revengerat | e802fd8a9566b25ff2063176d894efe655e47cb1c746417691083ba3d6e7d8ec

Resubmissions

07-11-2024 04:41

241107-fa9yssxrhj 10

07-11-2024 04:32

241107-e6a9nsvlat 8

Analysis

max time kernel
288s
max time network
289s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2024 04:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Untitled.png
Size

50KB
MD5

8e9c71ce941f1912f41cfaede1db1e24
SHA1

db19ac45731476b950be59a11987a213b768ba50
SHA256

e802fd8a9566b25ff2063176d894efe655e47cb1c746417691083ba3d6e7d8ec
SHA512

07e558d3718ec969ed06ecd499f6ee70871493d5d747b7762c7ef9302ca5faea0bcf89c465b37da88b569369600c918c1ccc4984a82f2b178bbd8b7d88cb09c6
SSDEEP

1536:fTub1Va7luiGYNZ+Q3zTXMscxEI9StVzyZLRT6:r8LaJj2gzL7IMEY

Score

10^/10

revengerat warzonerat guest discovery infostealer persistence rat rezer0 stealer trojan

Malware Config

Extracted

Family

warzonerat

168.61.222.215:5400

Extracted

Family

revengerat

Botnet

Guest

0.tcp.ngrok.io:19521

Mutex

RV_MUTEX

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat
Revengerat family
revengerat
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat
Warzonerat family
warzonerat

ReZer0 packer 1 IoCs

Detects ReZer0, a packer with multiple versions used in various campaigns.

rezer0

Processes:

resource	yara_rule
behavioral1/memory/2288-916-0x00000000052A0000-0x00000000052C8000-memory.dmp	rezer0

RevengeRat Executable 1 IoCs

stealer

Processes:

resource	yara_rule
C:\Users\Admin\Downloads\RevengeRAT.exe	revengerat

Warzone RAT payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/3384-922-0x0000000000400000-0x0000000000553000-memory.dmp	warzonerat
behavioral1/memory/3384-924-0x0000000000400000-0x0000000000553000-memory.dmp	warzonerat

Downloads MZ/PE file

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WarzoneRAT.exeWarzoneRAT.exeWarzoneRAT.exeWarzoneRAT.exeWarzoneRAT.exeWarzoneRAT.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	WarzoneRAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	WarzoneRAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	WarzoneRAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	WarzoneRAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	WarzoneRAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	WarzoneRAT.exe

Drops startup file 2 IoCs

Processes:

RegSvcs.exeRegSvcs.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe	RegSvcs.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe	RegSvcs.exe

Executes dropped EXE 11 IoCs

Processes:

WarzoneRAT.exeWarzoneRAT.exeWarzoneRAT.exeWarzoneRAT.exeWarzoneRAT.exeWarzoneRAT.exeRevengeRAT.exeRevengeRAT.exesvchost.exeHydra.exesvchost.exe

pid	process
2288	WarzoneRAT.exe
2004	WarzoneRAT.exe
2340	WarzoneRAT.exe
4364	WarzoneRAT.exe
1576	WarzoneRAT.exe
1016	WarzoneRAT.exe
1984	RevengeRAT.exe
3832	RevengeRAT.exe
980	svchost.exe
2128	Hydra.exe
3956	svchost.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

RegSvcs.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\svchost.exe"	RegSvcs.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs

Web Service
T1102

Processes:

flow ioc

165 raw.githubusercontent.com
167 raw.githubusercontent.com
185 0.tcp.ngrok.io
201 0.tcp.ngrok.io
217 0.tcp.ngrok.io
163 raw.githubusercontent.com

flow	ioc
165	raw.githubusercontent.com
167	raw.githubusercontent.com
185	0.tcp.ngrok.io
201	0.tcp.ngrok.io
217	0.tcp.ngrok.io
163	raw.githubusercontent.com

Suspicious use of SetThreadContext 14 IoCs

Processes:

