:\Users\Admin\Downloads\1507100101000115.exe"
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                      PID:4032
                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\PentagonRAT\UPX\mpress.exe
                                                                                                                                                                                                                        UPX\mpress.exe -s "C:\Users\Admin\Downloads\1507100101000115.exe"
                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        PID:4128
                                                                                                                                                                                                                • C:\Windows\SysWOW64\TiWorker.exe
                                                                                                                                                                                                                  C:\Windows\SysWOW64\TiWorker.exe
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                  PID:672
                                                                                                                                                                                                                • C:\Users\Admin\Downloads\1507100101000115.exe
                                                                                                                                                                                                                  "C:\Users\Admin\Downloads\1507100101000115.exe"
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                  PID:1796
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                    PID:3088
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\InstallDir\Dllhost.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\InstallDir\Dllhost.exe"
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                      • Adds policy Run key to start application
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      • Drops startup file
                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                      PID:2024
                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\netsh.exe
                                                                                                                                                                                                                        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\InstallDir\Dllhost.exe" "Dllhost.exe" ENABLE
                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                        • Modifies Windows Firewall
                                                                                                                                                                                                                        PID:3772
                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                        schtasks /create /sc minute /mo 1 /tn StUpdate /tr C:\Users\Admin\AppData\Local\Temp/StUpdate.exe
                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                                                                                                        PID:1400
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\StUpdate.exe
                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp/StUpdate.exe
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                  PID:3532
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    PID:4912
                                                                                                                                                                                                                • C:\Windows\system32\taskmgr.exe
                                                                                                                                                                                                                  "C:\Windows\system32\taskmgr.exe" /4
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                  • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                  • Checks SCSI registry key(s)
                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                  PID:704
                                                                                                                                                                                                                • C:\Users\Admin\Desktop\Virus Rat v8.0 Beta\Virus Rat v8.0 Betax.exe
                                                                                                                                                                                                                  "C:\Users\Admin\Desktop\Virus Rat v8.0 Beta\Virus Rat v8.0 Betax.exe"
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                  PID:3444
                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\Virus Rat v8.0 Beta\Virus Rat v8.0 Beta.exe
                                                                                                                                                                                                                    "C:\Users\Admin\Desktop\Virus Rat v8.0 Beta\Virus Rat v8.0 Beta.exe"
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                    • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                    PID:4924
                                                                                                                                                                                                                • C:\Users\Admin\Downloads\deeeed.exe
                                                                                                                                                                                                                  "C:\Users\Admin\Downloads\deeeed.exe"
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                  PID:4032
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    • Drops startup file
                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                    • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                    PID:4728
                                                                                                                                                                                                                • C:\Windows\system32\taskmgr.exe
                                                                                                                                                                                                                  "C:\Windows\system32\taskmgr.exe" /4
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                  • Checks SCSI registry key(s)
                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                  PID:1448
                                                                                                                                                                                                                • C:\Users\Admin\Desktop\Revenge-RAT v0.3\Revenge-RAT v0.3x.exe
                                                                                                                                                                                                                  "C:\Users\Admin\Desktop\Revenge-RAT v0.3\Revenge-RAT v0.3x.exe"
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                  PID:5016
                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\Revenge-RAT v0.3\Revenge-RAT v0.3.exe
                                                                                                                                                                                                                    "C:\Users\Admin\Desktop\Revenge-RAT v0.3\Revenge-RAT v0.3.exe"
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                    • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                    PID:2908
                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe
                                                                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe" /QUIET "C:\Users\Admin\AppData\Local\Temp\RV.IL" /output:"C:\Users\Admin\Downloads\Client.exe" /resource:Extensions\Admin.res
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                      PID:4956
                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                                                                                                                                                                                                        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCFFC.tmp" "Extensions\Admin.res"
                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                          PID:4028
                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\Revenge-RAT v0.3\Extensions\GoRC.exe
                                                                                                                                                                                                                        Extensions\GoRC /r Extensions\Information.rc
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        PID:3684
                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\Revenge-RAT v0.3\Extensions\Resource Hacker.exe
                                                                                                                                                                                                                        "Extensions\Resource Hacker" -addoverwrite C:\Users\Admin\Downloads\Client.exe,C:\Users\Admin\Downloads\Client.exe,C:\Users\Admin\Desktop\Revenge-RAT v0.3\Extensions\Information.res,VERSIONINFO,1,
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                        PID:1520
                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\Revenge-RAT v0.3\Extensions\dotNET_Reactor.exe
                                                                                                                                                                                                                        "C:\Users\Admin\Desktop\Revenge-RAT v0.3\Extensions\dotNET_Reactor.exe" dotNET_Reactor.exe -file "C:\Users\Admin\Downloads\Client.exe" -antitamp[1] -suppressildasm[1] -obfuscate_public_types[1] -stringencryption[1] -obfuscation[1] -targetfile "C:\Users\Admin\Downloads\Client.exe"
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        PID:4164
                                                                                                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                                                                                                        "C:\Windows\explorer.exe" /select,C:\Users\Admin\Downloads\Client.exe
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                          PID:3292
                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe
                                                                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe" /QUIET "C:\Users\Admin\AppData\Local\Temp\RV.IL" /output:"C:\Users\Admin\Downloads\dedddddddd.exe"
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                          PID:1720
                                                                                                                                                                                                                        • C:\Users\Admin\Desktop\Revenge-RAT v0.3\Extensions\GoRC.exe
                                                                                                                                                                                                                          Extensions\GoRC /r Extensions\Information.rc
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          PID:4500
                                                                                                                                                                                                                        • C:\Users\Admin\Desktop\Revenge-RAT v0.3\Extensions\Resource Hacker.exe
                                                                                                                                                                                                                          "Extensions\Resource Hacker" -addoverwrite C:\Users\Admin\Downloads\dedddddddd.exe,C:\Users\Admin\Downloads\dedddddddd.exe,C:\Users\Admin\Desktop\Revenge-RAT v0.3\Extensions\Information.res,VERSIONINFO,1,
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                          PID:3488
                                                                                                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                                                                                                          "C:\Windows\explorer.exe" /select,C:\Users\Admin\Downloads\dedddddddd.exe
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                            PID:4148
                                                                                                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                                                                                                        C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                                                                        • Modifies Internet Explorer settings
                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                        • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                                                                                                        • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                        PID:1620
                                                                                                                                                                                                                        • C:\Users\Admin\Downloads\Client.exe
                                                                                                                                                                                                                          "C:\Users\Admin\Downloads\Client.exe"
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                          PID:4552
                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe
                                                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe"
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                              PID:3016
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 3016 -s 236
                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                                                PID:1108
