Overview
overview
7Static
static
3Rainmeter-4.5.18.exe
windows7-x64
4Rainmeter-4.5.18.exe
windows10-2004-x64
7$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...fo.dll
windows7-x64
3$PLUGINSDI...fo.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDIR/UAC.dll
windows7-x64
3$PLUGINSDIR/UAC.dll
windows10-2004-x64
3$PLUGINSDI...fo.dll
windows7-x64
3$PLUGINSDI...fo.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3Plugins/Ac...er.dll
windows7-x64
1Plugins/Ac...er.dll
windows10-2004-x64
1Plugins/Ad...PU.dll
windows7-x64
1Plugins/Ad...PU.dll
windows10-2004-x64
1Plugins/Au...el.dll
windows7-x64
1Plugins/Au...el.dll
windows10-2004-x64
1Plugins/CoreTemp.dll
windows7-x64
1Plugins/CoreTemp.dll
windows10-2004-x64
1Plugins/FileView.dll
windows7-x64
1Plugins/FileView.dll
windows10-2004-x64
1Plugins/Fo...fo.dll
windows7-x64
1Plugins/Fo...fo.dll
windows10-2004-x64
1Plugins/InputText.dll
windows7-x64
3Plugins/InputText.dll
windows10-2004-x64
3Plugins/PerfMon.dll
windows7-x64
1Plugins/PerfMon.dll
windows10-2004-x64
1Plugins/Pi...in.dll
windows7-x64
1Plugins/Pi...in.dll
windows10-2004-x64
1Analysis
- max time kernel
231s - max time network
232s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
11/06/2024, 10:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Rainmeter-4.5.18.exe
Resource
win7-20231129-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
Rainmeter-4.5.18.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
18 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win7-20231129-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/MoreInfo.dll
Resource
win7-20240419-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/MoreInfo.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240508-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral9
Sample
$PLUGINSDIR/UAC.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral10
Sample
$PLUGINSDIR/UAC.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral11
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win7-20240220-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral12
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral13
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20231129-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral14
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral15
Sample
Plugins/ActionTimer.dll
Resource
win7-20240508-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral16
Sample
Plugins/ActionTimer.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral17
Sample
Plugins/AdvancedCPU.dll
Resource
win7-20240419-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral18
Sample
Plugins/AdvancedCPU.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral19
Sample
Plugins/AudioLevel.dll
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral20
Sample
Plugins/AudioLevel.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral21
Sample
Plugins/CoreTemp.dll
Resource
win7-20240508-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral22
Sample
Plugins/CoreTemp.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral23
Sample
Plugins/FileView.dll
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral24
Sample
Plugins/FileView.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral25
Sample
Plugins/FolderInfo.dll
Resource
win7-20240508-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral26
Sample
Plugins/FolderInfo.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral27
Sample
Plugins/InputText.dll
Resource
win7-20240419-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral28
Sample
Plugins/InputText.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral29
Sample
Plugins/PerfMon.dll
Resource
win7-20240215-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral30
Sample
Plugins/PerfMon.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral31
Sample
Plugins/PingPlugin.dll
Resource
win7-20231129-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral32
Sample
Plugins/PingPlugin.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
1 signatures
150 seconds
General
- Target Rainmeter-4.5.18.exe
- Size 2.4MB
- Sample240611-mgr5wstglj
- SHA256 5ac959e5dee9884512f4a34623bbad2c08be427669015b917a750f7cbfbb0a75
- MD5 e2d2743839d187982e9c602575efc48c
- SHA1 e5b6808770e6bca105c1616e31015160725f855e
- SHA512 941936885ee61bcda2d0623a660d5532adecd66d7ee506650d33c5236e15f01dd0689ebab2ebf4f1935bf48f88d0c2579af800602602542521fe349b291d9878
- SSDEEP 49152:mQ5YRSuP59wVHUY1jLjTwtuXUaLEikcepufsJvHtgomcyC5eieKalFvv+Xg8V:m7Ss9wVHUCY8TIPC34eieKa/8NV
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Rainmeter.lnk Rainmeter-4.5.18.exe - Downloads MZ/PE file
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 204 raw.githubusercontent.com 205 raw.githubusercontent.com - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation Rainmeter-4.5.18.