WarzoneRAT.exeWarzoneRAT.exeWarzoneRAT.exeWarzoneRAT.exeWarzoneRAT.exeWarzoneRAT.exeRevengeRAT.exeRegSvcs.exeRevengeRAT.exeRegSvcs.exesvchost.exeRegSvcs.exesvchost.exeRegSvcs.exe

description	pid	process	target process
PID 2288 set thread context of 3384	2288	WarzoneRAT.exe	MSBuild.exe
PID 2004 set thread context of 2280	2004	WarzoneRAT.exe	MSBuild.exe
PID 2340 set thread context of 4284	2340	WarzoneRAT.exe	MSBuild.exe
PID 4364 set thread context of 5012	4364	WarzoneRAT.exe	MSBuild.exe
PID 1576 set thread context of 3380	1576	WarzoneRAT.exe	MSBuild.exe
PID 1016 set thread context of 560	1016	WarzoneRAT.exe	MSBuild.exe
PID 1984 set thread context of 3648	1984	RevengeRAT.exe	RegSvcs.exe
PID 3648 set thread context of 2128	3648	RegSvcs.exe	RegSvcs.exe
PID 3832 set thread context of 3300	3832	RevengeRAT.exe	RegSvcs.exe
PID 3300 set thread context of 4488	3300	RegSvcs.exe	RegSvcs.exe
PID 980 set thread context of 5096	980	svchost.exe	RegSvcs.exe
PID 5096 set thread context of 4920	5096	RegSvcs.exe	RegSvcs.exe
PID 3956 set thread context of 4568	3956	svchost.exe	RegSvcs.exe
PID 4568 set thread context of 4728	4568	RegSvcs.exe	RegSvcs.exe

Drops file in Program Files directory 2 IoCs

Processes:

setup.exesetup.exe

description	ioc	process
File opened for modification	C:\Program Files\Crashpad\settings.dat	setup.exe
File opened for modification	C:\Program Files\Crashpad\metadata	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

vbc.exevbc.exevbc.exevbc.exevbc.exeMSBuild.exeRegSvcs.execvtres.exevbc.exeschtasks.execvtres.execvtres.exeRegSvcs.exevbc.execvtres.exevbc.exeRegSvcs.exevbc.execvtres.execvtres.exevbc.execvtres.exeMSBuild.exevbc.exevbc.execvtres.exeRegSvcs.execvtres.execvtres.exeschtasks.exevbc.exevbc.exeHydra.exeRegSvcs.exeRegSvcs.exevbc.exevbc.execvtres.execvtres.exevbc.exeWarzoneRAT.exeWarzoneRAT.exevbc.exevbc.exevbc.exeMSBuild.execvtres.execvtres.exevbc.execvtres.exeMSBuild.exeRegSvcs.exevbc.exeschtasks.exevbc.execvtres.execvtres.execvtres.exevbc.execvtres.execvtres.execvtres.exeschtasks.exeMSBuild.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hydra.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WarzoneRAT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WarzoneRAT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133754281063595698"	chrome.exe

Modifies registry class 1 IoCs

Processes:

chrome.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings chrome.exe
Scheduled Task/Job: Scheduled Task 1 TTPs 7 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid process

4456 schtasks.exe
1656 schtasks.exe
2892 schtasks.exe
4484 schtasks.exe
2536 schtasks.exe
1884 schtasks.exe
3200 schtasks.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	chrome.exe

pid	process
4456	schtasks.exe
1656	schtasks.exe
2892	schtasks.exe
4484	schtasks.exe
2536	schtasks.exe
1884	schtasks.exe
3200	schtasks.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

