Resubmissions
05-09-2024 21:46
240905-1m1k4szfrr 705-09-2024 21:44
240905-1lx4la1cmg 505-09-2024 21:25
240905-z9yvcszblr 605-09-2024 21:14
240905-z3jf4azflb 1005-09-2024 21:12
240905-z2kmrszfka 3Analysis
-
max time kernel
438s -
max time network
542s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05-09-2024 21:14
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://chromewebstore.google.com/detail/roblox-for-free/hchahigddjfnomcffodpdldcelbdokca
Resource
win10v2004-20240802-en
General
-
Target
https://chromewebstore.google.com/detail/roblox-for-free/hchahigddjfnomcffodpdldcelbdokca
Malware Config
Extracted
revengerat
Guest
0.tcp.ngrok.io:19521
RV_MUTEX
Extracted
crimsonrat
185.136.161.124
Signatures
-
CrimsonRAT main payload 1 IoCs
resource yara_rule behavioral1/files/0x0007000000023767-1536.dat family_crimsonrat -
CrimsonRat
Crimson RAT is a malware linked to a Pakistani-linked threat actor.
-
RevengeRAT
Remote-access trojan with a wide range of capabilities.
-
RevengeRat Executable 1 IoCs
resource yara_rule behavioral1/files/0x000e00000002373f-1355.dat revengerat -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe RegSvcs.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe RegSvcs.exe -
Executes dropped EXE 4 IoCs
pid Process 3980 svchost.exe 1844 svchost.exe 5980 dlrarhsiva.exe 5556 svchost.exe -
resource yara_rule behavioral1/memory/5368-1605-0x0000000000DE0000-0x000000000141D000-memory.dmp upx behavioral1/memory/3888-1606-0x0000000000F70000-0x000000000110C000-memory.dmp upx behavioral1/memory/3888-1607-0x0000000000F70000-0x000000000110C000-memory.dmp upx behavioral1/memory/3888-1608-0x0000000000F70000-0x000000000110C000-memory.dmp upx behavioral1/memory/696-1609-0x0000000001200000-0x00000000012F4000-memory.dmp upx behavioral1/memory/696-1616-0x0000000001200000-0x00000000012F4000-memory.dmp upx behavioral1/memory/696-1617-0x0000000001200000-0x00000000012F4000-memory.dmp upx behavioral1/memory/3584-1618-0x0000000000FC0000-0x00000000010CC000-memory.dmp upx behavioral1/memory/3584-1619-0x0000000000FC0000-0x00000000010CC000-memory.dmp upx behavioral1/memory/3584-1620-0x0000000000FC0000-0x00000000010CC000-memory.dmp upx behavioral1/memory/5368-1621-0x0000000000DE0000-0x000000000141D000-memory.dmp upx behavioral1/memory/5368-1622-0x0000000000DE0000-0x000000000141D000-memory.dmp upx behavioral1/memory/6120-1623-0x0000000000F00000-0x000000000100C000-memory.dmp upx behavioral1/memory/6120-1624-0x0000000000F00000-0x000000000100C000-memory.dmp upx behavioral1/memory/6120-1625-0x0000000000F00000-0x000000000100C000-memory.dmp upx behavioral1/memory/6132-1635-0x0000000000600000-0x000000000070C000-memory.dmp upx behavioral1/memory/6132-1636-0x0000000000600000-0x000000000070C000-memory.dmp upx behavioral1/memory/6132-1637-0x0000000000600000-0x000000000070C000-memory.dmp upx behavioral1/memory/5368-1638-0x0000000000DE0000-0x000000000141D000-memory.dmp upx behavioral1/memory/4396-1713-0x0000000000B00000-0x0000000000C0C000-memory.dmp upx behavioral1/memory/4396-1714-0x0000000000B00000-0x0000000000C0C000-memory.dmp upx behavioral1/memory/4396-1715-0x0000000000B00000-0x0000000000C0C000-memory.dmp upx behavioral1/memory/5368-1764-0x0000000000DE0000-0x000000000141D000-memory.dmp upx behavioral1/memory/5368-1898-0x0000000000DE0000-0x000000000141D000-memory.dmp upx behavioral1/memory/5368-1939-0x0000000000DE0000-0x000000000141D000-memory.dmp upx behavioral1/memory/5368-2078-0x0000000000DE0000-0x000000000141D000-memory.dmp upx behavioral1/memory/5368-2214-0x0000000000DE0000-0x000000000141D000-memory.dmp upx behavioral1/memory/5368-2218-0x0000000000DE0000-0x000000000141D000-memory.dmp upx behavioral1/memory/5368-2219-0x0000000000DE0000-0x000000000141D000-memory.dmp upx behavioral1/memory/5368-2221-0x0000000000DE0000-0x000000000141D000-memory.dmp upx behavioral1/memory/5368-2222-0x0000000000DE0000-0x000000000141D000-memory.dmp upx -
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\svchost.exe" RegSvcs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\~~CB = "cb.exe" ColorBug.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cmd.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
flow ioc 206 0.tcp.ngrok.io 209 0.tcp.ngrok.io 240 0.tcp.ngrok.io 264 0.tcp.ngrok.io 271 0.tcp.ngrok.io -
AutoIT Executable 18 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/3888-1608-0x0000000000F70000-0x000000000110C000-memory.dmp autoit_exe behavioral1/memory/696-1617-0x0000000001200000-0x00000000012F4000-memory.dmp autoit_exe behavioral1/memory/3584-1620-0x0000000000FC0000-0x00000000010CC000-memory.dmp autoit_exe behavioral1/memory/5368-1621-0x0000000000DE0000-0x000000000141D000-memory.dmp autoit_exe behavioral1/memory/5368-1622-0x0000000000DE0000-0x000000000141D000-memory.dmp autoit_exe behavioral1/memory/6120-1625-0x0000000000F00000-0x000000000100C000-memory.dmp autoit_exe behavioral1/memory/6132-1637-0x0000000000600000-0x000000000070C000-memory.dmp autoit_exe behavioral1/memory/5368-1638-0x0000000000DE0000-0x000000000141D000-memory.dmp autoit_exe behavioral1/memory/4396-1715-0x0000000000B00000-0x0000000000C0C000-memory.dmp autoit_exe behavioral1/memory/5368-1764-0x0000000000DE0000-0x000000000141D000-memory.dmp autoit_exe behavioral1/memory/5368-1898-0x0000000000DE0000-0x000000000141D000-memory.dmp autoit_exe behavioral1/memory/5368-1939-0x0000000000DE0000-0x000000000141D000-memory.dmp autoit_exe behavioral1/memory/5368-2078-0x0000000000DE0000-0x000000000141D000-memory.dmp autoit_exe behavioral1/memory/5368-2214-0x0000000000DE0000-0x000000000141D000-memory.dmp autoit_exe behavioral1/memory/5368-2218-0x0000000000DE0000-0x000000000141D000-memory.dmp autoit_exe behavioral1/memory/5368-2219-0x0000000000DE0000-0x000000000141D000-memory.dmp autoit_exe behavioral1/memory/5368-2221-0x0000000000DE0000-0x000000000141D000-memory.dmp autoit_exe behavioral1/memory/5368-2222-0x0000000000DE0000-0x000000000141D000-memory.dmp autoit_exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF chrome.exe File created \??\c:\windows\system32\driverstore\filerepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF chrome.exe -
Suspicious use of SetThreadContext 13 IoCs
description pid Process procid_target PID 2612 set thread context of 2360 2612 RevengeRAT.exe 156 PID 2360 set thread context of 1056 2360 RegSvcs.exe 157 PID 1804 set thread context of 4840 1804 RevengeRAT.exe 161 PID 4840 set thread context of 2976 4840 RegSvcs.exe 162 PID 3980 set thread context of 6032 3980 svchost.exe 233 PID 6032 set thread context of 5180 6032 RegSvcs.exe 234 PID 1844 set thread context of 2076 1844 svchost.exe 270 PID 2076 set thread context of 3316 2076 RegSvcs.exe 271 PID 5556 set thread context of 4852 5556 svchost.exe 282 PID 4852 set thread context of 4992 4852 RegSvcs.exe 283 PID 5368 set thread context of 3888 5368 VeryFun.exe 286 PID 5368 set thread context of 696 5368 VeryFun.exe 287 PID 5368 set thread context of 3584 5368 VeryFun.exe 289 -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System.ini VeryFun.exe -