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Rainmeter\Languages\1060.dll Rainmeter-4.5.18.exe File created C:\Program Files\Rainmeter\Languages\1036.dll Rainmeter-4.5.18.exe File created C:\Program Files\Rainmeter\Plugins\UsageMonitor.dll Rainmeter-4.5.18.exe File created C:\Program Files\Rainmeter\Languages\1031.dll Rainmeter-4.5.18.exe File created C:\Program Files\Rainmeter\Defaults\Skins\illustro\Clock\Clock.ini Rainmeter-4.5.18.exe File created C:\Program Files\Rainmeter\Defaults\Skins\illustro\Disk\2 Disks.ini Rainmeter-4.5.18.exe File created C:\Program Files\Rainmeter\Defaults\Skins\illustro\System\System.ini Rainmeter-4.5.18.exe File created C:\Program Files\Rainmeter\Defaults\Skins\illustro\Welcome\Background.png Rainmeter-4.5.18.exe File created C:\Program Files\Rainmeter\Rainmeter.VisualElementsManifest.xml Rainmeter-4.5.18.exe File created C:\Program Files\Rainmeter\Plugins\RunCommand.dll Rainmeter-4.5.18.exe File created C:\Program Files\Rainmeter\Languages\3082.dll Rainmeter-4.5.18.exe File created C:\Program Files\Rainmeter\Plugins\InputText.dll Rainmeter-4.5.18.exe File created C:\Program Files\Rainmeter\Plugins\WindowMessagePlugin.dll Rainmeter-4.5.18.exe File created C:\Program Files\Rainmeter\Languages\2070.dll Rainmeter-4.5.18.exe File created C:\Program Files\Rainmeter\Rainmeter.exe Rainmeter-4.5.18.exe File created C:\Program Files\Rainmeter\Rainmeter.exe.config Rainmeter-4.5.18.exe File created C:\Program Files\Rainmeter\VisualElements\Rainmeter_600.png Rainmeter-4.5.18.exe File created C:\Program Files\Rainmeter\Plugins\PerfMon.dll Rainmeter-4.5.18.exe File created C:\Program Files\Rainmeter\Languages\1029.dll Rainmeter-4.5.18.exe File created C:\Program Files\Rainmeter\Languages\1043.dll Rainmeter-4.5.18.exe File created C:\Program Files\Rainmeter\Languages\1057.dll Rainmeter-4.5.18.exe File opened for modification C:\Program Files\Rainmeter\writetest~.rm Rainmeter-4.5.18.exe File created C:\Program Files\Rainmeter\Plugins\PingPlugin.dll Rainmeter-4.5.18.exe File created C:\Program Files\Rainmeter\Languages\1037.dll Rainmeter-4.5.18.exe File created C:\Program Files\Rainmeter\Languages\1051.dll Rainmeter-4.5.18.exe File created C:\Program Files\Rainmeter\Defaults\Layouts\illustro default\Rainmeter.ini Rainmeter-4.5.18.exe File created C:\Program Files\Rainmeter\Plugins\CoreTemp.dll Rainmeter-4.5.18.exe File created C:\Program Files\Rainmeter\Plugins\FileView.dll Rainmeter-4.5.18.exe File created C:\Program Files\Rainmeter\Languages\1045.dll Rainmeter-4.5.18.exe File created C:\Program Files\Rainmeter\Languages\1046.dll Rainmeter-4.5.18.exe File created C:\Program Files\Rainmeter\Languages\1048.dll Rainmeter-4.5.18.exe File created C:\Program Files\Rainmeter\Languages\1066.dll Rainmeter-4.5.18.exe File created C:\Program Files\Rainmeter\Languages\2074.dll Rainmeter-4.5.18.exe File created C:\Program Files\Rainmeter\Defaults\Skins\illustro\Welcome\Welcome.ini Rainmeter-4.5.18.exe File created C:\Program Files\Rainmeter\Rainmeter.dll Rainmeter-4.5.18.exe File created C:\Program Files\Rainmeter\Languages\2052.dll Rainmeter-4.5.18.exe File created C:\Program Files\Rainmeter\Defaults\Skins\illustro\@Resources\Background.png Rainmeter-4.5.18.exe File created C:\Program Files\Rainmeter\Defaults\Skins\illustro\Google\Google.ini Rainmeter-4.5.18.exe File created C:\Program Files\Rainmeter\Languages\1025.dll Rainmeter-4.5.18.exe File created C:\Program Files\Rainmeter\Defaults\Skins\illustro\Disk\1 Disk.ini Rainmeter-4.5.18.exe File created C:\Program Files\Rainmeter\Languages\1026.dll Rainmeter-4.5.18.exe File created C:\Program Files\Rainmeter\Plugins\PowerPlugin.dll Rainmeter-4.5.18.exe File created C:\Program Files\Rainmeter\Languages\1028.dll Rainmeter-4.5.18.exe File created C:\Program Files\Rainmeter\Languages\1032.dll Rainmeter-4.5.18.exe File created C:\Program Files\Rainmeter\Languages\1041.dll Rainmeter-4.5.18.exe File created C:\Program Files\Rainmeter\Languages\1061.dll Rainmeter-4.5.18.exe File created C:\Program Files\Rainmeter\Plugins\FolderInfo.dll Rainmeter-4.5.18.exe File created C:\Program Files\Rainmeter\Plugins\ActionTimer.dll Rainmeter-4.5.18.exe File created C:\Program Files\Rainmeter\Plugins\Win7AudioPlugin.dll Rainmeter-4.5.18.exe File created C:\Program Files\Rainmeter\Languages\1042.dll Rainmeter-4.5.18.exe File created C:\Program Files\Rainmeter\Languages\1055.dll Rainmeter-4.5.18.exe File created C:\Program Files\Rainmeter\RestartRainmeter.exe Rainmeter-4.5.18.exe File created C:\Program Files\Rainmeter\Defaults\Skins\illustro\Network\Network.ini Rainmeter-4.5.18.exe File created C:\Program Files\Rainmeter\Defaults\Skins\illustro\Recycle Bin\Recycle Bin.ini Rainmeter-4.5.18.exe File created C:\Program Files\Rainmeter\uninst.exe Rainmeter-4.5.18.exe File created C:\Program Files\Rainmeter\Languages\1033.dll Rainmeter-4.5.18.exe File created C:\Program Files\Rainmeter\Languages\1040.dll Rainmeter-4.5.18.exe File created C:\Program Files\Rainmeter\Languages\1058.dll Rainmeter-4.5.18.exe File created C:\Program Files\Rainmeter\Languages\1086.dll Rainmeter-4.5.18.exe File created C:\Program Files\Rainmeter\Plugins\iTunesPlugin.dll Rainmeter-4.5.18.exe File created C:\Program Files\Rainmeter\Plugins\AudioLevel.dll Rainmeter-4.5.18.exe File created C:\Program Files\Rainmeter\Languages\1030.dll Rainmeter-4.5.18.exe File created C:\Program Files\Rainmeter\Languages\1038.dll Rainmeter-4.5.18.exe File created C:\Program Files\Rainmeter\Languages\1054.dll Rainmeter-4.5.18.exe - Executes dropped EXE 2 IoCs
pid Process 1256 Rainmeter.exe 5108 Rainmeter.exe - Loads dropped DLL 6 IoCs