Processes:

chrome.exeWarzoneRAT.exeWarzoneRAT.exeWarzoneRAT.exeWarzoneRAT.exeWarzoneRAT.exeWarzoneRAT.exechrome.exetaskmgr.exe

pid	process
464	chrome.exe
464	chrome.exe
2288	WarzoneRAT.exe
2288	WarzoneRAT.exe
2288	WarzoneRAT.exe
2288	WarzoneRAT.exe
2288	WarzoneRAT.exe
2288	WarzoneRAT.exe
2004	WarzoneRAT.exe
2004	WarzoneRAT.exe
2004	WarzoneRAT.exe
2004	WarzoneRAT.exe
2340	WarzoneRAT.exe
2340	WarzoneRAT.exe
2340	WarzoneRAT.exe
2340	WarzoneRAT.exe
2340	WarzoneRAT.exe
2340	WarzoneRAT.exe
4364	WarzoneRAT.exe
4364	WarzoneRAT.exe
4364	WarzoneRAT.exe
4364	WarzoneRAT.exe
1576	WarzoneRAT.exe
1576	WarzoneRAT.exe
1576	WarzoneRAT.exe
1576	WarzoneRAT.exe
1576	WarzoneRAT.exe
1576	WarzoneRAT.exe
1016	WarzoneRAT.exe
1016	WarzoneRAT.exe
1016	WarzoneRAT.exe
1016	WarzoneRAT.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

Processes:

chrome.exe

pid process

464 chrome.exe
464 chrome.exe
464 chrome.exe
464 chrome.exe
464 chrome.exe
464 chrome.exe
464 chrome.exe
464 chrome.exe
464 chrome.exe
464 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	464	chrome.exe
Token: SeCreatePagefilePrivilege	464	chrome.exe
Token: SeShutdownPrivilege	464	chrome.exe
Token: SeCreatePagefilePrivilege	464	chrome.exe
Token: SeShutdownPrivilege	464	chrome.exe
Token: SeCreatePagefilePrivilege	464	chrome.exe
Token: SeShutdownPrivilege	464	chrome.exe
Token: SeCreatePagefilePrivilege	464	chrome.exe
Token: SeShutdownPrivilege	464	chrome.exe
Token: SeCreatePagefilePrivilege	464	chrome.exe
Token: SeShutdownPrivilege	464	chrome.exe
Token: SeCreatePagefilePrivilege	464	chrome.exe
Token: SeShutdownPrivilege	464	chrome.exe
Token: SeCreatePagefilePrivilege	464	chrome.exe
Token: SeShutdownPrivilege	464	chrome.exe
Token: SeCreatePagefilePrivilege	464	chrome.exe
Token: SeShutdownPrivilege	464	chrome.exe
Token: SeCreatePagefilePrivilege	464	chrome.exe
Token: SeShutdownPrivilege	464	chrome.exe
Token: SeCreatePagefilePrivilege	464	chrome.exe
Token: SeShutdownPrivilege	464	chrome.exe