                                                                                                                                                                                                                          • C:\Users\Admin\Downloads\Client.exe
                                                                                                                                                                                                                            "C:\Users\Admin\Downloads\Client.exe"
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                            PID:3500
                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe
                                                                                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe"
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                                                                                                                              • Checks processor information in registry
                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                              PID:2944
                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe
                                                                                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe"
                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                  PID:3444
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Client.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\Client.exe"
                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                  PID:4348
                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe
                                                                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe"
                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                    • Checks processor information in registry
                                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                    PID:3308
                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe
                                                                                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe"
                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                        PID:1088
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3016 -ip 3016
                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                PID:4652
                                                                                                                                                                                                                              • C:\Windows\system32\taskmgr.exe
                                                                                                                                                                                                                                "C:\Windows\system32\taskmgr.exe" /4
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                • Checks SCSI registry key(s)
                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                PID:2440
                                                                                                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                                                                                                C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                • Modifies Internet Explorer settings
                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                PID:4552
                                                                                                                                                                                                                                • C:\Users\Admin\Downloads\dedddddddd.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\Downloads\dedddddddd.exe"
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                  PID:1976
                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe
                                                                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe"
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                    • Checks processor information in registry
                                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                    PID:2084
                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe
                                                                                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe"
                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                        PID:1764
                                                                                                                                                                                                                                      • C:\Users\Admin\Downloads\dedddddddd.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\Downloads\dedddddddd.exe"
                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                        PID:4732
                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe
                                                                                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe"
                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                          • Checks processor information in registry
                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                          PID:3292
                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe
                                                                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe"
                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                              PID:1880
                                                                                                                                                                                                                                            • C:\Users\Admin\Downloads\dedddddddd.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\Downloads\dedddddddd.exe"
                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                              PID:4344
                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe
                                                                                                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe"
                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                • Checks processor information in registry
                                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                PID:2220
                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe
                                                                                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe"
                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                    PID:4868
                                                                                                                                                                                                                                    • C:\Windows\system32\taskmgr.exe
                                                                                                                                                                                                                                      "C:\Windows\system32\taskmgr.exe" /4
                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                      • Checks SCSI registry key(s)
                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                      PID:2372
                                                                                                                                                                                                                                    • C:\Users\Admin\Desktop\AsyncRAT v0.5.7B\AsyncRAT.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\Desktop\AsyncRAT v0.5.7B\AsyncRAT.exe"
                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      PID:176
                                                                                                                                                                                                                                    • C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                                                                                                                                                                      C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                        PID:2372
                                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\AsyncRAT v0.5.7B\AsyncRAT.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\Desktop\AsyncRAT v0.5.7B\AsyncRAT.exe"
                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                                        • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                        PID:4632
                                                                                                                                                                                                                                      • C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                                                                                                                                                                        C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                          PID:1300
                                                                                                                                                                                                                                        • C:\Users\Admin\Downloads\AsyncClient.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\Downloads\AsyncClient.exe"
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                          PID:3836
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "ded" /tr '"C:\Users\Admin\AppData\Roaming\ded.exe"' & exit
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                              PID:2044
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                schtasks /create /f /sc onlogon /rl highest /tn "ded" /tr '"C:\Users\Admin\AppData\Roaming\ded.exe"'
                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                • Creates scheduled task(s)
                                                                                                                                                                                                                                                PID:3240
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp10EB.tmp.bat""
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                PID:4992
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                                                                                                  timeout 3
                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                  • Delays execution with timeout.exe
                                                                                                                                                                                                                                                  PID:5052
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\ded.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\ded.exe"
                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                  • Modifies Windows Defender Real-time Protection settings
                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                  • Windows security modification
                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                  PID:4728
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                    "powershell" Get-MpPreference -verbose
                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                    PID:2832
                                                                                                                                                                                                                                            • C:\Windows\system32\mspaint.exe
                                                                                                                                                                                                                                              "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\AsyncRAT v0.5.7B\ClientsFolder\33CA0180DF26E595063F\RemoteDesktop\IMG_01-14-2023 10;24;44.jpeg" /ForceBootstrapPaint3D
                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                              PID:4392
                                                                                                                                                                                                                                            • C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                              C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc
                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                                              PID:3000
                                                                                                                                                                                                                                            • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                                                              C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                              PID:3620
                                                                                                                                                                                                                                            • C:\Windows\system32\taskmgr.exe
                                                                                                                                                                                                                                              "C:\Windows\system32\taskmgr.exe" /4
                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                              • Checks SCSI registry key(s)
                                                                                                                                                                                                                                              • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                              PID:3004