pid Process 3424 Rainmeter-4.5.18.exe 3424 Rainmeter-4.5.18.exe 3424 Rainmeter-4.5.18.exe 3424 Rainmeter-4.5.18.exe 1256 Rainmeter.exe 5108 Rainmeter.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133625753057785574" chrome.exe - Modifies registry class 17 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Rainmeter.SkinInstaller\ = "Rainmeter Skin Installer" Rainmeter-4.5.18.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Rainmeter.SkinInstaller\DefaultIcon Rainmeter-4.5.18.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Rainmeter.SkinInstaller\shell\open\command\ = "\"C:\\Program Files\\Rainmeter\\SkinInstaller.exe\" %1" Rainmeter-4.5.18.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Rainmeter.SkinInstaller\shell\edit\command Rainmeter-4.5.18.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Rainmeter.SkinInstaller\shell Rainmeter-4.5.18.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Rainmeter.SkinInstaller\shell\edit\command\ = "\"C:\\Program Files\\Rainmeter\\SkinInstaller.exe\" %1" Rainmeter-4.5.18.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.inc Rainmeter-4.5.18.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.inc\ = "inifile" Rainmeter-4.5.18.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Rainmeter.SkinInstaller\shell\edit\ = "Install Rainmeter skin" Rainmeter-4.5.18.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.rmskin\ = "Rainmeter.SkinInstaller" Rainmeter-4.5.18.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Rainmeter.SkinInstaller Rainmeter-4.5.18.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Rainmeter.SkinInstaller\DefaultIcon\ = "C:\\Program Files\\Rainmeter\\SkinInstaller.exe,0" Rainmeter-4.5.18.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Rainmeter.SkinInstaller\shell\edit Rainmeter-4.5.18.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.rmskin Rainmeter-4.5.18.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Rainmeter.SkinInstaller\shell\ = "open" Rainmeter-4.5.18.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Rainmeter.SkinInstaller\shell\open\command Rainmeter-4.5.18.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Rainmeter.SkinInstaller\shell\open Rainmeter-4.5.18.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4952 chrome.exe 4952 chrome.exe 3788 chrome.exe 3788 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 27 IoCs
pid Process 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe Token: SeShutdownPrivilege 4952 chrome.exe Token: SeCreatePagefilePrivilege 4952 chrome.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1256 Rainmeter.exe 1256 Rainmeter.exe 1256 Rainmeter.exe 1256 Rainmeter.exe 5108 Rainmeter.exe 5108 Rainmeter.exe 5108 Rainmeter.exe 5108 Rainmeter.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe - Suspicious use of SendNotifyMessage 35 IoCs
pid Process 1256 Rainmeter.exe 1256 Rainmeter.exe 1256 Rainmeter.exe 1256 Rainmeter.exe 1256 Rainmeter.exe 5108 Rainmeter.exe 5108 Rainmeter.exe 5108 Rainmeter.exe 5108 Rainmeter.exe 5108 Rainmeter.exe 5108 Rainmeter.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe 4952 chrome.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3424 wrote to memory of 1256 3424 Rainmeter-4.5.18.exe 90 PID 3424 wrote to memory of 1256 3424 Rainmeter-4.5.18.exe 90 PID 4952 wrote to memory of 1576 4952 chrome.exe 104 PID 4952 wrote to memory of 1576 4952 chrome.exe 104 PID 4952 wrote to memory of 2400 4952 chrome.exe 105 PID 4952 wrote to memory of 2400 4952 chrome.exe 105 PID 4952 wrote to memory of 2400 4952 chrome.exe 105 PID 4952 wrote to memory of 2400 4952 chrome.exe 105 PID 4952 wrote to memory of 2400 4952 chrome.exe 105 PID 4952 wrote to memory of 2400 4952 chrome.exe 105 PID 4952 wrote to memory of 2400 4952 chrome.exe 105 PID 4952 wrote to memory of 2400 4952 chrome.exe 105 PID 4952 wrote to memory of 2400 4952 chrome.exe 105 PID 4952 wrote to memory of 2400 4952 chrome.exe 105 PID 4952 wrote to memory of 2400 4952 chrome.exe 105 PID 4952 wrote to memory of 2400 4952 chrome.exe 105 PID 4952 wrote to memory of 2400 4952 chrome.exe 105 PID 4952 wrote to memory of 2400 4952 chrome.exe 105 PID 4952 wrote to memory of 2400 4952 chrome.exe 105 PID 4952 wrote to memory of 2400 4952 chrome.exe 105 PID 4952 wrote to memory of 2400 4952 chrome.exe 105 PID 4952 wrote to memory of 2400 4952 chrome.exe 105 PID 4952 wrote to memory of 2400 4952 chrome.exe 105 PID 4952 wrote to memory of 2400 4952 chrome.exe 105 PID 4952 wrote to memory of 2400 4952 chrome.exe 105 PID 4952 wrote to memory of 2400 4952 chrome.exe 105 PID 4952 wrote to memory of 2400 4952 chrome.exe 105 PID 4952 wrote to memory of 2400 4952 chrome.exe 105 PID 4952 wrote to memory of 2400 4952 chrome.exe 105 PID 4952 wrote to memory of 2400 4952 chrome.exe 105 PID 4952 wrote to memory of 2400 4952 chrome.exe 105 PID 4952 wrote to memory of 2400 4952 chrome.exe 105 PID 4952 wrote to memory of 2400 4952 chrome.exe 105 PID 4952 wrote to memory of 2400 4952 chrome.exe 105 PID 4952 wrote to memory of 2400 4952 chrome.exe 105 PID 4952 wrote to memory of 656 4952 chrome.exe 106 PID 4952 wrote to memory of 656 4952 chrome.exe 106 PID 4952 wrote to memory of 412 4952 chrome.exe 107 PID 4952 wrote to memory of 412 4952 chrome.exe 107 PID 4952 wrote to memory of 412 4952 chrome.exe 107 PID 4952 wrote to memory of 412 4952 chrome.exe 107 PID 4952 wrote to memory of 412 4952 chrome.exe 107 PID 4952 wrote to memory of 412 4952 chrome.exe 107 PID 4952 wrote to memory of 412 4952 chrome.exe 107 PID 4952 wrote to memory of 412 4952 chrome.exe 107 PID 4952 wrote to memory of 412 4952 chrome.exe 107 PID 4952 wrote to memory of 412 4952 chrome.exe 107 PID 4952 wrote to memory of 412 4952 chrome.exe 107 PID 4952 wrote to memory of 412 4952 chrome.exe 107 PID 4952 wrote to memory of 412 4952 chrome.exe 107 PID 4952 wrote to memory of 412 4952 chrome.exe 107 PID 4952 wrote to memory of 412 4952 chrome.exe 107 PID 4952 wrote to memory of 412 4952 chrome.exe 107 PID 4952 wrote to memory of 412 4952 chrome.exe 107 PID 4952 wrote to memory of 412 4952 chrome.exe 107 PID 4952 wrote to memory of 412 4952 chrome.exe 107 PID 4952 wrote to memory of 412 4952 chrome.exe 107 PID 4952 wrote to memory of 412 4952 chrome.exe 107 PID 4952 wrote to memory of 412 4952 chrome.exe 107 PID 4952 wrote to memory of 412 4952 chrome.exe 107 PID 4952 wrote to memory of 412 4952 chrome.exe 107 PID 4952 wrote to memory of 412 4952 chrome.exe 107 PID 4952 wrote to memory of 412 4952 chrome.exe 107 PID 4952 wrote to memory of 412 4952 chrome.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\Rainmeter-4.5.18.exe"C:\Users\Admin\AppData\Local\Temp\Rainmeter-4.5.18.exe"1⤵