Token: SeCreatePagefilePrivilege	464	chrome.exe
Token: SeShutdownPrivilege	464	chrome.exe
Token: SeCreatePagefilePrivilege	464	chrome.exe
Token: SeShutdownPrivilege	464	chrome.exe
Token: SeCreatePagefilePrivilege	464	chrome.exe
Token: SeShutdownPrivilege	464	chrome.exe
Token: SeCreatePagefilePrivilege	464	chrome.exe
Token: SeShutdownPrivilege	464	chrome.exe
Token: SeCreatePagefilePrivilege	464	chrome.exe
Token: SeShutdownPrivilege	464	chrome.exe
Token: SeCreatePagefilePrivilege	464	chrome.exe
Token: SeShutdownPrivilege	464	chrome.exe
Token: SeCreatePagefilePrivilege	464	chrome.exe
Token: SeShutdownPrivilege	464	chrome.exe
Token: SeCreatePagefilePrivilege	464	chrome.exe
Token: SeShutdownPrivilege	464	chrome.exe
Token: SeCreatePagefilePrivilege	464	chrome.exe
Token: SeShutdownPrivilege	464	chrome.exe
Token: SeCreatePagefilePrivilege	464	chrome.exe
Token: SeShutdownPrivilege	464	chrome.exe
Token: SeCreatePagefilePrivilege	464	chrome.exe
Token: SeShutdownPrivilege	464	chrome.exe
Token: SeCreatePagefilePrivilege	464	chrome.exe
Token: SeShutdownPrivilege	464	chrome.exe
Token: SeCreatePagefilePrivilege	464	chrome.exe
Token: SeShutdownPrivilege	464	chrome.exe
Token: SeCreatePagefilePrivilege	464	chrome.exe
Token: SeShutdownPrivilege	464	chrome.exe
Token: SeCreatePagefilePrivilege	464	chrome.exe
Token: SeShutdownPrivilege	464	chrome.exe
Token: SeCreatePagefilePrivilege	464	chrome.exe
Token: SeShutdownPrivilege	464	chrome.exe
Token: SeCreatePagefilePrivilege	464	chrome.exe
Token: SeShutdownPrivilege	464	chrome.exe
Token: SeCreatePagefilePrivilege	464	chrome.exe
Token: SeShutdownPrivilege	464	chrome.exe
Token: SeCreatePagefilePrivilege	464	chrome.exe
Token: SeShutdownPrivilege	464	chrome.exe
Token: SeCreatePagefilePrivilege	464	chrome.exe
Token: SeShutdownPrivilege	464	chrome.exe
Token: SeCreatePagefilePrivilege	464	chrome.exe
Token: SeShutdownPrivilege	464	chrome.exe
Token: SeCreatePagefilePrivilege	464	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