Event Triggered Execution: Netsh Helper DLL 1 TTPs 2 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh cmd.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh cmd.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cvtres.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cvtres.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cvtres.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cvtres.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cvtres.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cvtres.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cvtres.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cvtres.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cvtres.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cvtres.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cvtres.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cvtres.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cvtres.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cvtres.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WinNuke.98.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cvtres.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cvtres.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cvtres.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cvtres.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cvtres.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cvtres.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VeryFun.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cvtres.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cvtres.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cvtres.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cvtres.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cvtres.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\CENTRALPROCESSOR\0 RegSvcs.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString RegSvcs.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\CENTRALPROCESSOR\0 RegSvcs.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString RegSvcs.exe -
Enumerates system info in registry 2 TTPs 6 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133700444997036400" chrome.exe -
Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2392887640-1187051047-2909758433-1000\{6187228A-205D-4482-8A23-E11F906D7577} msedge.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings msedge.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings OpenWith.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4172 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4140 chrome.exe 4140 chrome.exe 2336 msedge.exe 2336 msedge.exe 3288 msedge.exe 3288 msedge.exe 6052 identity_helper.exe 6052 identity_helper.exe 5572 msedge.exe 5572 msedge.exe 5952 chrome.exe 5952 chrome.exe 5952 chrome.exe 5952 chrome.exe 3876 msedge.exe 3876 msedge.exe 3876 msedge.exe 3876 msedge.exe 2740 msedge.exe 2740 msedge.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3800 taskmgr.exe -
Suspicious behavior: LoadsDriver 6 IoCs
pid Process 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 660 Process not Found -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs
pid Process 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4140 chrome.exe Token: SeCreatePagefilePrivilege 4140 chrome.exe Token: SeShutdownPrivilege 4140 chrome.exe Token: SeCreatePagefilePrivilege 4140 chrome.exe Token: SeShutdownPrivilege 4140 chrome.exe Token: SeCreatePagefilePrivilege 4140 chrome.exe Token: SeShutdownPrivilege 4140 chrome.exe Token: SeCreatePagefilePrivilege 4140 chrome.exe Token: SeShutdownPrivilege 4140 chrome.exe Token: SeCreatePagefilePrivilege 4140 chrome.exe Token: SeShutdownPrivilege 4140 chrome.exe Token: SeCreatePagefilePrivilege 4140 chrome.exe Token: SeShutdownPrivilege 4140 chrome.exe Token: SeCreatePagefilePrivilege 4140 chrome.exe Token: SeShutdownPrivilege 4140 chrome.exe Token: SeCreatePagefilePrivilege 4140 chrome.exe Token: SeShutdownPrivilege 4140 chrome.exe Token: SeCreatePagefilePrivilege 4140 chrome.exe Token: SeShutdownPrivilege 4140 chrome.exe Token: SeCreatePagefilePrivilege 4140 chrome.exe Token: SeShutdownPrivilege 4140 chrome.exe Token: SeCreatePagefilePrivilege 4140 chrome.exe Token: SeShutdownPrivilege 4140 chrome.exe Token: SeCreatePagefilePrivilege 4140 chrome.exe Token: SeShutdownPrivilege 4140 chrome.exe Token: SeCreatePagefilePrivilege 4140 chrome.exe Token: SeShutdownPrivilege 4140 chrome.exe Token: SeCreatePagefilePrivilege 4140 chrome.exe Token: SeShutdownPrivilege 4140 chrome.exe Token: SeCreatePagefilePrivilege 4140 chrome.exe Token: SeShutdownPrivilege 4140 chrome.exe Token: SeCreatePagefilePrivilege 4140 chrome.exe Token: SeShutdownPrivilege 4140 chrome.exe Token: SeCreatePagefilePrivilege 4140 chrome.exe Token: SeShutdownPrivilege 4140 chrome.exe Token: SeCreatePagefilePrivilege 4140 chrome.exe Token: SeShutdownPrivilege 4140 chrome.exe Token: SeCreatePagefilePrivilege 4140 chrome.exe Token: SeShutdownPrivilege 4140 chrome.exe Token: SeCreatePagefilePrivilege 4140 chrome.exe Token: SeShutdownPrivilege 4140 chrome.exe Token: SeCreatePagefilePrivilege 4140 chrome.exe Token: SeShutdownPrivilege 4140 chrome.exe Token: SeCreatePagefilePrivilege 4140 chrome.exe Token: SeShutdownPrivilege 4140 chrome.exe Token: SeCreatePagefilePrivilege 4140 chrome.exe Token: SeShutdownPrivilege 4140 chrome.exe Token: SeCreatePagefilePrivilege 4140 chrome.exe Token: SeShutdownPrivilege 4140 chrome.exe Token: SeCreatePagefilePrivilege 4140 chrome.exe Token: SeShutdownPrivilege 4140 chrome.exe Token: SeCreatePagefilePrivilege 4140 chrome.exe Token: SeShutdownPrivilege 4140 chrome.exe Token: SeCreatePagefilePrivilege 4140 chrome.exe Token: SeShutdownPrivilege 4140 chrome.exe Token: SeCreatePagefilePrivilege 4140 chrome.exe Token: SeShutdownPrivilege 4140 chrome.exe Token: SeCreatePagefilePrivilege 4140 chrome.exe Token: SeShutdownPrivilege 4140 chrome.exe Token: SeCreatePagefilePrivilege 4140 chrome.exe Token: SeShutdownPrivilege 4140 chrome.exe Token: SeCreatePagefilePrivilege 4140 chrome.exe Token: SeShutdownPrivilege 4140 chrome.exe Token: SeCreatePagefilePrivilege 4140 chrome.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 3288 msedge.exe 3288 msedge.exe 1380 OpenWith.exe 5368 VeryFun.exe 3888 cmd.exe 696 cmd.exe 3584 cmd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4140 wrote to memory of 3996 4140 chrome.exe 83 PID 4140 wrote to memory of 3996 4140 chrome.exe 83 PID 4140 wrote to memory of 4420 4140 chrome.exe 84 PID 4140 wrote to memory of 4420 4140 chrome.exe 84 PID 4140 wrote to memory of 4420 4140 chrome.exe 84 PID 4140 wrote to memory of 4420 4140 chrome.exe 84 PID 4140 wrote to memory of 4420 4140 chrome.exe 84 PID 4140 wrote to memory of 4420 4140 chrome.exe 84 PID 4140 wrote to memory of 4420 4140 chrome.exe 84 PID 4140 wrote to memory of 4420 4140 chrome.exe 84 PID 4140 wrote to memory of 4420 4140 chrome.exe 84 PID 4140 wrote to memory of 4420 4140 chrome.exe 84 PID 4140 wrote to memory of 4420 4140 chrome.exe 84 PID 4140 wrote to memory of 4420 4140 chrome.exe 84 PID 4140 wrote to memory of 4420 4140 chrome.exe 84 PID 4140 wrote to memory of 4420 4140 chrome.exe 84 PID 4140 wrote to memory of 4420 4140 chrome.exe 84 PID 4140 wrote to memory of 4420 4140 chrome.exe 84 PID 4140 wrote to memory of 4420 4140 chrome.exe 84 PID 4140 wrote to memory of 4420 4140 chrome.exe 84 PID 4140 wrote to memory of 4420 4140 chrome.exe 84 PID 4140 wrote to memory of 4420 4140 chrome.exe 84 PID 4140 wrote to memory of 4420 4140 chrome.exe 84 PID 4140 wrote to memory of 4420 4140 chrome.exe 84 PID 4140 wrote to memory of 4420 4140 chrome.exe 84 PID 4140 wrote to memory of 4420 4140 chrome.exe 84 PID 4140 wrote to memory of 4420 4140 chrome.exe 84 PID 4140 wrote to memory of 4420 4140 chrome.exe 84 PID 4140 wrote to memory of 4420 4140 chrome.exe 84 PID 4140 wrote to memory of 4420 4140 chrome.exe 84 PID 4140 wrote to memory of 4420 4140 chrome.exe 84 PID 4140 wrote to memory of 4420 4140 chrome.exe 84 PID 4140 wrote to memory of 4932 4140 chrome.exe 85 PID 4140 wrote to memory of 4932 4140 chrome.exe 85 PID 4140 wrote to memory of 4828 4140 chrome.exe 86 PID 4140 wrote to memory of 4828 4140 chrome.exe 86 PID 4140 wrote to memory of 4828 4140 chrome.exe 86 PID 4140 wrote to memory of 4828 4140 chrome.exe 86 PID 4140 wrote to memory of 4828 4140 chrome.exe 86 PID 4140 wrote to memory of 4828 4140 chrome.exe 86 PID 4140 wrote to memory of 4828 4140 chrome.exe 86 PID 4140 wrote to memory of 4828 4140 chrome.exe 86 PID 4140 wrote to memory of 4828 4140 chrome.exe 86 PID 4140 wrote to memory of 4828 4140 chrome.exe 86 PID 4140 wrote to memory of 4828 4140 chrome.exe 86 PID 4140 wrote to memory of 4828 4140 chrome.exe 86 PID 4140 wrote to memory of 4828 4140 chrome.exe 86 PID 4140 wrote to memory of 4828 4140 chrome.exe 86 PID 4140 wrote to memory of 4828 4140 chrome.exe 86 PID 4140 wrote to memory of 4828 4140 chrome.exe 86 PID 4140 wrote to memory of 4828 4140 chrome.exe 86 PID 4140 wrote to memory of 4828 4140 chrome.exe 86 PID 4140 wrote to memory of 4828 4140 chrome.exe 86 PID 4140 wrote to memory of 4828 4140 chrome.exe 86 PID 4140 wrote to memory of 4828 4140 chrome.exe 86 PID 4140 wrote to memory of 4828 4140 chrome.exe 86 PID 4140 wrote to memory of 4828 4140 chrome.exe 86 PID 4140 wrote to memory of 4828 4140 chrome.exe 86 PID 4140 wrote to memory of 4828 4140 chrome.exe 86 PID 4140 wrote to memory of 4828 4140 chrome.exe 86 PID 4140 wrote to memory of 4828 4140 chrome.exe 86 PID 4140 wrote to memory of 4828 4140 chrome.exe 86 PID 4140 wrote to memory of 4828 4140 chrome.exe 86 PID 4140 wrote to memory of 4828 4140 chrome.exe 86