- Drops startup file
- Checks computer location settings
- Drops file in Program Files directory
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Program Files\Rainmeter\Rainmeter.exe"C:\Program Files\Rainmeter\Rainmeter.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1256
-
-
C:\Program Files\Rainmeter\Rainmeter.exe"C:\Program Files\Rainmeter\Rainmeter.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5108
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc2228ab58,0x7ffc2228ab68,0x7ffc2228ab782⤵PID:1576
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1620 --field-trial-handle=1804,i,4778106606438005466,12246136776791223168,131072 /prefetch:22⤵PID:2400
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1864 --field-trial-handle=1804,i,4778106606438005466,12246136776791223168,131072 /prefetch:82⤵PID:656
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2124 --field-trial-handle=1804,i,4778106606438005466,12246136776791223168,131072 /prefetch:82⤵PID:412
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3088 --field-trial-handle=1804,i,4778106606438005466,12246136776791223168,131072 /prefetch:12⤵PID:380
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3108 --field-trial-handle=1804,i,4778106606438005466,12246136776791223168,131072 /prefetch:12⤵PID:3848
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4360 --field-trial-handle=1804,i,4778106606438005466,12246136776791223168,131072 /prefetch:12⤵PID:3248
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4524 --field-trial-handle=1804,i,4778106606438005466,12246136776791223168,131072 /prefetch:82⤵PID:1604
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3972 --field-trial-handle=1804,i,4778106606438005466,12246136776791223168,131072 /prefetch:82⤵PID:5084
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5008 --field-trial-handle=1804,i,4778106606438005466,12246136776791223168,131072 /prefetch:82⤵PID:4160
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe" --reenable-autoupdates --system-level2⤵PID:3668
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x254,0x258,0x25c,0x230,0x260,0x7ff6da51ae48,0x7ff6da51ae58,0x7ff6da51ae683⤵PID:532
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4648 --field-trial-handle=1804,i,4778106606438005466,12246136776791223168,131072 /prefetch:82⤵PID:3688
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4688 --field-trial-handle=1804,i,4778106606438005466,12246136776791223168,131072 /prefetch:82⤵PID:1748
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5004 --field-trial-handle=1804,i,4778106606438005466,12246136776791223168,131072 /prefetch:12⤵PID:4884
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3536 --field-trial-handle=1804,i,4778106606438005466,12246136776791223168,131072 /prefetch:12⤵PID:1532
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=3396 --field-trial-handle=1804,i,4778106606438005466,12246136776791223168,131072 /prefetch:12⤵PID:4116
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=2740 --field-trial-handle=1804,i,4778106606438005466,12246136776791223168,131072 /prefetch:12⤵PID:1752
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=4656 --field-trial-handle=1804,i,4778106606438005466,12246136776791223168,131072 /prefetch:12⤵PID:2276
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=3316 --field-trial-handle=1804,i,4778106606438005466,12246136776791223168,131072 /prefetch:12⤵PID:2368
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=4816 --field-trial-handle=1804,i,4778106606438005466,12246136776791223168,131072 /prefetch:12⤵PID:3192
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=4320 --field-trial-handle=1804,i,4778106606438005466,12246136776791223168,131072 /prefetch:12⤵PID:4488
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=3512 --field-trial-handle=1804,i,4778106606438005466,12246136776791223168,131072 /prefetch:12⤵PID:1364
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=4676 --field-trial-handle=1804,i,4778106606438005466,12246136776791223168,131072 /prefetch:12⤵PID:1524
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4276 --field-trial-handle=1804,i,4778106606438005466,12246136776791223168,131072 /prefetch:82⤵PID:2540
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=2352 --field-trial-handle=1804,i,4778106606438005466,12246136776791223168,131072 /prefetch:12⤵PID:4980
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=3488 --field-trial-handle=1804,i,4778106606438005466,12246136776791223168,131072 /prefetch:12⤵PID:3832
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=3088 --field-trial-handle=1804,i,4778106606438005466,12246136776791223168,131072 /prefetch:12⤵PID:2060
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=872 --field-trial-handle=1804,i,4778106606438005466,12246136776791223168,131072 /prefetch:12⤵PID:4160
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --mojo-platform-channel-handle=4504 --field-trial-handle=1804,i,4778106606438005466,12246136776791223168,131072 /prefetch:12⤵PID:2712