chrome.exetaskmgr.exe

pid	process
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe

Suspicious use of SendNotifyMessage 58 IoCs

Processes:

chrome.exetaskmgr.exe

pid	process
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
464	chrome.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 464 wrote to memory of 4464	464	chrome.exe	chrome.exe
PID 464 wrote to memory of 4464	464	chrome.exe	chrome.exe
PID 464 wrote to memory of 2000	464	chrome.exe	chrome.exe
PID 464 wrote to memory of 2000	464	chrome.exe	chrome.exe
PID 464 wrote to memory of 2000	464	chrome.exe	chrome.exe
PID 464 wrote to memory of 2000	464	chrome.exe	chrome.exe
PID 464 wrote to memory of 2000	464	chrome.exe	chrome.exe
PID 464 wrote to memory of 2000	464	chrome.exe	chrome.exe
PID 464 wrote to memory of 2000	464	chrome.exe	chrome.exe
PID 464 wrote to memory of 2000	464	chrome.exe	chrome.exe
PID 464 wrote to memory of 2000	464	chrome.exe	chrome.exe
PID 464 wrote to memory of 2000	464	chrome.exe	chrome.exe
PID 464 wrote to memory of 2000	464	chrome.exe	chrome.exe
PID 464 wrote to memory of 2000	464	chrome.exe	chrome.exe
PID 464 wrote to memory of 2000	464	chrome.exe	chrome.exe
PID 464 wrote to memory of 2000	464	chrome.exe	chrome.exe
PID 464 wrote to memory of 2000	464	chrome.exe	chrome.exe
PID 464 wrote to memory of 2000	464	chrome.exe	chrome.exe
PID 464 wrote to memory of 2000	464	chrome.exe	chrome.exe
PID 464 wrote to memory of 2000	464	chrome.exe	chrome.exe
PID 464 wrote to memory of 2000	464	chrome.exe	chrome.exe
PID 464 wrote to memory of 2000	464	chrome.exe	chrome.exe
PID 464 wrote to memory of 2000	464	chrome.exe	chrome.exe
PID 464 wrote to memory of 2000	464	chrome.exe	chrome.exe
PID 464 wrote to memory of 2000	464	chrome.exe	chrome.exe
PID 464 wrote to memory of 2000	464	chrome.exe	chrome.exe
PID 464 wrote to memory of 2000	464	chrome.exe	chrome.exe
PID 464 wrote to memory of 2000	464	chrome.exe	chrome.exe
PID 464 wrote to memory of 2000	464	chrome.exe	chrome.exe
PID 464 wrote to memory of 2000	464	chrome.exe	chrome.exe
PID 464 wrote to memory of 2000	464	chrome.exe	chrome.exe
PID 464 wrote to memory of 2000	464	chrome.exe	chrome.exe
PID 464 wrote to memory of 4912	464	chrome.exe	chrome.exe
PID 464 wrote to memory of 4912	464	chrome.exe	chrome.exe
PID 464 wrote to memory of 5048	464	chrome.exe	chrome.exe
PID 464 wrote to memory of 5048	464	chrome.exe	chrome.exe
PID 464 wrote to memory of 5048	464	chrome.exe	chrome.exe
PID 464 wrote to memory of 5048	464	chrome.exe	chrome.exe
PID 464 wrote to memory of 5048	464	chrome.exe	chrome.exe
PID 464 wrote to memory of 5048	464	chrome.exe	chrome.exe
PID 464 wrote to memory of 5048	464	chrome.exe	chrome.exe
PID 464 wrote to memory of 5048	464	chrome.exe	chrome.exe
PID 464 wrote to memory of 5048	464	chrome.exe	chrome.exe
PID 464 wrote to memory of 5048	464	chrome.exe	chrome.exe
PID 464 wrote to memory of 5048	464	chrome.exe	chrome.exe
PID 464 wrote to memory of 5048	464	chrome.exe	chrome.exe
PID 464 wrote to memory of 5048	464	chrome.exe	chrome.exe
PID 464 wrote to memory of 5048	464	chrome.exe	chrome.exe
PID 464 wrote to memory of 5048	464	chrome.exe	chrome.exe
PID 464 wrote to memory of 5048	464	chrome.exe	chrome.exe
PID 464 wrote to memory of 5048	464	chrome.exe	chrome.exe
PID 464 wrote to memory of 5048	464	chrome.exe	chrome.exe
PID 464 wrote to memory of 5048	464	chrome.exe	chrome.exe
PID 464 wrote to memory of 5048	464	chrome.exe	chrome.exe
PID 464 wrote to memory of 5048	464	chrome.exe	chrome.exe
PID 464 wrote to memory of 5048	464	chrome.exe	chrome.exe
PID 464 wrote to memory of 5048	464	chrome.exe	chrome.exe
PID 464 wrote to memory of 5048	464	chrome.exe	chrome.exe
PID 464 wrote to memory of 5048	464	chrome.exe	chrome.exe
PID 464 wrote to memory of 5048	464	chrome.exe	chrome.exe
PID 464 wrote to memory of 5048	464	chrome.exe	chrome.exe
PID 464 wrote to memory of 5048	464	chrome.exe	chrome.exe
PID 464 wrote to memory of 5048	464	chrome.exe	chrome.exe
PID 464 wrote to memory of 5048	464	chrome.exe	chrome.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Untitled.png
1⤵
PID:2136