                                                                                                                                                                                                                                            Network

                                                                                                                                                                                                                                            MITRE ATT&CK Matrix ATT&CK v6

                                                                                                                                                                                                                                            Execution

                                                                                                                                                                                                                                            Scheduled Task

                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                            T1053

                                                                                                                                                                                                                                            Persistence

                                                                                                                                                                                                                                            Modify Existing Service

                                                                                                                                                                                                                                            2
                                                                                                                                                                                                                                            T1031

                                                                                                                                                                                                                                            Change Default File Association

                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                            T1042

                                                                                                                                                                                                                                            Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                            3
                                                                                                                                                                                                                                            T1060

                                                                                                                                                                                                                                            Scheduled Task

                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                            T1053

                                                                                                                                                                                                                                            Privilege Escalation

                                                                                                                                                                                                                                            Scheduled Task

                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                            T1053

                                                                                                                                                                                                                                            Defense Evasion

                                                                                                                                                                                                                                            Modify Registry

                                                                                                                                                                                                                                            6
                                                                                                                                                                                                                                            T1112

                                                                                                                                                                                                                                            Disabling Security Tools

                                                                                                                                                                                                                                            2
                                                                                                                                                                                                                                            T1089

                                                                                                                                                                                                                                            Credential Access

                                                                                                                                                                                                                                            Credentials in Files

                                                                                                                                                                                                                                            2
                                                                                                                                                                                                                                            T1081

                                                                                                                                                                                                                                            Discovery

                                                                                                                                                                                                                                            Query Registry

                                                                                                                                                                                                                                            5
                                                                                                                                                                                                                                            T1012

                                                                                                                                                                                                                                            System Information Discovery

                                                                                                                                                                                                                                            5
                                                                                                                                                                                                                                            T1082

                                                                                                                                                                                                                                            Peripheral Device Discovery

                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                            T1120

                                                                                                                                                                                                                                            Collection

                                                                                                                                                                                                                                            Data from Local System

                                                                                                                                                                                                                                            2
                                                                                                                                                                                                                                            T1005

                                                                                                                                                                                                                                            Command and Control

                                                                                                                                                                                                                                            Web Service

                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                            T1102

                                                                                                                                                                                                                                            Replay Monitor

                                                                                                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                                                                                                            Downloads

                                                                                                                                                                                                                                            • C:\Program Files\WinRAR\Uninstall.exe
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              412KB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              92667e28583a9489e3cf4f1a7fd6636e

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              faa09990ba4daae970038ed44e3841151d6e7f28

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              9147293554ad43920bcf763ffd6e1183c36b9f8156dc220548426a187a5f2959

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              63555a15f153df59b2ca2ab56cd20d71420eb5c9977bcf774723d8484157172b027f71fb2f7a4692aecc6e471f50beec2e0f7a43e57449714caede1e9684c0b8

                                                                                                                                                                                                                                            • C:\Program Files\WinRAR\WinRAR.exe
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              2.3MB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              0b114fc0f4b6d49f57b3b01dd9ea6a8c

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              23e1480c3ff3a54e712d759e9325d362bf52fabd

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              f0f312fe14599d7379aa247c1d0cc6100db45bfe7f277113134a8157950bcacd

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              e31c3a3da5e72a9d72e245d6e5dcc7c92e4cfcbb6bdbb61061e0586e29f77e8b42a81a0bba99ce45e148a2423907878fb858c40cc1008ef9d90fb8e4e2fcd573

                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\AddLimit.csv
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              796KB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              e71b687a319f5689cb1727a0fda835df

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              334df9bf24e9b88d5c852c9099027b883e51e192

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              064403802c27d0ffe184c43dd880c02d97c9aac15495d46f4a582e01874431ce

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              0f8dd7920621f5cbcd7d3d2552da531f841aebd9cbe76bf1d302639a8e001c443cc914536ad00c74a84322914f46c3a6b3a0c7ccb08e3074159f2c694fe934f0

                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\ApproveSync.vsw
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              619KB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              2b6d846535ce76b8f211d92b70d40e52

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              af70bff41d56ffca5de20ff6b619110f27919694

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              15535750feac5f77abcf16faa1d8a0d309dd5909372e3efc61cf62c46f51e857

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              b95f858145d75b40615e8addb461f10eb01ba916c6df6adb01a449880916615dd4cb88561523f5b73e0751ac3eefdc635f5ed36878cce9769d47602e84fef8a4

                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\ClearSync.DVR-MS
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              644KB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              28609bb9b8b41dd880a89bb9e138e709

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              cdc1fe3b486761e24945b4c8e8fe22e15f256b64

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              9bd6b81a5a1852977df169962b17e689bc68ab3ceb9cec88db42295ebef44541

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              4b166646a702b16df6ce2d682957cd23e5d592672478117ca4d74f530b8f50b32e5713714aa0e4c256540542aa086bb4f0b91516a193a946947337070e68e02b