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --mojo-platform-channel-handle=5112 --field-trial-handle=1804,i,4778106606438005466,12246136776791223168,131072 /prefetch:12⤵PID:336
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --mojo-platform-channel-handle=4708 --field-trial-handle=1804,i,4778106606438005466,12246136776791223168,131072 /prefetch:12⤵PID:3168
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --mojo-platform-channel-handle=4760 --field-trial-handle=1804,i,4778106606438005466,12246136776791223168,131072 /prefetch:12⤵PID:4836
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --mojo-platform-channel-handle=4512 --field-trial-handle=1804,i,4778106606438005466,12246136776791223168,131072 /prefetch:12⤵PID:4660
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --mojo-platform-channel-handle=4800 --field-trial-handle=1804,i,4778106606438005466,12246136776791223168,131072 /prefetch:12⤵PID:1588
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --mojo-platform-channel-handle=2148 --field-trial-handle=1804,i,4778106606438005466,12246136776791223168,131072 /prefetch:12⤵PID:3716
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5444 --field-trial-handle=1804,i,4778106606438005466,12246136776791223168,131072 /prefetch:82⤵PID:2536
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5540 --field-trial-handle=1804,i,4778106606438005466,12246136776791223168,131072 /prefetch:82⤵PID:1656
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --mojo-platform-channel-handle=4688 --field-trial-handle=1804,i,4778106606438005466,12246136776791223168,131072 /prefetch:12⤵PID:4876
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --mojo-platform-channel-handle=5364 --field-trial-handle=1804,i,4778106606438005466,12246136776791223168,131072 /prefetch:12⤵PID:4328
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --mojo-platform-channel-handle=3388 --field-trial-handle=1804,i,4778106606438005466,12246136776791223168,131072 /prefetch:12⤵PID:1364
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4004 --field-trial-handle=1804,i,4778106606438005466,12246136776791223168,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3788
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4004 --field-trial-handle=1804,i,4778106606438005466,12246136776791223168,131072 /prefetch:82⤵PID:624
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3448 --field-trial-handle=1804,i,4778106606438005466,12246136776791223168,131072 /prefetch:82⤵PID:4860
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4268 --field-trial-handle=1804,i,4778106606438005466,12246136776791223168,131072 /prefetch:82⤵PID:376
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5100 --field-trial-handle=1804,i,4778106606438005466,12246136776791223168,131072 /prefetch:82⤵PID:1752
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5724 --field-trial-handle=1804,i,4778106606438005466,12246136776791223168,131072 /prefetch:82⤵PID:1260
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5176 --field-trial-handle=1804,i,4778106606438005466,12246136776791223168,131072 /prefetch:82⤵PID:696
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5692 --field-trial-handle=1804,i,4778106606438005466,12246136776791223168,131072 /prefetch:82⤵PID:3472
-
-
C:\Users\Admin\Downloads\MEMZ.exe"C:\Users\Admin\Downloads\MEMZ.exe"2⤵PID:4572
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:1364
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:728
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Rainmeter\Defaults\Layouts\illustro default\Rainmeter.ini
- Size 698B
- SHA256 97030b68fafaee7bb69eacb3c737ba0ca0d75b70e805166494b34fc589f1b7d9
- MD5 7ed3f1a420c2ba65345af28455a754da
- SHA1 798075c46eded535f7a3191b38c5c6128dbfb4af
- SHA512 fd3c12386c671089f7f7ac23450318c64cf69eae908fafcbc264c9d7f842482efdb5667f18c0cd7bd015715d06e43260c394a5ebc9639526eae504614e89aba5
- MD5 SHA1 SHA512
- Path C:\Program Files\Rainmeter\Defaults\Skins\illustro\@Resources\Background.png
- Size 1KB
- SHA256 ae72127580a6401f4b3cba621267fcb4d13f0547b7ea00d2748a3a3892cb54de
- MD5 751ae72195e782cf91732d0e89138582
- SHA1 13a3f32b1b34b61a8ea51efb9098ffc82925dd5d
- SHA512 00f821d05e77e5a8bd9cfcb7ac3f963a9dc826521aa9192801d8ea38d085651f3cccc4ab306b58d6310d5445b36645849a4df9adbf6befedf17a785e95424ab4
- MD5 SHA1 SHA512
- Path C:\Program Files\Rainmeter\Defaults\Skins\illustro\Clock\Clock.ini
- Size 2KB
- SHA256 45b2d5644208a29e7e90cc74e130c0fb77c35099e9dbd17ffc010080a3ef1d8d
- MD5 a23de9c5c90b698420fc8b3517f36598
- SHA1 8f872f02bdd7be04d340c4f1d0a97f795cd66f6e
- SHA512 c8030bfbde83fab6ebaeef2a080b55cfa463ece91732e79b0c11ff204bf86715095fe128cbbf76d4cc4029880ec97ba6a7b6f14561bdecf790d3d4359e74176a
- MD5 SHA1 SHA512
- Path C:\Program Files\Rainmeter\Defaults\Skins\illustro\Disk\1 Disk.ini
- Size 3KB
- SHA256 1e243b7ec358bc79d65da9d5446758cfd567847cf7fea6ce128f4947d04d7346
- MD5 bd443770cbb26712f476fa3d41ab812c
- SHA1 12aa90188125460708af5fa135cff7f1985c6408
- SHA512 48e1efcd309d9ea9e780ca7873a2996ee3cbd7bacc6f30b6f017df7c76392d34ca3dd847e5d2b4e36bb340ba8e9a8f095efa8a5e0fc5c11b4f73586356cf625c
- MD5 SHA1 SHA512
- Path C:\Program Files\Rainmeter\Defaults\Skins\illustro\Disk\2 Disks.ini
- Size 5KB
- SHA256 3106efa019016e9d84d0ee4e484f45ffc4311617d3ef3ddce74393a6e41952f0
- MD5 7215e77b41579b66126d8d010ab6894a
- SHA1 47462528453382376fab2ee6985fe6347ffbfc6a
- SHA512 b9abb0081838cde464b6047af7f8f6ca983a33c37e32dbd0e43c64e943389051b5daf195e7843dece36dd295bbb6a05be7dec27af810ebb49c31e164b7ce2469