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ff9748ccc40,0x7ff9748ccc4c,0x7ff9748ccc58
  2⤵
  PID:4464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1904,i,15506226710570674519,5243190865990907497,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1900 /prefetch:2
  2⤵
  PID:2000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2004,i,15506226710570674519,5243190865990907497,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2116 /prefetch:3
  2⤵
  PID:4912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2212,i,15506226710570674519,5243190865990907497,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2484 /prefetch:8
  2⤵
  PID:5048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3156,i,15506226710570674519,5243190865990907497,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3168 /prefetch:1
  2⤵
  PID:932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3400,i,15506226710570674519,5243190865990907497,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:4080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4560,i,15506226710570674519,5243190865990907497,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4504 /prefetch:1
  2⤵
  PID:4684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4720,i,15506226710570674519,5243190865990907497,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4692 /prefetch:8
  2⤵
  PID:4528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4724,i,15506226710570674519,5243190865990907497,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4824 /prefetch:8
  2⤵
  PID:3896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4780,i,15506226710570674519,5243190865990907497,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4696 /prefetch:8
  2⤵
  PID:2396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4728,i,15506226710570674519,5243190865990907497,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5000 /prefetch:8
  2⤵
  PID:2988
- C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe
  "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe" --reenable-autoupdates --system-level
  2⤵
  - Drops file in Program Files directory
  PID:1112
- - C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe
    "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x284,0x288,0x28c,0x260,0x290,0x7ff6a90f4698,0x7ff6a90f46a4,0x7ff6a90f46b0
    3⤵
    - Drops file in Program Files directory
    PID:4172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5012,i,15506226710570674519,5243190865990907497,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5112 /prefetch:8
  2⤵
  PID:1456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5040,i,15506226710570674519,5243190865990907497,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5024 /prefetch:8
  2⤵
  PID:2600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5004,i,15506226710570674519,5243190865990907497,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5032 /prefetch:8
  2⤵
  PID:2236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4692,i,15506226710570674519,5243190865990907497,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5504 /prefetch:8
  2⤵
  PID:888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5468,i,15506226710570674519,5243190865990907497,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5616 /prefetch:2
  2⤵
  PID:1460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=4736,i,15506226710570674519,5243190865990907497,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4824 /prefetch:1
  2⤵
  PID:116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=3524,i,15506226710570674519,5243190865990907497,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:3640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=5636,i,15506226710570674519,5243190865990907497,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:1396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=5104,i,15506226710570674519,5243190865990907497,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:4092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4996,i,15506226710570674519,5243190865990907497,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4388 /prefetch:8
  2⤵
  PID:932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3532,i,15506226710570674519,5243190865990907497,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5364 /prefetch:8
  2⤵
  PID:1972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=5628,i,15506226710570674519,5243190865990907497,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4832 /prefetch:1
  2⤵
  PID:2976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=3476,i,15506226710570674519,5243190865990907497,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5456,i,15506226710570674519,5243190865990907497,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3208 /prefetch:8
  2⤵
  PID:740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=3456,i,15506226710570674519,5243190865990907497,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5484 /prefetch:8
  2⤵
  PID:4072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=3220,i,15506226710570674519,5243190865990907497,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5756 /prefetch:8
  2⤵
  PID:264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5076,i,15506226710570674519,5243190865990907497,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5940 /prefetch:8
  2⤵
  PID:3028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=4832,i,15506226710570674519,5243190865990907497,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6004 /prefetch:8
  2⤵
  PID:884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5768,i,15506226710570674519,5243190865990907497,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=860 /prefetch:8
  2⤵
  PID:3668
- C:\Users\Admin\Downloads\WarzoneRAT.exe
  "C:\Users\Admin\Downloads\WarzoneRAT.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  PID:2288
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jFvfxe" /XML "C:\Users\Admin\AppData\Local\Temp\tmpECBC.tmp"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2892
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:1348
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3384
- C:\Users\Admin\Downloads\WarzoneRAT.exe
  "C:\Users\Admin\Downloads\WarzoneRAT.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2004
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jFvfxe" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF141.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4484
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2280
- C:\Users\Admin\Downloads\WarzoneRAT.exe
  "C:\Users\Admin\Downloads\WarzoneRAT.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  PID:2340
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jFvfxe" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC4B.tmp"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2536
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:932
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4284
- C:\Users\Admin\Downloads\WarzoneRAT.exe
  "C:\Users\Admin\Downloads\WarzoneRAT.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4364
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jFvfxe" /XML "C:\Users\Admin\AppData\Local\Temp\tmp31B5.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1884
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5224,i,15506226710570674519,5243190865990907497,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5660 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=2360,i,15506226710570674519,5243190865990907497,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4428 /prefetch:8
  2⤵
  PID:1884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=6228,i,15506226710570674519,5243190865990907497,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1484 /prefetch:8
  2⤵
  PID:3860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=6108,i,15506226710570674519,5243190865990907497,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5360 /prefetch:8
  2⤵
  PID:3028
- C:\Users\Admin\Downloads\RevengeRAT.exe
  "C:\Users\Admin\Downloads\RevengeRAT.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:1984
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
    3⤵
    - Drops startup file
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    PID:3648
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2128
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\f5ejf2rw.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1144
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4930.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE2FFBC77EF948FB8EAB1B24C3386E5.TMP"
        5⤵
        