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3472
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://chromewebstore.google.com/detail/roblox-for-free/hchahigddjfnomcffodpdldcelbdokca2⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffd6dcdcc40,0x7ffd6dcdcc4c,0x7ffd6dcdcc583⤵PID:3996
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2024,i,13707401744982067381,10924283554237312352,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2020 /prefetch:23⤵PID:4420
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1912,i,13707401744982067381,10924283554237312352,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2072 /prefetch:33⤵PID:4932
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2248,i,13707401744982067381,10924283554237312352,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2264 /prefetch:83⤵PID:4828
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3108,i,13707401744982067381,10924283554237312352,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3144 /prefetch:13⤵PID:5008
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3116,i,13707401744982067381,10924283554237312352,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3180 /prefetch:13⤵PID:2868
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4340,i,13707401744982067381,10924283554237312352,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4544 /prefetch:83⤵PID:1812
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4584,i,13707401744982067381,10924283554237312352,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4612 /prefetch:83⤵PID:3976
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=4752,i,13707401744982067381,10924283554237312352,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4716 /prefetch:13⤵PID:3248
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4996,i,13707401744982067381,10924283554237312352,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5028 /prefetch:83⤵PID:3456
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4324,i,13707401744982067381,10924283554237312352,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4808 /prefetch:83⤵PID:404
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4680,i,13707401744982067381,10924283554237312352,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5108 /prefetch:83⤵PID:3816
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5052,i,13707401744982067381,10924283554237312352,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4852 /prefetch:83⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:5952
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default2⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3288 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffd596946f8,0x7ffd59694708,0x7ffd596947183⤵PID:4700
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,6504633787228475145,13440102519275229873,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:23⤵PID:4040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,6504633787228475145,13440102519275229873,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
PID:2336
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,6504633787228475145,13440102519275229873,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:83⤵PID:5136
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,6504633787228475145,13440102519275229873,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:13⤵PID:5316
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,6504633787228475145,13440102519275229873,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:13⤵PID:5324
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,6504633787228475145,13440102519275229873,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:13⤵PID:5708
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,6504633787228475145,13440102519275229873,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:13⤵PID:5716
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,6504633787228475145,13440102519275229873,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5332 /prefetch:83⤵PID:5928
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,6504633787228475145,13440102519275229873,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5332 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:6052
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,6504633787228475145,13440102519275229873,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:13⤵PID:5528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,6504633787228475145,13440102519275229873,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:13⤵PID:5520
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,6504633787228475145,13440102519275229873,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:13⤵PID:5408
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,6504633787228475145,13440102519275229873,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4172 /prefetch:13⤵PID:2972
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,6504633787228475145,13440102519275229873,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:13⤵PID:5604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2120,6504633787228475145,13440102519275229873,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5540 /prefetch:83⤵PID:5592
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2120,6504633787228475145,13440102519275229873,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4708 /prefetch:83⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5572
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,6504633787228475145,13440102519275229873,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:13⤵PID:2972
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,6504633787228475145,13440102519275229873,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1348 /prefetch:13⤵PID:2580
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,6504633787228475145,13440102519275229873,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:13⤵PID:3444
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,6504633787228475145,13440102519275229873,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2804 /prefetch:13⤵PID:3024
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2120,6504633787228475145,13440102519275229873,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6228 /prefetch:83⤵PID:1544
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,6504633787228475145,13440102519275229873,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5988 /prefetch:13⤵PID:1716
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,6504633787228475145,13440102519275229873,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6096 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
PID:3876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2120,6504633787228475145,13440102519275229873,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6088 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:2740
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,6504633787228475145,13440102519275229873,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6296 /prefetch:13⤵PID:744