- SSDEEP 96:AobdFNk+M2UXmv4tmTyhm1cOW457PLGOhLJphLJ0vcOAd/SmGmD3:3pnk+NUXmvAmehGc345fN5mvoj3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Rainmeter\Defaults\Skins\illustro\Google\Google.ini
- Size 2KB
- SHA256 d5088ede9c2366864572a95cbc87afddd3dbe0adc9d890b640646acd1dd401c2
- MD5 f04f5cd3c064a53966592193b7fe372e
- SHA1 5a88c6723efae9fa3f684c3fbcd48079fcda3ea5
- SHA512 f4ce218c7828bcd9ddc53b2781a7aa21bc151671d373c884dddccaa3d9c74cb93d9f3ea0b5649ea6d5f6f75da2e8fe36fd875c7ccb90b7cb2b6368a425cdf96b
- MD5 SHA1 SHA512
- Path C:\Program Files\Rainmeter\Defaults\Skins\illustro\Network\Network.ini
- Size 4KB
- SHA256 5d19b527cec19026ccaf130cf54dbf5716c2877d08076a57658c37ded698e803
- MD5 af773a3edb7ab7dea85efd07894d672f
- SHA1 218d83135747d9600c00bce410098e202f3999f4
- SHA512 9cf52adb75bceee2ec6990498807830eaada7c3e44a03c06a06b384271bdac5b42c595bfc6698a5df557fec38842755cc54f62a77b40474a02ad9a3f32dc362b
- SSDEEP 96:Aoblhq7BMGLinXXPLGOhLJphLJOwWcOAdZm3:3Rhq7EXDN5cwWH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Rainmeter\Defaults\Skins\illustro\Recycle Bin\Recycle Bin.ini
- Size 3KB
- SHA256 0ff9e0d8cf8d2a902e9fcda78857ead00b3378815c2f342b1e1b5cd7eea39a10
- MD5 0a1fe3462f5f9e3599d5bb33b157f74a
- SHA1 cfdc3dcf0fc6683fb2bb7a491be83999a6442640
- SHA512 978fb567f717fa4853c2cf22bbab987ea1354eed0c762877d53183227847c504cdbb39f0850a829e5fddbfeded2599b65e73df8b8401ced106bd6eb23e6d5ef4
- MD5 SHA1 SHA512
- Path C:\Program Files\Rainmeter\Defaults\Skins\illustro\System\System.ini
- Size 4KB
- SHA256 a2298019b2774ef5f7fa1d22d08738f36e7749ea125bf441a6b8bad23b960826
- MD5 e7c252045282bcc9b1e5675865d8408c
- SHA1 2d035d8c608afd1cdcbaa931b1a170de06e60910
- SHA512 8444337335973db2a6578d49332ccbe5b2e151aac8428b9f6da92f184af91c782a4b6e15164162db85dedcaca3524804ef31a2da90a359e88af9e609f3ef01c5
- SSDEEP 96:Aoblh0/ClMYPLGOhLJphLJ04cOcdr97Omsn:3Rh0/ClM+N5m4Kron
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Rainmeter\Defaults\Skins\illustro\Welcome\Background.png
- Size 1KB
- SHA256 3aea0caa797e487abb0901648773251ca52f14b680a960baee080f263d2dd9ec
- MD5 27c60fa5b6e8c9545c885f108f501a36
- SHA1 58439914234e29a6e8973328dae945ec2fc569ce
- SHA512 26f6a7057f31aab9b88ed5fd779e83e82d32205eb568c46f4fbe93a79182e1f09e00a06d842fea180c2ee469510ad08e26fb8cd08228e3ad6f037802b2b965d1
- MD5 SHA1 SHA512
- Path C:\Program Files\Rainmeter\Defaults\Skins\illustro\Welcome\Welcome.ini
- Size 3KB
- SHA256 6b710c75c1bfc4046ce0bdcde3c4f920aaefe1ecd4fa186d3bdfee12af897707
- MD5 9fd985ded033fa0fcc86c222e8e4370d
- SHA1 83615886c788f272078fbbe02e1f8af87ca1ef4e
- SHA512 4165e953773328557f42f1f8a29f0b566bcd5c347b8d5e9586ba09f2a4283a64e6f0ae6aa0ea0ba2b6ae8b0598ca4fed7e6878969eed371a1e6fe6dd23695c3c
- MD5 SHA1 SHA512
- Path C:\Program Files\Rainmeter\Languages\1033.dll
- Size 13KB
- SHA256 62dab5892dde4b2cb899273fb205c1770fc2fabca282e51b65e5fa60218cab6b
- MD5 2ef22e0172e13db7c128c0155bf10b00
- SHA1 a81ae49635bff063048cb4c1fa6962da553a57f8
- SHA512 c09c4acffdfd5dc0ef6704f3b337a4865cc9932f12b142113a1b5dd403bf1d952b9bff793a2fe368f26c0bf2626e0c1766252e0b86170f9f8c22221fc6750d86
- SSDEEP 192:A96bPM8wV4F+JOQMes7ZCl7LVm4fxX4/mVVK0nWKy8Sy4B1DLTqf0F1L8HeHdHPa:A9e64EgDgl728VbkuHeHdHIM+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Rainmeter\Rainmeter.dll
- Size 2.6MB
- SHA256 de168bd99a3581139456d86f0cd2dc30561ea95fedd6185c1f1e517bc42e38a7
- MD5 0afb12e3671b0da30df98ec58b43b0a9
- SHA1 8fcce8e8ee9ca49956ec6099125affae23ae902a
- SHA512 301c62f870d29c1787a28f252c6ec936e08b097ced9e3c164bc6e02bf3009e6db5853c0a7c879329fd7beb941272327ffd091e11d6c2915633cc4084e7c895de
- SSDEEP 49152:+LTTg4xNUOkckk/FYGNsiK28WPkPhdxzFK/7jfP:Gg4rUO9kOFBWPhvxK/7jP
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Rainmeter\Rainmeter.exe
- Size 464KB
- SHA256 4bfa907726195157705978372217cee1c99e12493b093aafe30fc31aede16ceb
- MD5 cfebe658f8284913b48c5163cfbbce33
- SHA1 43759d3ba4d1cfbb3433a154bdc6e772343d7298
- SHA512 26086ed53744f015f5f45d4f04cb908a6ca1f114079c1aefce740c0255a9fb321871c54aebe34561dccb7c0eb44d350b5a79514ade1f5ef3f47456df8975bf25
- SSDEEP 1536:RnqQVCSl4ckovg4BmO2PHAmxbd3RHs6MNgu1Bec2seiP:FzVJlmoTmO2vBp4NgseZD6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\0519f3c0-202a-499b-9afa-934ada232c39.tmp
- Size 8KB
- SHA256 47dd1929bd7830e12ef364f41799ada021e62bcd0128ad8948d88b9c5817d25e
- MD5 daa4d934c1c2d3f43339736409df0433
- SHA1 f7f21ddc7598d30f81a52a3b2938da89e6c35479
- SHA512 0e73f964de304523f7667254b631c45c964976fc6dbe1259e2d2e619b0afa7ed6024b2ead556ac0eaf852d6a8343d71109fd3e755816af8774103e252d71c8e0
- SSDEEP 192:XWc2kJHp+uimYaJZC8oyh+F7Kcw9bdamP5tjEsXtScR:XWcHpLtZZEyq21daitIsXtScR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000008
- Size 202KB
- SHA256 9462da5aa6e2a762b02a24b7305bac86349e5b5ea182d36fd6a163de550cde60
- MD5 6a16cbefd2e29c459297b7ccc8d366ad
- SHA1 40da0213a9e5ea4cb6948f4a8e92b5e8b97e6cfe
- SHA512 6a9de0231f9987554a20208a89c6c802d28c57ecb6f9e95771c94156b65c61ac1e18298ce6d3f0559d3a08052845cc2014dab335e119fde731d745e4857b7d74
- SSDEEP 6144:MpsBLK1nTbtBiyzVDKt/evvpW7+wub6zB2FA:RBLunTJZzhvvprUV2S
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 1KB
- SHA256 7eace4c5fd125ca2c940bfc78a9d843ca0d3e5aba30bf4f7dce8b5740eec41eb
- MD5 e8f3759de29e397b1e9678a701b34dc3
- SHA1 c29207e334260c089d341aeb3b0a018aa08b0fc0
- SHA512 4a2a0debe19ba9b24883067c3ab1d893b0de3fd5dde8a399fc095f143393b6f511c33a119bb751b596d6cd31b4c0b834cc480681c2c5133a139f5e0a6c7dbd85
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 3KB
- SHA256 0bbc58ff9f8dc3ce4b1a79ae1dc0a0bacc6fd12b34cb1e320e456a86ede8a3cc