        PID:2268
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\4_k-5yof.cmdline"
      4⤵
      PID:3300
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4A49.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc95D436BAE898464EBFEE569898CC413E.TMP"
        5⤵
        
        PID:4644
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\voh1lfk3.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3516
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4B24.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc9A982A99E5274919A23974D450324AF9.TMP"
        5⤵
        
        PID:2312
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\06i72iuy.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2292
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4C0E.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc7B422B1A81A94887B51D1A5B7F6BC626.TMP"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1180
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\mcmej0gt.cmdline"
      4⤵
      PID:2160
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4D27.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4C578C49EB224273A59BF2A0E2EE4E.TMP"
        5⤵
        
        PID:4904
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\-frd_r98.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4372
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4DD3.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA4B91D6DDA0F412F9EA431A2213CA1B.TMP"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2528
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\l3q6oh7h.cmdline"
      4⤵
      PID:4616
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4E6F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc3D9F5F05DD034C919A3241A5EF56BF4.TMP"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3172
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\dxiw3qsw.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3772
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4EFC.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc981246D726B049FFBDE85A98B495FE68.TMP"
        5⤵
        
        PID:2312
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\pxddveyc.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1548
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4FB7.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc1DC2A20C646B4FA0A64B6A4D9DEF46BF.TMP"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1180
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\rlv6yhq4.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2884
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5073.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcDE0C1971F1C74710B4BC50E46D59F927.TMP"
        5⤵
        
        PID:4904
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\bilfh06i.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5004
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES519C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc2BC4C98AF6474E63A55B36A44496C23.TMP"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4568
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\bf5gbsia.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1744
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5238.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc12F96492125C40C8913482CF991DB4.TMP"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3172
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\9nd0ptdb.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3756
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES52F4.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4B53496BFA5647869D4D57727C9C79ED.TMP"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1984
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\23rm7tvf.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4376
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES539F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcBBEBA33110B0427181C668CF6F2BDAD6.TMP"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1180
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\znadkzfz.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1592
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES544B.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcC63998A4E52D4BD5AFF1B2B60ECE9C.TMP"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4904
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\0z-bayeu.cmdline"
      4⤵
      PID:5044
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES54F7.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc79199467D9C24E66A2285B116AF950.TMP"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4568
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ldcmze-r.cmdline"
      4⤵
      PID:456
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES570A.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc42A12B7B4D464F72832A094FE7BD85.TMP"
        5⤵
        
        PID:3944
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\umt3wyk1.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2520
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5797.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcAF29185EC910412489DCE1BEE854E552.TMP"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2700
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\nijn2rvt.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3772
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5824.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc3E25D50387BF40409C91ED3A68627622.TMP"
        5⤵
        
        PID:1180
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\uttabh-f.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4700
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES58B0.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD1956A6F28C4469858CDCA76DF46A31.TMP"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3408
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\cupfz7fs.cmdline"
      4⤵
      PID:1592
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES595C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE7D10BE21DFA4871A6622C781B972D78.TMP"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1960
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\u9ahqw3a.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5044
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES59E9.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc264D60BC5ED41798D467778E75D4C7.TMP"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1096
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      PID:980
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
        5⤵
        Drops startup file
        Adds Run key to start application
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:5096
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4920
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:1656
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\qelqs-sb.cmdline"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1540
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFAFB.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc901B546F9A0745BFB4AF5611B9FAC555.TMP"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3408
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\iyah5o_x.cmdline"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3084
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFC53.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc334E7AFFA8514F6AAA2685D3538D305.TMP"
        7⤵
        
        PID:428
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\qd3r8fkx.cmdline"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4820
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFCEF.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc427EA43F2BEF40D09F5252AB71D7BEBA.TMP"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2528
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\a7iuf2zw.cmdline"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5012
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFDBA.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc2174888A7D4C475E9156EAC11AFCBF54.TMP"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:244
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\6amel9yn.cmdline"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2248
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFE95.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcBAC8E5FE34184245A6835B245DB0FFB6.TMP"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2252
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\kkpdjmgt.cmdline"
        6⤵
        