-
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Virus\WinNuke.98.exe"C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Virus\WinNuke.98.exe"2⤵
- System Location Discovery: System Language Discovery
PID:4972
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Virus\WinNuke.98.exe"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Virus\WinNuke.98.exe"2⤵PID:1052
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\RAT\RevengeRAT.exe"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\RAT\RevengeRAT.exe"2⤵
- Suspicious use of SetThreadContext
PID:2612 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"3⤵
- Drops startup file
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Checks processor information in registry
PID:2360 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"4⤵
- System Location Discovery: System Language Discovery
PID:1056
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\jdzv3ym0.cmdline"4⤵
- System Location Discovery: System Language Discovery
PID:3548 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7B13.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc552E8A989FFE4283818353F7FEBEE8B9.TMP"5⤵PID:4544
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\qjzbeb9-.cmdline"4⤵PID:1732
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7BA0.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc57E51E9CD49947FBBCD339E9AB5EC89F.TMP"5⤵
- System Location Discovery: System Language Discovery
PID:3692
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\6rijjp-0.cmdline"4⤵
- System Location Discovery: System Language Discovery
PID:4584 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7C0D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc8CC588DA6D8E4154862682E649664E9.TMP"5⤵PID:1168
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\oyvdugyc.cmdline"4⤵
- System Location Discovery: System Language Discovery
PID:4936 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7C7B.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc64E465378AD74C78A2EB525CD387B6C.TMP"5⤵
- System Location Discovery: System Language Discovery
PID:5052
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\v-soq9p8.cmdline"4⤵PID:1116
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7CE8.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc72CE8F084D147869BFF8BED7360AC.TMP"5⤵
- System Location Discovery: System Language Discovery
PID:6052
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\he_c-lgh.cmdline"4⤵
- System Location Discovery: System Language Discovery
PID:2172 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7D55.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc3453A5D438A24AD9B1BE2626E5B60C5.TMP"5⤵PID:5704
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ymrs6ojh.cmdline"4⤵
- System Location Discovery: System Language Discovery
PID:3624 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7DB3.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc21B7AD879D1544958A4449DCAB1443A1.TMP"5⤵
- System Location Discovery: System Language Discovery
PID:3684
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\xh6bi6u1.cmdline"4⤵
- System Location Discovery: System Language Discovery
PID:5192 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7E11.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4B948449EB644828ADD0F02460BD9559.TMP"5⤵
- System Location Discovery: System Language Discovery
PID:2380
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\52teo5lt.cmdline"4⤵
- System Location Discovery: System Language Discovery
PID:5256 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7E7E.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcC2572463C2864AC3B66BA124D4441966.TMP"5⤵
- System Location Discovery: System Language Discovery
PID:5848
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\m9ypkmjz.cmdline"4⤵
- System Location Discovery: System Language Discovery
PID:1804 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7EDC.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc83FA02A2C7147718D7DCBE96AC2F593.TMP"5⤵
- System Location Discovery: System Language Discovery
PID:3408
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\az2fxcr1.cmdline"4⤵
- System Location Discovery: System Language Discovery
PID:4840 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7F49.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc7422B574CE8A4101A2552F8A862D2010.TMP"5⤵PID:5244
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\qzavre5v.cmdline"4⤵
- System Location Discovery: System Language Discovery
PID:3880 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7FE6.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc66C01C53A04A4925A119EB198ECB78F.TMP"5⤵
- System Location Discovery: System Language Discovery
PID:5752
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\tsx2gvwi.cmdline"4⤵
- System Location Discovery: System Language Discovery
PID:5884 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES80B1.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4C0B41FDE2C94365A6D78833E1DAD5EB.TMP"5⤵
- System Location Discovery: System Language Discovery
PID:744
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ndllf5up.cmdline"4⤵
- System Location Discovery: System Language Discovery
PID:2840 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES815D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcDC091481665D471798950A0CD4B4CFC.TMP"5⤵
- System Location Discovery: System Language Discovery
PID:4528
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\3eokxfu3.cmdline"4⤵PID:3912
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8209.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc82655AAFB8694FC989647C2D3077A654.TMP"5⤵
- System Location Discovery: System Language Discovery
PID:5400
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\fapwvzlc.cmdline"4⤵PID:5928
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8286.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc88E9F2A1FE6E4A7FBD1B6B52ECE333.TMP"5⤵
- System Location Discovery: System Language Discovery
PID:1088
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\1-bnd7zs.cmdline"4⤵
- System Location Discovery: System Language Discovery
PID:2100 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8360.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc3A177DF76A824936A27377CCD5F6EE9D.TMP"5⤵PID:5712
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\hfhvv0l3.cmdline"4⤵
- System Location Discovery: System Language Discovery
PID:2828 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES83ED.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc6804C6EBE8CE4B0CA0FA7395A4D932EB.TMP"5⤵
- System Location Discovery: System Language Discovery
PID:1480
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\v5n2ip-z.cmdline"4⤵
- System Location Discovery: System Language Discovery
PID:5380 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES84E7.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc2D521D5354B64E7A81933B476FE5AB95.TMP"5⤵
- System Location Discovery: System Language Discovery
PID:3636
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\9-nrm2v-.cmdline"4⤵
- System Location Discovery: System Language Discovery
PID:3016 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8554.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc19FE13938A2946AEBC36C2BF44C13697.TMP"5⤵
- System Location Discovery: System Language Discovery
PID:1880
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\8_p3arul.cmdline"4⤵
- System Location Discovery: System Language Discovery
PID:2208 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES85D1.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc2B1E813F2F1849589D8D9BD2D115D38.TMP"5⤵
- System Location Discovery: System Language Discovery
PID:2304
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3980 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"5⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Checks processor information in registry