                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\CopyCheckpoint.js
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              771KB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              a479d4d714830930e1d7187cd717a8fd

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              1a2ac4695b23a0c1b8684b13111b50e912bcb629

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              f09fd5aecb92002b24e98beb0869aee40c264a18d99e23cccb8c59bda2bcb741

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              dd9e70a7d4c5558999840634c3f94a8246639b17f2bf78fb8ff3be02c78d5507fcfc2fe20d5e223db9e807e858586c9c5c34e166596747ed6ef82b8aa33d656d

                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\EditCompare.mpp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              973KB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              59ec7692b978434ce2e2b3dd8e0fcf63

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              3cd8a7f7c0db3bccdaa19b97a8520a9acae531dc

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              8f93884138e3522c8860213495ed2ddf627926c5d62550dd8de0446dc0b5da97

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              1cb38f37deecce3ddffacacec316e88b5f403f97d83e37d1a16da40b2ac1f7a94eefaba455e00bb544e58cbe642e4aebe417d5534a1bdd9ae4bc13e03f429e4a

                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\EnterTrace.DVR-MS
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              897KB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              020fa54a436e7a559c47357e99c128bb

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              2aab4c7b617470077f3e7015fba587345b6e6429

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              e1ee017622a1dcf878a92eb9fbdf120f932d8035ed978da4ab85ab65fc1e8078

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              2125eb97940ce0e3db9b062daa9bf87fdc78291253750fa7c1de5d753fd01f25e5aa3ebc16ebc4a0d1d328421ba5001769c87170a13b253c8560c2723793ee99

                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\ExitResize.wma
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              518KB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              d18470946208452ceaf90873c7d6a529

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              bf4980b336661b295bf60d800b2dda76a248b2cc

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              717356c8d1f32d2b9fa92d015a8dc1d60eadfa680becbccd341d9d7448a85a13

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              d043c97ea7827968d54dc7e060811b928b9867afd5fdc308c824da5515b30cc6ab57b363b4631950366297e1a6ba37596a03e50a9e28b487bcfeda8a32865141

                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\ExitWrite.zip
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              391KB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              db896322c1cffa015e70ec4b102c2624

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              6b50ad513ad0e5d6f864333f071ac5a5cf530cdc

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              96e72b70d248fad85cb14f281587fb78a77f088b32e03ec6e55201e1ed21f670

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              33f3007e33f9100185f907e007212078d28c9f247d722050c150b4012a099754813aa881164d81ec63a4a43fc675b71250fba5171599e497e34ce2ae894a8180

                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\ExpandUndo.dwfx
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              417KB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              15e2c6eb8e3ca8ad7941c295651f9069

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              93c78e9790c3e3c717f6d07ce2ecfe38e1bb19c8

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              6de7abf2a11cf31836c315d623d871fad43b5f8dad99b3ff4b0b6e2dc7fe664b

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              4f5f8d9a40782e43b953abe50c1de18162c97119ebe8bfb847ba0ce069ab386c0a1ea10eed6828d99b9121ec42d88d8b512d7a0dc2c7a5831c1f30b5a5abcf8e

                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\InvokeRegister.txt
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              948KB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              37ea1029625fabaa347ed0fbe2681bd0

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              895463e782e2860813f2e4fab5df6fd1a328c9d4

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              eb4684ac2ca2e0c57d7a9625e54887bcf916771ad283f7e0c0bf2caf9af1b101

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              e66e30ded42fcf2c412b3e5d183eb69f22df39f1971d3cac28663bf01274f2192b2075ddc05f8b6f81d0cbd2585325944ad064c6f1373dc59a3e67fabb50c9e0

                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\InvokeStep.wmf
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              594KB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              822ebf2e98e82b50d7ccdee045e198e4

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              769a32cff271c1a8655571ab42adca77b8fe94bd

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              2c27d824995852263fefcd1139b16bbbd2797b1a4545d701436a196f18e4946c

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              ad2380cd55394487b08fcdefaacad8cd7f1f8dd48cc3b72c018571f13bd9d350f18aae288035063633e002492a67ee6e58172dc1215d2888454347e05b64f5ca

                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\JoinRevoke.bmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              922KB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              390213c81022216736d60b3dba52a3e5

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              03ffa52b867caa1a491d5a2f153b5a3e1e1878c0

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              2127190aad23445241f26a611afb02fbb9177df7459efa45ca144ad1e6098e85

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              2364e17c8640986c74af5d7eb3fce0c648d07ca15f3d0bab4569a4d3a47758b581d6b021eb78065b1de0a9995495c6eb838034550b8adb3cd8d267ab3649b853

                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\PingRemove.wpl
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              695KB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              5d4097abcdda504502f7c1ba639a1a35

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              d3b779bbb0ffe2c28c28be0d27328f0137f0bff8

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              e949d78d5cbfac35e327508141641d395c45bc55dda853aaacf32907c3b2a9c8

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              44bea2fc2bf2950932a7c1831aaf9be3a4dedb82b24b4623327286bb2dfdfccbf3688ddeb8a315e674c713df6717d0672d42bf520258ccefa8b6e6513e9fd5c7

                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\RedoSet.pdf
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              568KB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              7f5e42d408bb12d30382036d49edddf6

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              3e8cf811d2ce2aa50a8def961613178e19952043

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              63349ee9914eb9c0d31339b3a4a6db1f270d118d46a59dcee63d14595aa86bbe