- MD5 3d8003e0e2c81469a1f2aa4fbf02e182
- SHA1 33164446df0b57d5f3808d03a93e7f8c7e5584c3
- SHA512 9f99035df7ef484abe567af13faf0c196301b5c115f48503c843b058e298ff81b59439bd0b2f250fdf5dba7e4786b2cc58d5160dbd1ae6c32bb0e427d419458c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 354B
- SHA256 ba3e20cc17e3a7ead9452fe46a9d9751775b14cdbc6e1638a0803c70235732d5
- MD5 944154ab796c1d5c72909d9e43ddd886
- SHA1 acf3c4610453d9148d6a882923eb03d9b776916f
- SHA512 936e4384518dd61a6b83a04aa9e697afba7fc405cc9bf57a08cde80067fd85e94465683e9bc88929795f1f4b43d9222d9d24d82377dc29ecb768cddfaf563a66
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 690B
- SHA256 98e68d4b3b14e30cbc7797c9fdcba926fb9b99a3952be608971b195e16590e87
- MD5 c9313240161c8ac7ad03249dfd0f5120
- SHA1 e6bbd601a0ed49c2195251dd04fd1329f425bf68
- SHA512 2213a7dbf6ac4b4340e17b72c6ee5ae2ca82dd58daac814cd78af970a9c056036b7ab086efa8ff9f77fb8843a5f398203126991aef2e9e7f11ada6c407656e19
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 1KB
- SHA256 8811091d5979b65531635f6797a58300a72d869f1640d4b14d22157aa93fd1f7
- MD5 4a98da2077e6825be31df39350dea42b
- SHA1 28283e761ec68bbd0ebbd398620d89693048ab3c
- SHA512 f58dee82b966d8c9ece7cd56cab9026434a92e94ef33dbacb1f61d6ad81c7d0d771324badb941d810f9088cce52579f01f656ed8cf659ee40160c7784dacc092
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 690B
- SHA256 bfd3b47b849d6ccb8e05cce5561ed20b608e0df9461583e3b3b113b646155f0f
- MD5 2641254220c87422bbd21d691a0b6d76
- SHA1 4201de3704c60ad9a72239917cfd13dd65d35a94
- SHA512 c422e042be6396e1828920670f53680e1de82408173d3294e3a34ca925332043a1317ac3d3e28a11b55a29f321db330eaa5d94b2f22ba0d3f688362fd3c141d8
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 7KB
- SHA256 d30dec2e5082c67b7d22ef9b0868ab8ca0aabee434847ed156c571e94dac0c89
- MD5 7469505712af4a19d78f0bdaca6b5d05
- SHA1 b042172ad5cdbdd89382e58673a62eb35593dc3e
- SHA512 4fd8d4f61a22cf21da1137cd7aa9b9141e8fcd2809af26f35f8f662568e75ab82d5a4a4748e13439b95a3fa5884b7010ef60eebe529a1168b89e87c511932f1f
- SSDEEP 192:XWc2kJHp+uimYaJZC8pyh+F/w9bnZamP5tjEsXtScR:XWcHpLtZZdyqCZaitIsXtScR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 7KB
- SHA256 95e2ae216aaa613eb8aa037d1aef6b0131965f73d863affc2810dd6f0c0e64d6
- MD5 92d4e99646d1db49adac70329d55373c
- SHA1 6f92c251274100877c6da0fe958b883bda823a38
- SHA512 3e6f6c20996fbe5e5debc9968ae0346545477dadb32949a8d49ce0cf9b7200ac654a6197407639f8c5bf97992098d72e78eea997ff435cdbe13b46137d8587e0
- SSDEEP 192:Xup+uimYaJZC8syh+FYw9bnZamP5tjEsXtScR:XupLtZZ4yqJZaitIsXtScR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 8KB
- SHA256 b7dc6483e5a78164f6490a9fa4b58335eadb440e7dec8c0d62a66d886a2219f0
- MD5 712739eb2047944fef69bae67cc8e787
- SHA1 4580156e15c8584c869f62558c45d38ee97284c1
- SHA512 13ed774fb3ebf38319cfc9e7f2d2735ac0615391b47de99bc34aa23331c4f7565e9b13f3925399fff701b6af34a6124b2384c1b1449205db1eda80e9a1aa3fe5
- SSDEEP 192:KdWc2kJHp+uimYaJZC8yyh+FGwJ6vamP5tjEsXtScR:IWcHpLtZZWyqFEvaitIsXtScR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 8KB
- SHA256 1c4aba5985f2142a6094fdf0abc06148326e0272204702502d5204acbaee2ddd
- MD5 9368a699c22542b747062e5b923d5738
- SHA1 6b67f7eeb2a7150409812dc6dba57a82a97dc683
- SHA512 10da9bf246ad5f2b48a6f34f15e108848fa04423c6f5beb741a276b56fedacc93ab7b7d2b28b285ad6ff00d481bfc028f3bece587d12c059a4a3208af8241903
- SSDEEP 192:KdWc2kJHp+uimYaJZC8yyh+F7wJ6vamP5tjEsXtScR:IWcHpLtZZWyqUEvaitIsXtScR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 7KB
- SHA256 f5e5cf0ee0bb164f8e6b2be31c9af73a01aa6089df4e0adafc44b060b0be1b7a
- MD5 4d7b169380406a6e702ee1c9f5c04eb1
- SHA1 bd7fbed03f8f3ac742fbd7321656bdaa4b948cec
- SHA512 cd947ce895b690c8d25155d9dde292fc7956d19c2281939c020f5d89ea080807c23b5857d8c33268124a751b77c500faa97af3da6beae2415e4313d9ae01680b
- SSDEEP 192:Xup+uimYaJZC8syh+Fjp+amP5tjEsXtScR:XupLtZZ4yqN+aitIsXtScR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 16KB
- SHA256 50ed4adfaf6f4977b00b0c775940d220d8a71efd96f83bd9a14d818cd563e70c
- MD5 d017e0a2686c4726e88c0db1dc844af6
- SHA1 ae521e52271ec44e87ad8d2620897ea10ded47dc
- SHA512 13baeec806d8ca152f1ee48154abe34835b4708340c77052c55989594642ed2f20756a79a015859ad8e6ab88dcdf677db6af28fc2d0f40fd42893ac7ee3f29c3
- SSDEEP 384:Kqoy7pLhLcEvh7Xb11kXqKf/pUZNCgVLH2Hf9irrUiCHGMcMM2Y:Kzy7pLhLZJjb11kXqKf/pUZNCgVLH2HW
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
- Size 56B
- SHA256 c58cb79fa4a9ade48ed821dd9f98957b0adfda7c2d267e3d07951c2d371aa968
- MD5 94275bde03760c160b707ba8806ef545
- SHA1 aad8d87b0796de7baca00ab000b2b12a26427859
- SHA512 2aabd49bc9f0ed3a5c690773f48a92dbbbd60264090a0db2fe0f166f8c20c767a74d1e1d7cc6a46c34cfbd1587ddb565e791d494cd0d2ca375ab8cc11cd8f930
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe5a76d7.TMP
- Size 120B
- SHA256 dc5a18dc67a3a371b89e3da3baacf2b4bb84d9ef9a7c48d4d22e2b4ac59b5309
- MD5 1e0201735091444b102a8c10e05b12d0
- SHA1 2a98ece489574b816318ceefc0e89b92377fc959
- SHA512 2792cb87457f15afdc6fa3997e0c16d791369b81313d6c5a512568fd15a92e4016538715933b19498971787b6578fc1c39cb9cc196a5d985167c5bd5768f86d1
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 264KB
- SHA256 9aab00bae5fdd236c88aa4c1305d7b1d4e094dd6b8c5046a68634033bc6ec1b1
- MD5 8ec05c0e3abec7b7b5cfabffc1545e23
- SHA1 93e0ecc2286e8f40fd2a4ffc9fac3d8f795ddafe
- SHA512 4011e7e3b173c83796e6ad7f2f3fbbf6a44e67a614e2607e1e8dcaa4dbe4eca86ee77b82839378ffe678bde43d67348f7cf7d72bbde55bcc507406deb17a8b36
- SSDEEP 6144:Z4WRqFy+7MkX+Ktg0niOyNLzvevF9te35nfC5mgMatp9:SDFhMu+KIzWvFu35tgMyp9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 264KB