PID:6032 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"6⤵
- System Location Discovery: System Language Discovery
PID:5180
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe"6⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4172
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\llinftu4.cmdline"6⤵
- System Location Discovery: System Language Discovery
PID:752 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2C91.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD3D680B45C9D488FAE3078A595375465.TMP"7⤵
- System Location Discovery: System Language Discovery
PID:444
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\eh1troyl.cmdline"6⤵
- System Location Discovery: System Language Discovery
PID:1052 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2DAA.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcFDA0CEC633EA4F469ECB3388CCD33CA5.TMP"7⤵
- System Location Discovery: System Language Discovery
PID:2704
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\r4sjjaat.cmdline"6⤵
- System Location Discovery: System Language Discovery
PID:1844 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2E27.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc824ED29A392749679FAD6B3559C651E.TMP"7⤵
- System Location Discovery: System Language Discovery
PID:4516
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\2ktzqsz9.cmdline"6⤵
- System Location Discovery: System Language Discovery
PID:4584 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2EB4.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc6E611BBFD1F1488B89B07422167FCB5A.TMP"7⤵
- System Location Discovery: System Language Discovery
PID:5704
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\yjckiojm.cmdline"6⤵
- System Location Discovery: System Language Discovery
PID:4464 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2F40.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc62ABE1117E1F4FF88EFD226C964BF48.TMP"7⤵
- System Location Discovery: System Language Discovery
PID:1080
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\tdmhea2q.cmdline"6⤵PID:5988
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2FDD.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc7B33B33289AD481BB03EB14CB8629D36.TMP"7⤵
- System Location Discovery: System Language Discovery
PID:216
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\rc55yulk.cmdline"6⤵
- System Location Discovery: System Language Discovery
PID:5256 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES304A.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc836C1C1AFE1D4B8BB7FDCF83DCEBDB37.TMP"7⤵PID:5104
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\wpwib36t.cmdline"6⤵
- System Location Discovery: System Language Discovery
PID:1048 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES30C7.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc3A0FF164B2F548F3A4852385DB3B5E72.TMP"7⤵
- System Location Discovery: System Language Discovery
PID:4568
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\jo1uwm6k.cmdline"6⤵
- System Location Discovery: System Language Discovery
PID:4492 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3134.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc9DD41D53437349278B324EEF955932A9.TMP"7⤵
- System Location Discovery: System Language Discovery
PID:5176
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\9ipxvh3i.cmdline"6⤵
- System Location Discovery: System Language Discovery
PID:4428 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES31A2.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc1F833CDA8A9049BAAD8E3890F04531C1.TMP"7⤵
- System Location Discovery: System Language Discovery
PID:1880
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 29766⤵PID:5572
-
-
-
-
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\RAT\RevengeRAT.exe"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\RAT\RevengeRAT.exe"2⤵
- Suspicious use of SetThreadContext
PID:1804 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4840 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"4⤵
- System Location Discovery: System Language Discovery
PID:2976
-
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /42⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
PID:3800
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\RAT\CrimsonRAT.exe"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\RAT\CrimsonRAT.exe"2⤵PID:6124
-
C:\ProgramData\Hdlharas\dlrarhsiva.exe"C:\ProgramData\Hdlharas\dlrarhsiva.exe"3⤵
- Executes dropped EXE
PID:5980
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\DudleyTrojan.bat" "2⤵PID:5752
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\DudleyTrojan.bat" "2⤵PID:1384
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\ColorBug.exe"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\ColorBug.exe"2⤵
- Adds Run key to start application
PID:4532
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\ColorBug.exe"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\ColorBug.exe"2⤵PID:1116
-
-
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\VeryFun.exe"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\VeryFun.exe"2⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5368 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3888
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Checks whether UAC is enabled
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:696
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3584
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵PID:6120
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵PID:6132
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵PID:5376
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵PID:4396
-
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:4600
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:1880
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5352
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5500
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3888
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1380
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1844 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2076 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"3⤵PID:3316
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5556 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"2⤵
- Suspicious use of SetThreadContext
PID:4852 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"3⤵
- System Location Discovery: System Language Discovery
PID:4992
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x418 0x4781⤵PID:3636
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:720
-
C:\Windows\System32\ie4uinit.exe"C:\Windows\System32\ie4uinit.exe" -UserConfig2⤵PID:2188
-
C:\Windows\System32\ie4uinit.exeC:\Windows\System32\ie4uinit.exe -ClearIconCache3⤵PID:1480
-
C:\Windows\system32\RunDll32.exeC:\Windows\system32\RunDll32.exe C:\Windows\system32\migration\WininetPlugin.dll,MigrateCacheForUser /m /04⤵PID:4548
-
-
C:\Windows\system32\RunDll32.exeC:\Windows\system32\RunDll32.exe C:\Windows\system32\migration\WininetPlugin.dll,MigrateCacheForUser /m /04⤵PID:4208
-
-
-
-
C:\Windows\System32\unregmp2.exe"C:\Windows\System32\unregmp2.exe" /FirstLogon2⤵PID:4008
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level2⤵PID:3536
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x274,0x278,0x27c,0x250,0x280,0x7ff702ad4698,0x7ff702ad46a4,0x7ff702ad46b03⤵PID:4196
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=2 --install-level=03⤵PID:1976
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x26c,0x270,0x274,0x248,0x278,0x7ff702ad4698,0x7ff702ad46a4,0x7ff702ad46b04⤵PID:3092
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge2⤵PID:1732
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff737e25460,0x7ff737e25470,0x7ff737e254803⤵PID:4444