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              21b713efa99ea0035b4b2ed399fb974dc2923623930b1e5291d244330dc21a119b92d046a2cee6acca5e01b74bc36b28c8971662d43febe62d14957f0ed954a0

                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\RegisterBlock.kix
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              821KB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              b8cb669b185c33ac1b211a12589c5774

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              928939bcab0a518b4e97d51372de7d4af8a94ea2

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              216155af2367a2ec483300ce69ef24d3c9d8ea8e6588c20ae7b118a97cfec0bd

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              27bc9123fda75116b6cd6ad9ba372fb7d753f143c3d4de120d0f0754d831d084237bf8c0dc953e0e62d3ba1c5c3b371eb01b78f47ad7a9dc68647c01d5bc730e

                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\RegisterInstall.mhtml
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              493KB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              59bf387286b91a1d8825ea76205e72ca

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              e2d94262401f38c20a478cbc1c40e8e4483cff1a

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              790b7bd5e0afacdee646844eb1b49cee916bb146c6b41c7b51e8e4a63210562c

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              b100986c422f7dd57672aab46cc57f6a0c62a8b20748f87e9327dfbd8da64021de49c89fc530bb04f6fb881919013feb910715b1a0ad10e211d0dc57d168dc47

                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\RegisterUndo.M2V
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              543KB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              4cdd68fa1dc395f05377d371070957e3

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              0ab1af082d126d2c625b2dcf5423e83fc022e404

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              94cb958ecdc2af7bcb59b63b89253bc92b52ec758c04e683015a59da79349e3b

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              68c27fa47b5069edcd743e10212ef607d3b53673d62197980b95f91bf38bad58e979b5168918dde57b10f854bb14633e4c4224ba6adc99b1d10c053ccc71e5cf

                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\ResolveOptimize.ttf
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              847KB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              7b9b4085882914ce30c654db0edcc014

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              290a9e6df890ab9791fbd4bf06b63db0b6e014ff

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              310360984f2513beade9d9dce601f9eec8033ff574f992ae9abc9ab6ac1f4d2e

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              2a8a99180ac3ec6b1842c40414960496a805a2f9d0bc852a954894ccaafc4200534bb3e42630f85244bc6c0ee170db11aad8b6c29fa40890e3b56eff3bc45eab

                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\ResolveRegister.dwfx
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              341KB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              1ae393e4316753488a93fa20d9e3ff73

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              b6b3165c92db3c6a6610b62bbd280df2b47351b5

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              382616e6ada06119ed59521b3fc194d2467a1fbdfa7ebe2b9c0d1f0a236daa07

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              147734d3b11f76f2a61ddcd14f6874088dcc9b726b3faa0ece4e9848158b1afe537ca298a472ab8d812f2cfa0144beaf605e41d4faafe19a9073cbf653622641

                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\ShowSync.jtx
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              872KB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              a78a857c0d6e050501f2a5e68f0479eb

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              17111014b93c30a4692ad8876fc21f029c664682

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              b0737d934a68c708859546ddfb76f4a4c3334084d367938c5bf6a5aec587323c

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              10d0adceb8c57482dbca64eab838911a2159a917608f824ff3530cf8f212600378a65bc21f34117e14badd9a9cb95da0be184b7c6e146cb22349ec5438a1b755

                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\SkipUnpublish.aiff
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              366KB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              b294c0b81d93d70f6f35be055a88d7ea

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              e4c51aeb324d0e5a33634be734379ad71548978a

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              de37d4abe692d61f9c815d6ec0c35d4d3904ff42a00d4102125473221d4e65b4

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              9ea08488c0ad98f0fa9dcabee400aab5b20291ba7844c501088c511fffdbf863effe572ab81158160dc22eab428717e1ed4c3709d3978db7f5b7cb1fb3a0276b

                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\StepJoin.crw
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              d35f367d1be26728c3158f4da8f96671

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              4ecd238246da475d7881e897ab2c90a5d04de5cd

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              debc4738869fb685627018e177729ac93a8fd1e638ce0942299541a9e3e736ad

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              5715d0c8396538e5ad65b1244eaa0eef6b609dc187698a3614a832dce37c0238b773d885b2e930ef6fde5adfc115040a75bd90fd26328375144b5cd0d324eddb

                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\TestPush.nfo
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              442KB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              b4a5a944a0e3499c57be15e481588669

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              ee7e18c923dfb9c89b98f3cea113f2314792f7a5

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              d1e40bc5a9a496a5b729298451e71d8d384c48ac17cec5b7c3f7679216abf4cd

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              cac9f5232a306311bce760cc66571279ffdc87b718133fc74fbd834bce29fa30aca737be789854709d5e9ea3d951a0c42e88241ff217fe4ca4d83b11b5b8a300

                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\UnblockFind.mhtml
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              720KB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              2231675eefc10821710e13d0c2915cc8

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              c24693c1eaa391e4268653dd289f84dddca5a154

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              e174a1890431c5853850bb86fee87dc1d0d1f80c167d80ad4bc47cd318be7323

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              d09f0ec6cff2b18c3647d30f43446f55bf1caf4556419fbcbbd2640ccf98b44acf7b619e568f7585e02bb1a1d4a6a5c2f9e9c8affa89461e8bb48127c2e21752

                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\UnpublishPublish.dll
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              467KB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              4d057c0c56dc4a527e2224bd9ab69691