- SHA256 a21b3950fbe3b78abe94cb55389d05b19e73aea58d3d1bcd04508e5564171f6b
- MD5 767bb1683f76c6f9c599eaed9f955542
- SHA1 93635cef605094a59952c5e5bb91824ae5b7c409
- SHA512 436d5c338884e4c446503b992534f77599d8228156a94685565964e9e90e8bda3e8f44046a442335fefaa5bc2d73364b57151c2b78f9be06b0b8d5a6027ad05e
- SSDEEP 6144:Z4WRqFy+7MkX+Ktg0niOyNLzvevF9te35nfC5mgMatp9:SDFhMu+KIzWvFu35tgMyp9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 264KB
- SHA256 648de7511c8c640ffc1db1d773571013310be4a9d65963361c54d95c114bddc5
- MD5 a2b60fb08bc0a48d8b5114ef335accb5
- SHA1 c0548bdd3075c25654852107109f1735f6d44815
- SHA512 e21e76a5551795b3e48aaed7cee9412e6f30e746954425b3b80988add1335504eeabd96855b7aa6b3a354cf554d87495063458e3d832d1442bbc1916b57d3c93
- SSDEEP 6144:24WRqFy+7MkX+Ktg0niOyNLzvevF9te35nfC5mgMatp9:XDFhMu+KIzWvFu35tgMyp9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 264KB
- SHA256 960c77ede76abd0175d83127793eb3fd83e895081dc3ab869ea698955b10c2a2
- MD5 5b60d1e5b801a6fdef5b14ee94520fd0
- SHA1 801e80e3bfec26e37bfc7c3c6e52af7b10e2e596
- SHA512 a367553de33fee964339a73bd6f5855c2437f8b014ecc0f8310ef827a35fb0264cdce5b67a254013fd5e9a0331a2267eee6b760df21c1aed2af5d7f6c82d7abe
- SSDEEP 6144:A4WRqFy+7MkX+Ktg0niOyNLzvevF9te35nfC5mgMatp9:ZDFhMu+KIzWvFu35tgMyp9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
- Size 91KB
- SHA256 9306787085d412e8244c52deadaedc06bdabeb6697f9f4e80fe6e0246ebc24ee
- MD5 0ec799d5f15ac04150bf9f18e10f07a7
- SHA1 e0d0ed33f603367835d97c305e0c83178f02ae97
- SHA512 356eaf13a737abe66855a1b02d92f52635d0c244ac6719b89d81ec9f2eb8c31eae580653ac67c65a309a1ec81d92c8dc47a7b7e80952c9276acc6e8b1261610e
- SSDEEP 384:Ffc1xEQz9DVfhUP8gmgdHHRYp1dI69ETEY+PgrfVnVM482b4jruLPVC678HrzzEk:KiQ4+tKiQ/av6JfS6K46p/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe59b5aa.TMP
- Size 89KB
- SHA256 0a6fc54e1229f75249a28125c3cb5eac2c817cd51ac658f1e450d228285b40ec
- MD5 fa33ffb10f73111d93bbfc63845422c9
- SHA1 4dc04f2357928c973b04d5174b90cd5a0e235297
- SHA512 b38e47c17193c3af70901619fd6273f9deab8cb3cb8a6811f75e847bd7ddda4e7be230a74d53b285229a9ccba7f47922ea55a371a44a41e52048d7ea41e30861
- SSDEEP 384:vfc1xEQz9DVfhG8gmgdHHRYp1dI69ETEY+PgrfVnm82b4jruLPVC6tHrzzEsXvNi:AiQm+tRQ/zv6JfS6K46pZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsa53FE.tmp\LangDLL.dll
- Size 5KB
- SHA256 18e8b40ba22c7a1687bd16e8d585380bc2773fff5002d7d67e9485fcc0c51026
- MD5 68b287f4067ba013e34a1339afdb1ea8
- SHA1 45ad585b3cc8e5a6af7b68f5d8269c97992130b3
- SHA512 06c38bbb07fb55256f3cdc24e77b3c8f3214f25bfd140b521a39d167113bf307a7e8d24e445d510bc5e4e41d33c9173bb14e3f2a38bc29a0e3d08c1f0dca4bdb
- SSDEEP 48:S46+/nTKYKxbWsptIpBtWZ0iV8jAWiAJCvxft2O2B8mFofjLl:zFuPbOBtWZBV8jAWiAJCdv2Cm0L
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsa53FE.tmp\System.dll
- Size 12KB
- SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
- MD5 cff85c549d536f651d4fb8387f1976f2
- SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
- SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
- SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsa53FE.tmp\UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsa53FE.tmp\nsDialogs.dll
- Size 9KB
- SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
- MD5 6c3f8c94d0727894d706940a8a980543
- SHA1 0d1bcad901be377f38d579aafc0c41c0ef8dcefd
- SHA512 2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
- SSDEEP 96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Rainmeter\Rainmeter.ini
- Size 828B
- SHA256 ba4107f9844b0d4053f48a8a1273774e5a634e3161aa71b5d66d497e05594ffc
- MD5 b01e0c5e180ed70626c4456d9a70a526
- SHA1 e0ea07166ac47587cc02011cb792b49458470d6e
- SHA512 4affce4002b0d8ea30036f009d6d2a661cf94558a9b2023157258c4d98dde047388dbe90701f8a4a9f29fe269653e851bd24caa3eeccdf6cba28fe341a3c3102
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Rainmeter\Rainmeter.ini
- Size 876B
- SHA256 d6738c0e6c7e1c73633f569893853b9f94ae5bc6b9b2802dd20bc6ad5072ff39
- MD5 156f060548e6303d9397d0a5e4b6fcd1
- SHA1 f91b36f54195fa40952b7190ef50e87b21f3a01b
- SHA512 e75e89cdc9bd845ec586abc51ad82e47f10798df0219ada7cb487e6a5d6f99dfc7b924eba730c23c7b6d604c2e5a1193eb0d658f99a17cd79054d86ea19ae593
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Rainmeter\Rainmeter.stats
- Size 14B
- SHA256 bbaed1225b640899c768cc23df0e7a356a779f832ac0e2ec91758099a71e467e
- MD5 8d8fdd288384b581a21484457ac95147
- SHA1 d21a34cdf8bb5fa22e4b16ea3918b1a1840c6fe2
- SHA512 b94873859a926d50ee5c86e0cb157b248da2fdcca8c28afb1da2fdc75475b8bfd756c14d07d1233fa53eed79822a3684131c3dc6746f622ddcf0e46ebdb1b592
- MD5 SHA1 SHA512
- Path C:\Users\Admin\Downloads\6c13dff1-123f-4802-af0d-d949de4a57d1.tmp
- Size 11KB
- SHA256 a4de5e8127fd600d77bc3463fd501693abb59490ae585811be196269c9d80963
- MD5 25afcf36b7f5aba6e436d7db60f15829
- SHA1 c61b46c34c57d4b250de09467376f3ec819d70ea
- SHA512 156d5acabd891fc00ce28c272e576d13b95603317821422173aae88e778a11c6128bcd47cacaba2c564302ca5c70f420ba12f1b39acf7a888477fa21aac7d4b7
- SSDEEP 192:yHyG4awdQjOw9C9kx1vEL9DkNII0wKLPDjR8SvWZ3cCgHDn9qCqaRana17YTTYnf:0yGZ9C2ILLI0TjDjR43c/T9qCqjae4nf
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\Downloads\MEMZ.exe
- Size 16KB
- SHA256 3872c12d31fc9825e8661ac01ecee2572460677afbc7093f920a8436a42e28ff
- MD5 1d5ad9c8d3fee874d0feb8bfac220a11
- SHA1 ca6d3f7e6c784155f664a9179ca64e4034df9595
- SHA512 c8246f4137416be33b6d1ac89f2428b7c44d9376ac8489a9fbf65ef128a6c53fb50479e1e400c8e201c8611992ab1d6c1bd3d6cece89013edb4d35cdd22305b1
- SSDEEP 192:M2WgyvSW8gRc6olcIEiwqZKBkDFR43xWTM3LHf26gFrcx3sNq:JWgnSmFlcIqq3agmLH+6gF23sN
- MD5 SHA1 SHA512 SSDEEP