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --migrate-edgeuwp-taskbar-shortcut3⤵PID:3904
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0x78,0x10c,0x7ffd596946f8,0x7ffd59694708,0x7ffd596947184⤵PID:2728
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe"1⤵PID:5928
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exedw20.exe -x -s 8802⤵PID:3576
-
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:5252
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
520B
MD5d7bdecbddac6262e516e22a4d6f24f0b
SHA11a633ee43641fa78fbe959d13fa18654fd4a90be
SHA256db3be7c6d81b2387c39b32d15c096173022cccee1015571dd3e09f2a69b508a9
SHA5121e72db18de776fe264db3052ce9a842c9766a720a9119fc6605f795c36d4c7bf8f77680c5564f36e591368ccd354104a7412f267c4157f04c4926bce51aeeaa1
-
Filesize
9.1MB
MD564261d5f3b07671f15b7f10f2f78da3f
SHA1d4f978177394024bb4d0e5b6b972a5f72f830181
SHA25687f51b4632c5fbc351a59a234dfefef506d807f2c173aac23162b85d0d73c2ad
SHA5123a9ff39e6bc7585b0b03f7327652e4c3b766563e8b183c25b6497e30956945add5684f1579862117e44c6bac2802601fc7c4d2a0daa1824f16c4da1fd6c9c91a
-
Filesize
56KB
MD5b635f6f767e485c7e17833411d567712
SHA15a9cbdca7794aae308c44edfa7a1ff5b155e4aa8
SHA2566838286fb88e9e4e68882601a13fa770f1b510a0a86389b6a29070a129bf2e5e
SHA512551ba05bd44e66685f359802b35a8c9775792a12844906b4b53e1a000d56624c6db323754331c9f399072790991c1b256d9114a50fb78111652a1c973d2880af
-
Filesize
4KB
MD5fde1b01ca49aa70922404cdfcf32a643
SHA1b0a2002c39a37a0ccaf219d42f1075471fd8b481
SHA256741fe085e34db44b7c8ae83288697fab1359b028411c45dab2a3ca8b9ea548a5
SHA512b6b4af427069602e929c1a6ce9d88c4634f0927b7292efb4070d15fb40ce39fc5ce868452dcd5642b2864730502de7a4c33679c936beb1a86c26a753d3f4dc25
-
Filesize
4KB
MD5bb4ff6746434c51de221387a31a00910
SHA143e764b72dc8de4f65d8cf15164fc7868aa76998
SHA256546c4eeccca3320558d30eac5dc3d4726846bdc54af33aa63ac8f3e6fc128506
SHA5121e4c405eca8d1b02147271095545434697d3d672310b4ea2ecca8715eaa9689be3f25c3d4898e7a4b42c413f258eda729a70f5ad8bc314a742082b5a6a8e9ff1
-
Filesize
649B
MD575a5bde9afa598477b92261afe08449e
SHA150c3831bdbe538e4ba07bcf5ca62a6a8746d9af0
SHA256f1898838fe38c30a03152ed5c4b55f4c3a34341a50161c349b01c95f4b5fc8c0
SHA51210dcc55c727638989bbe9f7d5dea2a61d7d022c5a2eee2fda54fac5a0806385d46008c6f97e06636bb06c0a311755605e0e7b172d83c0b1be1ae7c9f830f233d
-
Filesize
480B
MD582b23492924d93ff8ede470a0fd57102
SHA10f52ff9fa8b667fff52f37a82664472bbba6a9c5
SHA256dd2ebda49e981de5f1717cf26768856cd86a0bd56862bbd5b2df6508e914171c
SHA51233edc6133282573457e7c3d3735852069fac822af827517a6681e59a508d0b91cd3a0a28b20d152c5494f403632a421d98fa8b7649329c9c130d2f82623d6734
-
Filesize
600B
MD5d386b1c8a34a84e26a35a3f1aacbb9bd
SHA121418f6d7ba8ae170088439ee75be4682f7ed051
SHA2566ee80947f77cbc76929820695719590a932ef2ee383ce3879ae90bd9dbeeff66
SHA5129a9a39d785b2da68bd5179647857f9ab459cee19f273f20fe35399ae035c52f90395fb5b3aeb29e5e04d13a690cdfd8a2ee68b8718f1c298c70a1e224306e67f
-
Filesize
4KB
MD538f6a580c9a98c791854dec877f5b160
SHA1682aa65601014be7844aa609952ae4c971a5aadb
SHA256cc64a379a20c1a6657aed7b491fc700a2770dc61de7d949f373195a90aab8e29
SHA512f25d37e5a8e2aa691df0b0a5b4221715545a0198ac88d8f46d9a16e5814b83feef8429174d5a158a66e15899758bd4a2460d0b0be359cd3c97c06c50c1604264
-
Filesize
4KB
MD52b3d7f5ecae6ff9f273852790cb77722
SHA189683848881f650bea1821bfc2ffa628c9c84456
SHA2560d158ecce045d9885a439411d2d873720236133915687e2c8db28c4e9e5fd84a
SHA512a409d0d2855f61450efa3cad6621df5f2957357861b5f907a6e796e07e55f5392b2e0fff79018b20145a2680a5b22430663c6a0f3efa95cd0bf4727fbe7a0b1b
-
Filesize
5KB
MD5a630a2bea0ab11fe517ef8b8cc33f988
SHA1aad1927d03ea1e676ee0555e49dd087fa8127098
SHA2569ee2e8065b5426b3cc128183afcf0eb2eed62cc6c092941f22e81c8d2d453df7
SHA5124d61698aeb30d24dda46db6e3a140264749b6cfdbe28a4952794b1fdf88c5b19a24ae63daf3f4936e353c0bc0e18e4b8ecf25d7e18f1af1673970db388d3cb9f
-
Filesize
5KB
MD56e229e470d6c00fb2e760a5cecbb1ac5
SHA18a9de9d0f79ed31219cca2d213a6c0418f586cd9
SHA256c6b0a5c8977b848062b90907eb2a80bc0a903e9ec8ed087ff9d164d7a57c2160
SHA512b15b81c4552ec6cf373859734fa512a8d47e25037307fc3bec5553ff323ee432a1b53fcc78ec0a8402e64303022c2abd8397990761b6daeddde2d7cd6307ef4d
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
688B
MD5c00e4ea6ad151f30110b9efb43274506
SHA170e5401762cd57740496597d80db3d64f6128025
SHA2564c89d9d8cf623c27292e046e7279cfffd15d98eade8afefc9238b15cc464ee15
SHA51294348b9b5345c64401e214462252b4398117b87a201afd633e67a5694a2c3bccb4341cc6b9264648cb9bca933109c2bca29b50e1859ad8e7d0dc0df999702280
-
Filesize
856B
MD591302f6a8547efb58efe24b40630cbdf
SHA1a6b9f0be1bc10ef5b4b98759b6e6cd99ba6a330e
SHA256f48199bdb8cd2928aa2b0a7fd700793a7a9b85a6de05e965f436d00c0e4bcc61
SHA5121ecea48eaf428dc615285c7ea92c1aaaf811911b1ad7516467dd62bba14d9dbb2e587034c2315951345c7b551669be9fccae425352e8268e0a2c135e76bd65c9
-
Filesize
9KB
MD5327cd764307cb6ffc3a2595f85ce2464
SHA1ad6aca522c8b7350a733a9bfb0e1220da28860a9
SHA256d2bab31227cd29d7242ed92fb8fba2c3a316e9ad5a2e06d4fa9cf51c85860cee
SHA512dd21f906b0df6d87f6def7117a0230baee6833cad188ed2c9ff1087ee34cc85044e79c62f646cf75ac6e7f9ab53a210f8939782f0947ff8385b9a0138b838f33
-
Filesize
9KB
MD5ffbc962ed0c6f435935d6c9251dd14b5
SHA1c060cd91c801489adaf9f92a35aa8c50407fafdf
SHA256c1950abf64929bba79c511817d7abb521e52949640badc41ea05e9e2166c01a9
SHA51247d2de72d9809a6185684f4e7eb6690d5ce1e1991234b867c3874ce377820247e7075e40eeb3f589e2ce61248aea22ad15ab54de03cd2509f6b704f79b60106e
-
Filesize
9KB
MD5b09610e746a503af6d6ced93c8c9585c
SHA1032b1bf5cc4ab323b2603bd52249ba21d3b9d144
SHA256ed7823ada079ac95d7b286f76477a953483bfc3079225f51c295fe145391c000
SHA5128dd6845898e36bb1697c034ac31494fab0542b82393f5c9f4bd0f39d53760162432ad4411679efb7154eb451f823edef32dd42859375d84fb33d51ac299f7fb1
-
Filesize
9KB
MD5b08f0139771a234914381e1acd2d0105
SHA1d830e3ee913c116758ad2d08c4ad6fcac33445ec
SHA256bc61aae4aae86af05a1dcd8f9def0d4b196312a11eabd90dc898448b6e507118
SHA51276fe0ee12dcc11cab7551be037fb596c034272dacbba19940df7ab6e1943b7f2148c85385a13515479b3a73855b0d23c2c08b78d1ab86276eb597bf1715bbeeb
-
Filesize
9KB
MD51bda5d476cea98065931747b6a2301e5
SHA17de0213e3fd567a7427d9323c8c3cb7c6a55868b
SHA25673f7597c73d7962b7bd9d6fd097e371267956501967254415cda1bf252d0bb5c
SHA5127052288295edb67f6e54a2d1d63c638c816df05c292989676ac171e4f923fa8eee883a899a57bf727ef66ca1f89825aff418f9724c7a378690fb3e56ef330c1a
-
Filesize
9KB
MD57dadff607a775a4121b175071a12e117
SHA1ed39ffa9770d2dca7b9229dc9506c3bd5000585d
SHA256208a903fcef136d64e567dad7a5eef32702154c711eb614977f591d7499e9635
SHA512411adede56f9338b2ccd0beec15ee359324b94873d63bf1dc6a6012c7fea234326625689c5083a3f33e4bc98cd8ccb1b2df5f65fe123744c47128526a03092eb
-
Filesize
9KB
MD5e2e3a0b293484a063b81e367952ca97d
SHA1fb21823566de5995131598f4d58dc61c92947353
SHA256bab67e4808fb077ae36770428c4caf261f217559f40aa741927af61304d53ef1
SHA51226a12da2041ffff20534d6aee384712faac6d2fb6aa35893677b22548e69e2720728ae52793bbd2a497bdcda970128b74f4410dbbfbaf54ca0d7615bd04e6a8b
-
Filesize
9KB
MD5ca3e04e50ebac1653f8aaf9ed69c80aa
SHA1f3ad8d9b8f47332791c0fd55af88abf6e7634788
SHA256d562fe29e59181191eb8a9ed575fee4b397265f065df4ecb86486ad320ccb6e9
SHA5125f069b579cc7b1a776a0346cf43d8648437481c31160044e1db317138fd51400c6c40b39e13f7a730768b85f81c2472a01016414d4195dcf6890cb2616570fcd
-
Filesize
9KB
MD5cfa367ec1ed4e3b9d5189ba990a0ac35
SHA1d00a354f680bc8ced78670fef1037b2ce33408db
SHA25633e5647abcde192c1dfd3df93cb25b1f33533c0bf74da23a075a57776e1938a3
SHA5122b7ba629d304d0236e4b0ad327d9626a8c448973f9de2c2af86d1e7390090676c319d587a1265981be899ed901cddbe09a906cd432cdeb287774757805920c8e
-
Filesize
9KB
MD5c1973c7746321216e402a6086e03fdde
SHA1a16ef42cabf3ae4429626272c255fdb97be5d171
SHA2569c068927798619c1730060e50c2e16e50112559c066fece5c869ba9bd5cbd73f
SHA51258e39db2a48532d27dc71510482f752493c20d6bb62984786dbdf9b1c51133215b6f5f180c0daf3247f7fa2d3b3cb591f77de0281bd2f1af691ef23d597e37c8
-
Filesize
9KB
MD563143d19f8ee0d8fd7436d23d27efec1
SHA11f2d1748b82d052064581b9e133674d8d394d73d
SHA256a9072b70ddfd426e4a152ce3c91a1cf0059624cdaff840cc6e5af1e1b2dd3f48