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              f09ed677a9fe0460a60f6a89c2db01aa13a9119c

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              ef217a9401c14c174484d2a271baba16736c1e6b159471c4d4f0171ecd69a926

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              02490341175278c2a7906e789e233080172ba09074299ccefb080a9661610334c9452dfcb1aa46ebaf3d943053d4adb3fecd5e05f40a378024f353859f43d857

                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\UpdatePop.pps
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              745KB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              37ac8643d0d2ba85f5a65b81d9c286fc

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              3bdba97d77d40498b3bd0ecb23592e7a24e5170e

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              dfd225605739e5e1fa60c793a05daad0f15bed812d67623f03a4365772c197d0

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              8388e4320b8af446ca5fd83fb336c0a93d3f3c81a8b43567894812776d39265412d71ce25b8e52986d0da663cd1ce9e510fc7494e933898ac373fdcf5b6f2f67

                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\WriteWatch.docx
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              670KB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              4ae4ac1e75acf6f6b0442a92a55578e2

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              15c0cb32292fcac66fc779d556eea2f78461f67e

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              98e3a4f650b5a11262958040204bda7507ba66851c1dc6cc80bb398df9956965

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              e7c2dfe4dbfdc6749a31f2d7b17c63e27df3ba833251099014a62dc084509a787e69757e282b589d631f72baadac2c18054517a05898040a694141cdf010f017

                                                                                                                                                                                                                                            • C:\Users\Admin\Downloads\winrar-x64-611.exe
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              3.3MB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              8a6217d94e1bcbabdd1dfcdcaa83d1b3

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              99b81b01f277540f38ea3e96c9c6dc2a57dfeb92

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              3023edb4fc3f7c2ebad157b182b62848423f6fa20d180b0df689cbb503a49684

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              a8f6f6fdfa9d754a577b7dd885a938fb9149f113baa2afb6352df622cdb73242175a06cd567e971fd3de93a126ba05b78178d5d512720d8fdb87ececce2cbf54

                                                                                                                                                                                                                                            • C:\Users\Admin\Downloads\winrar-x64-611.exe
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              3.3MB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              8a6217d94e1bcbabdd1dfcdcaa83d1b3

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              99b81b01f277540f38ea3e96c9c6dc2a57dfeb92

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              3023edb4fc3f7c2ebad157b182b62848423f6fa20d180b0df689cbb503a49684

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              a8f6f6fdfa9d754a577b7dd885a938fb9149f113baa2afb6352df622cdb73242175a06cd567e971fd3de93a126ba05b78178d5d512720d8fdb87ececce2cbf54

                                                                                                                                                                                                                                            • \??\pipe\crashpad_3048_JVMTBWQKQXILAOCY
                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              d41d8cd98f00b204e9800998ecf8427e

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                                                                                                                                                                                            • memory/176-320-0x0000010ED9930000-0x0000010ED9F96000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              6.4MB

                                                                                                                                                                                                                                            • memory/176-321-0x00007FF9EFD20000-0x00007FF9F07E1000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              10.8MB

                                                                                                                                                                                                                                            • memory/176-322-0x0000010EF76E0000-0x0000010EF76EA000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              40KB

                                                                                                                                                                                                                                            • memory/176-323-0x00007FF9EFD20000-0x00007FF9F07E1000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              10.8MB

                                                                                                                                                                                                                                            • memory/176-324-0x0000010EF4940000-0x0000010EF4952000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                            • memory/176-325-0x00007FF9EFD20000-0x00007FF9F07E1000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              10.8MB

                                                                                                                                                                                                                                            • memory/528-160-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            • memory/672-190-0x0000000000400000-0x0000000000DCB000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              9.8MB

                                                                                                                                                                                                                                            • memory/672-185-0x0000000000400000-0x0000000000DCB000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              9.8MB

                                                                                                                                                                                                                                            • memory/672-193-0x0000000000400000-0x0000000000DCB000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              9.8MB

                                                                                                                                                                                                                                            • memory/672-189-0x0000000000400000-0x0000000000DCB000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              9.8MB

                                                                                                                                                                                                                                            • memory/672-188-0x0000000000400000-0x0000000000DCB000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              9.8MB

                                                                                                                                                                                                                                            • memory/672-187-0x0000000000400000-0x0000000000DCB000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              9.8MB

                                                                                                                                                                                                                                            • memory/672-194-0x0000000000400000-0x0000000000DCB000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              9.8MB

                                                                                                                                                                                                                                            • memory/672-204-0x0000000000400000-0x0000000000DCB000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              9.8MB

                                                                                                                                                                                                                                            • memory/672-192-0x0000000000400000-0x0000000000DCB000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              9.8MB

                                                                                                                                                                                                                                            • memory/672-195-0x0000000000400000-0x0000000000DCB000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              9.8MB

                                                                                                                                                                                                                                            • memory/860-224-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            • memory/1088-280-0x0000000074EC0000-0x0000000075471000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              5.7MB

                                                                                                                                                                                                                                            • memory/1088-279-0x0000000000400000-0x000000000040C000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              48KB

                                                                                                                                                                                                                                            • memory/1088-278-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            • memory/1196-167-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            • memory/1352-168-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            • memory/1400-217-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            • memory/1480-173-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            • memory/1520-243-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            • memory/1532-202-0x00000000069B0000-0x0000000006A06000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              344KB