SHA512d34d3e3dcba5f1589baf00da705c9cbf0fe20ae12268fbf0698676a8a924d199916470a2dbfee33c49bc32d6d55b88d06ea5f1975e78a6552e403840fe713da7
-
Filesize
9KB
MD5ecdbadbcdf32c1bc395feacc0e1f1d4e
SHA145b4a6ca409633490c262ca2898a9235155ca109
SHA2566ed9622a6154eaaeda6e8f18601f201fe88f958e1d86e006d0eeee9b95a761ea
SHA512223279aa63a65a9de72208de7352ff235abc308d76ef1a8da94f71355c0fae2fd61ad228875fbe38abd9a4a58aa40257540ba326a8fc7d238a4f5a12d0acfaff
-
Filesize
9KB
MD55368a43293c16b5b343f0f528c4b017a
SHA138d33d46da01fec2e3f48bb4f79bc5ce06c48c06
SHA2566548c822677a174d2cd31416476c7dc02a4888d60bbdfa39289c33b91ffa2f64
SHA512098fd057f136238be6ec513eacdfd45f0181f0924a8f60b0f9826abe90f1bf02a2487dcc83194bce051952346cb520a7434d8c2e700e042b3cd485ed1ee24362
-
Filesize
9KB
MD55101f7f3371adea208360e409977929f
SHA19d0e1bd78303399ab1de3ebca5583e73206b7f44
SHA256777043e792305d57bd5c658b70d4c42fc3caedd19cd3476adfd787a2099a8977
SHA51285b9a0bab20556a405b86078bb00c06cb53b6a7d4233293a7968a0e901c01ff6f1a09cef39d37fd5927acf3fc4e96f4a66c56dfb249e4ccd42d426c25ca8156f
-
Filesize
9KB
MD5b746db81ff958ffede383c2cfdcc4c80
SHA1513c42a976ddce9692e503bdd5b6ca4cb4157327
SHA256f19b0b39e893a5f71e35e6955902b8a0354c65c25170b77c428ece59c45054f6
SHA51237473c534ec5b17c236e0385bbb51ae143c1745b67388cc50c55b3515800a83ce42651dee79fb2e6e44e2334064b9ef33751802936ae136ea6aee08417ab2ca7
-
Filesize
9KB
MD5c7ebe0b44360fd07f439b85afeac6553
SHA10c9e6d253b1748bd56bfe91f38bfd60be6409188
SHA256178422e604cc918884b99b5ccee6a6b61e40247a156d3b64eeac6745e4c27a30
SHA5125b171909748257fdb3ca57365af66ad09ff9403bbd8066ce68ea78fe95ceeb4b593f3a3de2011b99e6cf4c06d46b1dad0d5755f21d4e350cb5881d84af5972e4
-
Filesize
9KB
MD512d3251b173779044cb658af54f12680
SHA1de2665055699449055244667167db27bda0380b0
SHA25613ccf560d21bd5b6ba7a3d1ae2609869c4c91a38597799769f54946b26f364a7
SHA512b3645a4f9ba0b1687e5cf122cd1bc652df732bbc4e0750e3ce5d358ce67f8d329205317e8ede5c06c0f39cfb284aa412e0e76535cecfbbded6e5d6a8d0992189
-
Filesize
9KB
MD5d61d45b77a1a48d8f2f257bf23247af3
SHA1adebb97fb9f625cd338613faf255d556ce67e261
SHA25649ef2ef6744da2cb0704f06cb01a9971bcfb5cf0cd3d1200319f21535054c943
SHA512077c2c7accfd881c0d5e66ccd1c34b5744f44a3046261677c3edfde316d2d80036720fb278821ef645ca1d151129adaf4f8f74c2a3cfeeee29f03ee7c4e59ef9
-
Filesize
9KB
MD5938a9a157f77691e81072e27783ab167
SHA1f65cc241fc78de642709bbb158670d2bbbc52229
SHA25665fcd09fc27221a08e4de64bf090898b63bd512e3c032f6b13a6c7a88cd8b814
SHA512f6400c6d6e0ec9e0358eb25518bb6ed374886ed43eff82969ae3011a1f58007f246ca3bbfae96631d44392ffac1c1b139c0ae07437c1875e7f2b93771e158b54
-
Filesize
9KB
MD597a4176f54525f95e90b338a7864068d
SHA15aff0cd08055f9c30ed80f8abc05da5698777c68
SHA2561713e2947510f817f22451d0a8e069ae74b5517f2fc6758970ca65562786ec95
SHA512a284d2c63669f4cfff752e4c514d1e9d604f4cd082272a35b470865929b4a0182440c037ed77fce98834213161267155d36e7ad24ec58d1c9613d1579fe80707
-
Filesize
9KB
MD5829cc74f3fa69f4bdfe17dc78436a83f
SHA1bfc723484bbc02bdbf50f97b2f948ce34e0dd3ee
SHA25608b4e96b234fa414a20c98fc4a7172f64d9ee92d82de28e381c4e4e93c674da2
SHA5124e974983c5d50a43081038ee074b88404eedb061f868a373e273d1af184c505fe963bb688b49f87a91e57a64fb635c392b70a01d7698e148214491e8a8192258
-
Filesize
9KB
MD5296aeea33536a043353c13a7b0c2333b
SHA11316b2da19d1e83465c93c51ce1f3830c853cf51
SHA256c9b68d316cd804a72e56c9e44e901611adda41bc5e96cd473658d5fb9ca133e3
SHA5126071c3c008f116b76483ad047486435db7237358b26d40e2744540314d90762d6af4d0bbc955da08f0e34620e82373b1c3786e4fa008ebf7d8deaab9970afd20
-
Filesize
10KB
MD5113f77d028ae900bd5ba07ef166b1274
SHA12f108bd7acd7334d67c4258b533f8e765aab0a07
SHA2567b86cbed68c28aa84e162ac1d844f9ef8e5cba2f552ab347e82b6e7b495b5092
SHA5121aff6f8ba763f8a450dd54cb8a27a944d3f1d0a3835657cb863f9f8cebee0547a87ccc8f9697569f4592d2f67d47e6891a81986ade498f27d9f17b89e3376e02
-
Filesize
9KB
MD57096d1dafdbd0313d3c65d3a3aaaba1f
SHA17ea1f105ebb36e036651465818afdcb53bece077
SHA256d387eff49f314ba0c96b9b2ab8a6a946b0e9a39b3f78b05edcb9dbd0b7c0fb90
SHA5124e96a5108783f4de3a7d707fd1c08b107e0f3d9eb4aad8217dc69be421b2b4390cc9de025cd1a5b93af750fe39e22486d55dd05d57850ef9fca40af80bf5404a
-
Filesize
9KB
MD5c13bb7801c9fcd41d3e2c0d147d1c31b
SHA1d6ac28a25a801c3a4d86354c17ca6fe17f796a58
SHA256f2f1e6d00398c892dd5caa5f161cdb8229f5c8af2f26daeac9390387383151d3
SHA51257f5d8f729df8d73daf134eac849e93c2a0a7f9ed342eb0a679adaac10c4743ebb688e650886aa41c9b0d710490660804f3e1208a8cbde2d3af6173bd25b305b
-
Filesize
9KB
MD5f8e8729088437db19873f7d7cb6f9a04
SHA186f3aa09e061c9d2b170083ab73a22bda83e371e
SHA256ad1f73b806c8d5f396afc28e8a3ca547d497845820ac36dc1c0355adeaa410a0
SHA5129cc65d4beac641960cf934bb2d5a4bdc167b5c254562686a2f9302ced63ac18a6fad61fe98efc432d5b1a7bf51c1718a5717df5342a3b90c2af839504a0ea86f
-
Filesize
9KB
MD5c189448157c513a53bba9802588e0c66
SHA1322a59e88d140463fb9bfdda63ed6670826024a6
SHA256fbc9d9eef9671aaa39b0b30a02b3cdcf65e885e3ac2c079d4d95d575d12d9cb4
SHA512c4cb166085cd14c4fdeb5bd977c0d0ae5c703d93a63ee062649125f0493424f4d60aa9b49faf2488e1028601715e95e7f04cd9704987ac1f6b2f541d3fb4095c
-
Filesize
9KB
MD5ff27feb76b8dafc0f8f76775ea1710e6
SHA18b394488cfd40d9470b7f09fb80a7eef286e2094
SHA2567a269c1104c93c0cf04a6abc17837fcd913457745b5f1869705df2f5e8849739
SHA512a1d2473a359f0c6d9a3f59589e32caf86fc98404a59f7de4aceb44a230d1fe1325ec3ea6bc7c8b0e2e131d9284077ff15c02165f24399f29dfeac7b8807c3ede
-
Filesize
9KB
MD5fa5465199e9b574864f062578c4671a9
SHA151450cf6950a934266b774228fca395fb267240d
SHA256abe745c1d16a2f8208d921976812514aa4236209d4372498f3d406f3a9fe8956
SHA5125479c5eef170d90ac70571c659aafb25be4b238604372f52767bddde1204a6e6c1fbc3b32938a53c74b12a8444c2b6c8c3cbe573098e5cffbe82f47d2fe2d0cf
-
Filesize
9KB
MD5eeff2e17e51c1305536c7e8e0f62e9c7
SHA1ae89a51b9af84b349d15a2f41941af9e3cc5798c
SHA256ebd010865e5e27f877093c2baa6eb1b1e5aed01655007afd1c5cee507c29f961
SHA51212c0c544c264899adeecbab00c7b2ab5d335ba40f323e461c6f92d6017b45378ad3ca74dbee29b5a029bd30bc734074be3f2466e72f27fb8b5f09367b82eb7f3
-
Filesize
9KB
MD5db229487c1cc7d04d914ecf57e0e62c7
SHA154980e84767bb5fe08e709a144cc9a2641855756
SHA2560b8694630461594acf4320fd1b87b8a319d364a020fefdf2bd72c98c0805c57e
SHA5120a14b51649e1fb0fedf5f0b15cc9e96936c7f9ab4a4b19e470042bbd315036c8a2ea3a24457b6c5c41b040bfa1c80ff2d141292f12daa3bf10801fa1c6422cc4
-
Filesize
9KB
MD58724fc988101ecf84eefb1459fcfe5c3
SHA1aefa249e1694d502535953b44ea4cf61c66967a3
SHA256a8f2166175608132486f4d184b8a88c34fbe0a4f5653a5e9d8b58c6981ab5a20
SHA512aadc287d953d9dcd3f123945444ac9a3d22179d4f430fcdf3caa4bcd0038e2b6aa21f68f18fe6fca4fffd6323ddc8c0f561796e895a4965cda0c370978d23583
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\cb79de83-3114-4877-9acb-f1fa7f39a898.tmp
Filesize9KB
MD55e1b23f41a1deaf51f0b0803b2a83fae
SHA158fdcbeac5e380ec17acb1478144066f9b30bc9e
SHA256dbcf6fff9b83b921c9957f09952ed1bbc2f51076142d8c4d5fc7db62105f0629
SHA512c5a66be20e7cb2d00b2d4d0e7159ec087417c1349af370dffc6acc904592b0dd0ba0913e17818e1e4344afc44b63612641b2c956a93ea4832d3070a89454ee0d
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\f2569b38-26ed-4485-aefb-459ec5e04fca.tmp
Filesize9KB
MD53e62c778fcdf979646ba27ce6539413e
SHA18c3aa69ea5a0f44b38aea5896c3e00dcbda75f4c
SHA2564b5a31225699b81bfd47b87297378862a3b70dce478639a470e4b72883e3a612
SHA5123d4bdb1b91a9e1f4f057856cbcdba2fd56543f8c031c72c2e3aeba736e455c6e918a51c64ccd9f87a73e50ec4a22beaf08402e2e8f8bf3090e5ac3c97673cd5f
-
Filesize
264KB
MD5f6bf948cc9fc7e99924dbedcb925b9cc
SHA1f04f6112516f633319e57f173ddf7e4855018fe6
SHA25635b32a6e5d8165eb8b601a8d36d2072cf17d57afd4f4c4acf357ed63eac74f84
SHA51297f22d749752ee6aa58868846815c8a76ad168be626f09001031214b0f0c4f4da94f563ebdea8867f87c78515ddb034a40d67adb70164174622e49ada28152ac
-
Filesize
99KB
MD5924d6d213d05ea2385c471adbec546ae
SHA1ad9bb0da3ed1545533f4e4d3b4a3260b5b783823
SHA25637e9a37caadba33df315ccdbed53ec86fd23ad5c7581504edf4a999ef8bb31f8
SHA512bfcf9cb82fbb4528c5437e244e91cbc7ae64ee90a6ff75a7a5062f16cd4477bb159c04e0a675055305201c33e9a082433605ab2562c5bd9b0da729fe51646a13
-
Filesize
99KB
MD55af7aa51562489ed4a6584e1ea2551db
SHA12ffdf07173b0ac47810daac12edaea1ecd89c136
SHA256e712ef9b1fd6f637b0d955ba0a5d69a651b40a8aa89096a414f2b73d5381c9c9
SHA51268105c0d45ea96baa9df76d579aa671090b0b15d217a648f1693100abae1bb07999cf57879d3d1ac48da24d36eea76fe1b2eb44a2745bbf7854da335fe7c8fc1
-
Filesize
99KB
MD5b4baee5f45e883a8f85127a2480e9b78
SHA1487aeac1279f875a8aa6dc05eb16c60992611d01
SHA256a0351ec08be4997e0460f65118908688b5f90532c8a5c3e12082383c84dee189
SHA5123251ca847b6acb81a11de2e23d49b4871e16026d84be724d9a19ef2c7e0c0d176b3797843f92333f252fe8137087542faaed313f1c6ed278e395e579b54f8d0f
-
Filesize
120B
MD550dec1858e13f033e6dca3cbfad5e8de
SHA179ae1e9131b0faf215b499d2f7b4c595aa120925
SHA25614a557e226e3ba8620bb3a70035e1e316f1e9fb5c9e8f74c07110ee90b8d8ae4
SHA5121bd73338df685a5b57b0546e102ecfdee65800410d6f77845e50456ac70de72929088af19b59647f01cba7a5acfb399c52d9ef2402a9451366586862ef88e7bf
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\88681319-f70a-4c71-8cf1-01d8831eb14f.dmp
Filesize5.1MB
MD59ff8f50f197cea426ba838a416ac1641
SHA122fa4b1a3d3115d7b19f07021157aa12a90af47d
SHA256c1daff30b409bef628c15dccb3d5fb780c234beb529335eecec47a00733dd873
SHA51215cd50c1a6a9a1c1a553a495660757272551db9f011b8b8a7f24c695bff9b3b652f48c0219f9762da6845ad0b56bc4a2ffec78a4e7e73061ee6c168bb0b73349
-
Filesize
152B
MD5b9569e123772ae290f9bac07e0d31748
SHA15806ed9b301d4178a959b26d7b7ccf2c0abc6741
SHA25620ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b
SHA512cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795
-
Filesize
152B
MD5eeaa8087eba2f63f31e599f6a7b46ef4
SHA1f639519deee0766a39cfe258d2ac48e3a9d5ac03
SHA25650fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9
SHA512eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c
-
Filesize
152B
MD5aaf1146bb5e90143a1924e3aac8bbce1
SHA12280ee43be856e9b5d6d2f5eba75f3cc602b5308
SHA25670a61d70387c32da2c47e49a2b1f44c277c78314605b7344be9355a6e7b85d81
SHA512446c675a4266765b9ed5eb5c333aa8d91940bde17a97299f7af592a2b62f8fe571d15b20074a613e10420fd32b711a22da1482b13dc4b2ebb6a0c237931dbc9e
-
Filesize
62KB
MD5c3c0eb5e044497577bec91b5970f6d30
SHA1d833f81cf21f68d43ba64a6c28892945adc317a6
SHA256eb48be34490ec9c4f9402b882166cd82cd317b51b2a49aae75cdf9ee035035eb
SHA51283d3545a4ed9eed2d25f98c4c9f100ae0ac5e4bc8828dccadee38553b7633bb63222132df8ec09d32eb37d960accb76e7aab5719fc08cc0a4ef07b053f30cf38
-
Filesize
43KB
MD5edf3b94d12feda9fec733db26bcfee48
SHA1b8a381a326bbdcff3e6cfca8c4e2951bc75e3084
SHA2561402cb49197f078fc86b8522c42006091fb0c091922f420f78c6e1728e005adb
SHA5127f8fb7d5de19adf67a504d81fe504430aa8a9da1909e12ae15b0f02aedd0ec732e6225742cd1afb054e29a3f6819605b1ddc0835729e176fdd4975fc71feb17a
-
Filesize
70KB
MD54058c842c36317dcd384b6c2deaa8b95
SHA11085ddb12b29b79ffe51937ba9cd1957e5e229b4
SHA2560e562969cad63d217848a5080273d1745dc4277d210b68a769c822f2fbfd75f6
SHA512435a67024811360b12339e3916945b0639e2d9319e9d540b73e093848a467b030e91e01917b7fb804eb756dabce2fe53c2d7ea586554ee6cfee70e652a85924a
-
Filesize
19KB
MD52e86a72f4e82614cd4842950d2e0a716
SHA1d7b4ee0c9af735d098bff474632fc2c0113e0b9c
SHA256c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f
SHA5127a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1
-
Filesize
63KB
MD5710d7637cc7e21b62fd3efe6aba1fd27
SHA18645d6b137064c7b38e10c736724e17787db6cf3
SHA256c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b
SHA51219aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44
-
Filesize
84KB
MD574e33b4b54f4d1f3da06ab47c5936a13
SHA16e5976d593b6ee3dca3c4dbbb90071b76e1cd85c
SHA256535fc48679c38decd459ad656bdd6914e539754265244d0cc7b1da6bddf3e287
SHA51279218e8ee50484af968480ff9b211815c97c3f3035414e685aa5d15d9b4152682d87b66202339f212bf3b463a074bf7a4431107b50303f28e2eb4b17843991c2
-
Filesize
38KB
MD5bff21faca239119a0a3b3cf74ea079c6
SHA160a40c7e60425efe81e08f44731e42b4914e8ddf
SHA2568ea48b2ac756062818bd4ee2d289b88d0d62dc42a36cb6eee5bdd2ff347816c7
SHA512f9e5baefacae0cdb7b9c93afc43ad6ec3902b28c0cdf569e1a7013f4e5c8dfb7b389b5e2bc724b4ddfe554437320f4f2cc648642944c6f48ad2a78815acd9658
-
Filesize
1.2MB
MD5d717dc20ddf09d562cc7d4bddc69ea5e
SHA13c0a07ff93171250557ff41c1621eebd8f121577
SHA2565b92638f93b754c48a8050863fe38abcb2ac7397979bf3b9dbfa2ffecce2383c
SHA51207b48be4727a55e34ff097e8974ba14251436417edd64b3876b09cdfc31220551ab12f6f080af697e23b6cd9afda50ddbbbd00df53fbd538893b62fa43173e04
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize4KB
MD5c00de79c07572d89fef6aa0e6a68b581
SHA10d2c19589f598628b0ed21cff9f3034c14ee2eb6
SHA2566a4e300ae1e28cba1dd6bb6a3649aa842158787f2f81819279b60db728700622
SHA5128135f33b476cf94b691cb408420972ba5f4c3ca8bd01bef75ec835b3f43bb1a5c5baf27c016b31af57c5d0e9ad9e1c1503d8e0d804c7221b34b3de9ff364cd0a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize4KB
MD528a93cb1731948abff79cddc9000dde9
SHA1c8ddb780985995a5a6500872c58d08c2937c24fd
SHA2566ef98512b62e48695eb41c8267021c9d2d676b708e572b4b51385ffe80e2d08a
SHA51242d07fa530f836a3b15befe0aa5c1ecf2eea77848534196627d1cd855acfe8b2c0b8eb2b26aadf925e41e2ad8219c5e170de384a5bdc2fecc8522ee2aff8d733
-
Filesize
861B
MD51a99d8ba7efd6fe3418f52d81b2cee41
SHA1b829982bd1e80d6db0450a518af46ea05889fba1
SHA2560b8b46ef12c114cdc8ba26ef5c89e55a41c0387123e2b811ab017d98d7931340
SHA512c63fd59bc773c2ac4a89f84f9ed09b25438dc8296ade59239b8013be750870bccc5654bd2401464347ce6b71a026e42690db9174be227f3bc133d14eb619a354
-
Filesize
930B
MD5c4afd000f025ed1ef78105a463b0812d
SHA18b9b9ad75eed9921d758e77d69e9b1032c7c001f
SHA2567dbc7f2b673df6b1f0e8af7745c6545da4678660f7e322bb21a5ca0f8738a9f7
SHA512223a0b705008dba474c1ee02e1b536d35a4ea99b59ee0d7dd83ebc951edcc8fd9c8c129e80c40cde8868ec58f4deb264fc5e0005ba7ad9841f3f144606c4cea8
-
Filesize
7KB
MD5602971336f93ca4f7ff9af0942929711
SHA18978374ab83637cecce3aef2037eeda8ee95c014
SHA256a37494b1b6936754dbd2bde9855a408c22b863e0a53dc19cde6ae0f47305f7d7
SHA5129d2c8cc064b3fa0ff1e7d00c4bbc7b87d0d3cfd89390bfae5d3ce560ab2416e03d856a2bb27bb308ecb7c0d06790dab3ebf2e647c1b0165df424c98b047fdf22
-
Filesize
7KB
MD536d3dbbef388e13159f812f87f5b25a0
SHA12d0e56f85afb565c353031f2106c49a3a8958617
SHA256fc81395b9e25e34e5d7423db2e6983ce88bd8488502687ecc36cb7154054e68f
SHA512c4ae23e9956594509d30858d32f7dddcefcc8147209806cdd597ca9a68c2be9396fac2d0e0ceca6538410ae324e04a3bd5d3cf7b2a1107eb7849c7783ccca538
-
Filesize
5KB
MD5caff9c9232c94ab2fc42b8ec08f98304
SHA1a4e2cdb9f45471209fe551faedea9b059c167366
SHA25648774bee02a9416f94c59abcfdd98cab5f7b53360d986b0fbbe25c54dfa92fb0
SHA512ddd1e181d24853bf8cfe06cd9adf9b43016d58dc7024043537d95188021fb9ca30030c0ca4117131aa31e7007a88cd06839bc2638349a5fc4e023545bfad3215
-
Filesize
6KB
MD580f7bc3c111e42acb28a1d50f6e78da7
SHA1dcc233b4e722bd9fe6050d759fe7e1f0b8a56b2c
SHA2561d662d2b855b600b78cf36c26776a59e02726ca2acb9a41308ec61b23057ccf3
SHA5126d12619400e77176385121297a44d8b85e0cfc9581c774c7bbba2776cb7a32688d6df14da0aae77adb5ed62c0dc247b2d9ae66fa78130d869c89b57e5d0f63fb
-
Filesize
6KB
MD55178d1e004131292e50bbc7293bc2e66
SHA1301e9d6f6dce5cbd28b93f9217b28f310ac09d73
SHA256c9289d4260b176a7c387bbf9acb9658b973100f5e6d8b8e2d486eb805690641e
SHA512897ebece3fc2ae598702987a672596dac74ca22ff48d3a7ee9d91b62cf29ae99438e8cee139084b9bb998ccb2519f5f16646edecbd9ff80ba877ad630f4b7740
-
Filesize
7KB
MD5edbef43db912ce248016b6e570f379eb
SHA1e5731ee297aeb5f4cd99a75cce79252e10b36c47
SHA256b314cef5ae689e149538f7926b07f36896ed5d8313d293a420c84cd91ea432f1
SHA512e0d60d059f508a21db69c3d5b412a8edb1de81a0ccfd530d1e7da6c9e8ecdc5fff0316b920ce7d36db3d06739cfd78069ec8d7457620c0462e663dc7bb6847b5
-
Filesize
6KB
MD501447ae33adb46068fe47addf81442b6
SHA148980640b0eebc75fb5be96e1df4b4ffa275a49c
SHA256743ac141565b1173790d57c001bc325e6356f561f3266ac8a2417934b0497994
SHA5125d71c7c633f6d9c3ea5d71373a5fdd823b65bb3fa81ce19bf2312facbec28e3c5f28218eac848e2e2e254ef9567be22a07f1b9dfe1aa8ef816262659b299e8ab
-
Filesize
7KB
MD52ac99851b421550f726dccbed4def48a
SHA1aaad04e75cbaddcaa699c3d4e2c17ffa1e9d55bb
SHA256c136ab8c5596fa3f5b4f5e460801fd158e1f77c61dbf253588851285c1146239
SHA5129b038e1f9d4fa38c8758f163f20655a99388edda88ec73e3a87d8938c54583d078a93a78f8c6b932572f5ba796b864e155d5c0e0d40d2b4b79a3828cc7b16586
-