                                                                                                                                                                                                                                            • memory/1532-206-0x000000000F2B0000-0x000000000F302000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              328KB

                                                                                                                                                                                                                                            • memory/1532-201-0x0000000006850000-0x000000000685A000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              40KB

                                                                                                                                                                                                                                            • memory/1532-196-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            • memory/1532-197-0x0000000000FB0000-0x0000000001E0A000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              14.4MB

                                                                                                                                                                                                                                            • memory/1532-198-0x0000000006760000-0x00000000067FC000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              624KB

                                                                                                                                                                                                                                            • memory/1532-199-0x0000000006E20000-0x00000000073C4000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              5.6MB

                                                                                                                                                                                                                                            • memory/1532-200-0x0000000006910000-0x00000000069A2000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              584KB

                                                                                                                                                                                                                                            • memory/1532-219-0x0000000006870000-0x0000000006E14000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              5.6MB

                                                                                                                                                                                                                                            • memory/1532-218-0x000000000C3A0000-0x000000000C3AE000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              56KB

                                                                                                                                                                                                                                            • memory/1532-220-0x0000000006870000-0x0000000006E14000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              5.6MB

                                                                                                                                                                                                                                            • memory/1532-203-0x00000000068C0000-0x00000000068FE000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              248KB

                                                                                                                                                                                                                                            • memory/1532-205-0x000000000ED20000-0x000000000F214000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              5.0MB

                                                                                                                                                                                                                                            • memory/1720-284-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            • memory/1764-295-0x0000000074EC0000-0x0000000075471000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              5.7MB

                                                                                                                                                                                                                                            • memory/1764-292-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            • memory/1796-211-0x00007FF9EE510000-0x00007FF9EEF46000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              10.2MB

                                                                                                                                                                                                                                            • memory/1880-304-0x0000000074EC0000-0x0000000075471000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              5.7MB

                                                                                                                                                                                                                                            • memory/1880-302-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            • memory/1976-289-0x00007FF9DB0F0000-0x00007FF9DBB26000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              10.2MB

                                                                                                                                                                                                                                            • memory/1976-288-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            • memory/2024-214-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            • memory/2024-215-0x00007FF9EE510000-0x00007FF9EEF46000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              10.2MB

                                                                                                                                                                                                                                            • memory/2044-330-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            • memory/2084-291-0x00000000004078EE-mapping.dmp
                                                                                                                                                                                                                                            • memory/2084-294-0x0000000074EC0000-0x0000000075471000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              5.7MB

                                                                                                                                                                                                                                            • memory/2084-296-0x0000000074EC0000-0x0000000075471000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              5.7MB

                                                                                                                                                                                                                                            • memory/2084-299-0x0000000074EC0000-0x0000000075471000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              5.7MB

                                                                                                                                                                                                                                            • memory/2084-290-0x0000000000400000-0x000000000040C000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              48KB

                                                                                                                                                                                                                                            • memory/2108-186-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            • memory/2220-311-0x00000000004078EE-mapping.dmp
                                                                                                                                                                                                                                            • memory/2220-315-0x0000000074EC0000-0x0000000075471000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              5.7MB

                                                                                                                                                                                                                                            • memory/2220-316-0x0000000074EC0000-0x0000000075471000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              5.7MB

                                                                                                                                                                                                                                            • memory/2280-178-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            • memory/2412-181-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            • memory/2688-179-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            • memory/2820-183-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            • memory/2832-319-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            • memory/2908-238-0x000001EF5EAA9000-0x000001EF5EAAF000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              24KB

                                                                                                                                                                                                                                            • memory/2908-237-0x00007FF9EF5C0000-0x00007FF9F0081000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              10.8MB

                                                                                                                                                                                                                                            • memory/2908-269-0x000001EF61680000-0x000001EF61696000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              88KB

                                                                                                                                                                                                                                            • memory/2908-234-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            • memory/2908-239-0x000001EF5EAA9000-0x000001EF5EAAF000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              24KB

                                                                                                                                                                                                                                            • memory/2908-236-0x00007FF9EF5C0000-0x00007FF9F0081000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              10.8MB

                                                                                                                                                                                                                                            • memory/2908-317-0x00007FF9EF5C0000-0x00007FF9F0081000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              10.8MB

                                                                                                                                                                                                                                            • memory/2908-318-0x000001EF5EAA9000-0x000001EF5EAAF000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              24KB

                                                                                                                                                                                                                                            • memory/2908-235-0x000001EF436D0000-0x000001EF44494000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              13.8MB

                                                                                                                                                                                                                                            • memory/2944-270-0x0000000074EC0000-0x0000000075471000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              5.7MB

                                                                                                                                                                                                                                            • memory/2944-272-0x0000000074EC0000-0x0000000075471000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              5.7MB

                                                                                                                                                                                                                                            • memory/2944-267-0x0000000074EC0000-0x0000000075471000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              5.7MB

                                                                                                                                                                                                                                            • memory/2944-263-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              96KB

                                                                                                                                                                                                                                            • memory/2944-260-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            • memory/3000-350-0x000002F6285B0000-0x000002F6285C0000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              64KB

                                                                                                                                                                                                                                            • memory/3000-351-0x000002F629120000-0x000002F629130000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              64KB

                                                                                                                                                                                                                                            • memory/3016-255-0x0000000000710000-0x0000000000728000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              96KB

                                                                                                                                                                                                                                            • memory/3016-258-0x0000000000710000-0x0000000000728000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              96KB

                                                                                                                                                                                                                                            • memory/3016-249-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            • memory/3016-251-0x0000000000710000-0x0000000000728000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              96KB

                                                                                                                                                                                                                                            • memory/3088-213-0x00007FF9EE510000-0x00007FF9EEF46000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              10.2MB

                                                                                                                                                                                                                                            • memory/3088-212-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            • memory/3292-247-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            • memory/3292-308-0x0000000074EC0000-0x0000000075471000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              5.7MB

                                                                                                                                                                                                                                            • memory/3292-301-0x00000000004078EE-mapping.dmp
                                                                                                                                                                                                                                            • memory/3292-305-0x0000000074EC0000-0x0000000075471000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              5.7MB

                                                                                                                                                                                                                                            • memory/3292-306-0x0000000074EC0000-0x0000000075471000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              5.7MB

                                                                                                                                                                                                                                            • memory/3292-300-0x0000000000400000-0x000000000040C000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              48KB

                                                                                                                                                                                                                                            • memory/3308-282-0x0000000074EC0000-0x0000000075471000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              5.7MB

                                                                                                                                                                                                                                            • memory/3308-281-0x0000000074EC0000-0x0000000075471000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              5.7MB

                                                                                                                                                                                                                                            • memory/3308-273-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            • memory/3308-283-0x0000000074EC0000-0x0000000075471000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              5.7MB

                                                                                                                                                                                                                                            • memory/3416-176-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            • memory/3444-268-0x0000000074EC0000-0x0000000075471000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              5.7MB

                                                                                                                                                                                                                                            • memory/3444-265-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            • memory/3488-286-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            • memory/3496-175-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            • memory/3500-264-0x0000000074EC0000-0x0000000075471000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              5.7MB

                                                                                                                                                                                                                                            • memory/3500-259-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            • memory/3532-221-0x00007FF9EE510000-0x00007FF9EEF46000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              10.2MB

                                                                                                                                                                                                                                            • memory/3548-172-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            • memory/3684-242-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            • memory/3772-216-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            • memory/3836-329-0x00000000050C0000-0x0000000005126000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              408KB

                                                                                                                                                                                                                                            • memory/3836-328-0x0000000000740000-0x0000000000752000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                            • memory/3900-233-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            • memory/4028-241-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            • memory/4032-227-0x0000000074EC0000-0x0000000075471000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              5.7MB

                                                                                                                                                                                                                                            • memory/4032-229-0x0000000074EC0000-0x0000000075471000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              5.7MB

                                                                                                                                                                                                                                            • memory/4032-207-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            • memory/4128-208-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            • memory/4128-209-0x0000000000400000-0x000000000043B000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              236KB

                                                                                                                                                                                                                                            • memory/4128-210-0x0000000000400000-0x000000000043B000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              236KB

                                                                                                                                                                                                                                            • memory/4148-287-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            • memory/4164-244-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            • memory/4164-245-0x0000000074EC0000-0x0000000075471000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              5.7MB

                                                                                                                                                                                                                                            • memory/4164-246-0x0000000074EC0000-0x0000000075471000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              5.7MB

                                                                                                                                                                                                                                            • memory/4344-307-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            • memory/4344-309-0x00007FF9DB0F0000-0x00007FF9DBB26000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              10.2MB

                                                                                                                                                                                                                                            • memory/4348-276-0x0000000074EC0000-0x0000000075471000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              5.7MB

                                                                                                                                                                                                                                            • memory/4348-271-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            • memory/4444-180-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            • memory/4500-285-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            • memory/4516-174-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            • memory/4552-252-0x0000000074EC0000-0x0000000075471000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              5.7MB

                                                                                                                                                                                                                                            • memory/4552-248-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            • memory/4576-191-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            • memory/4632-326-0x00007FF9EFD20000-0x00007FF9F07E1000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              10.8MB

                                                                                                                                                                                                                                            • memory/4632-327-0x00007FF9EFD20000-0x00007FF9F07E1000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              10.8MB

                                                                                                                                                                                                                                            • memory/4640-177-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            • memory/4700-164-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            • memory/4728-231-0x0000000074EC0000-0x0000000075471000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              5.7MB

                                                                                                                                                                                                                                            • memory/4728-230-0x0000000074EC0000-0x0000000075471000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              5.7MB

                                                                                                                                                                                                                                            • memory/4728-228-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            • memory/4728-232-0x0000000074EC0000-0x0000000075471000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              5.7MB

                                                                                                                                                                                                                                            • memory/4732-298-0x00007FF9DB0F0000-0x00007FF9DBB26000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              10.2MB

                                                                                                                                                                                                                                            • memory/4732-297-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            • memory/4868-314-0x0000000074EC0000-0x0000000075471000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              5.7MB

                                                                                                                                                                                                                                            • memory/4868-312-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            • memory/4884-171-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            • memory/4912-222-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            • memory/4912-223-0x00007FF9EE510000-0x00007FF9EEF46000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              10.2MB

                                                                                                                                                                                                                                            • memory/4924-225-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            • memory/4924-226-0x00007FF9E0370000-0x00007FF9E0DA6000-memory.dmp
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              10.2MB

                                                                                                                                                                                                                                            • memory/4928-184-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            • memory/4956-240-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            • memory/4992-331-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            • memory/5032-182-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                            • memory/5052-332-0x0000000000000000-mapping.dmp