        PID:1040
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFF60.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcBF5784AF501B4F7195C1E9AA16168C34.TMP"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3452
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\vv54rlwb.cmdline"
        6⤵
        
        PID:2520
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2B.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcCFA35D65CE1C4AD998C953801EF171AE.TMP"
        7⤵
        
        PID:2188
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\9wk9cjgk.cmdline"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2364
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC8.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA04ABE86725640A7A46E1C638448D6A.TMP"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4904
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\10qcscph.cmdline"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:428
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES183.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc8EC474FEF9004FDA83F57F815520FAE0.TMP"
        7⤵
        
        PID:1460
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\5vklyof3.cmdline"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3520
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES22F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc3702FF73F46C4E32B6F6FC6E8D6B920.TMP"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3172
- C:\Users\Admin\Downloads\RevengeRAT.exe
  "C:\Users\Admin\Downloads\RevengeRAT.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:3832
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    PID:3300
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:4488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=6216,i,15506226710570674519,5243190865990907497,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4672 /prefetch:8
  2⤵
  PID:3832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5984,i,15506226710570674519,5243190865990907497,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6132 /prefetch:8
  2⤵
  PID:2704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=1488,i,15506226710570674519,5243190865990907497,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6256 /prefetch:8
  2⤵
  PID:428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5948,i,15506226710570674519,5243190865990907497,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5780 /prefetch:8
  2⤵
  PID:4644
- C:\Users\Admin\Downloads\Hydra.exe
  "C:\Users\Admin\Downloads\Hydra.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2128

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:2976

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3160

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2016

C:\Users\Admin\Downloads\WarzoneRAT.exe
"C:\Users\Admin\Downloads\WarzoneRAT.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:1576
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jFvfxe" /XML "C:\Users\Admin\AppData\Local\Temp\tmp67D8.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:3200
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:4376
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:3380

C:\Users\Admin\Downloads\WarzoneRAT.exe
"C:\Users\Admin\Downloads\WarzoneRAT.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:1016
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jFvfxe" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7C4A.tmp"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4456
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:560

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3356

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3956
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  PID:4568
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\svchost\vcredist2010_x64.log-MSI_vc_red.msi.ico

Filesize
4KB

MD5
fde1b01ca49aa70922404cdfcf32a643

SHA1
b0a2002c39a37a0ccaf219d42f1075471fd8b481

SHA256
741fe085e34db44b7c8ae83288697fab1359b028411c45dab2a3ca8b9ea548a5

SHA512
b6b4af427069602e929c1a6ce9d88c4634f0927b7292efb4070d15fb40ce39fc5ce868452dcd5642b2864730502de7a4c33679c936beb1a86c26a753d3f4dc25

Download Submit
C:\ProgramData\svchost\vcredist2010_x64.log.ico

Filesize
4KB

MD5
bb4ff6746434c51de221387a31a00910

SHA1
43e764b72dc8de4f65d8cf15164fc7868aa76998

SHA256
546c4eeccca3320558d30eac5dc3d4726846bdc54af33aa63ac8f3e6fc128506

SHA512
1e4c405eca8d1b02147271095545434697d3d672310b4ea2ecca8715eaa9689be3f25c3d4898e7a4b42c413f258eda729a70f5ad8bc314a742082b5a6a8e9ff1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\55e956fd-0843-4318-8f7c-4bbc95bcc8be.tmp

Filesize
231KB

MD5
a9dec512a388f3eb2f233db99473082d

SHA1
aba08b7a5aabaa057775620c1abbec34b3f9ae1c

SHA256
9e5d53c8c4f2fc6ba8be816fb93defce00ab79564c178f7ada2208372069cc2b

SHA512
bcf6e309720bfb63983de433782bbd746eed214e609c5d3382ca6a1ced5bc2286d5fc0dc2d7207b9945ed7f05c9809b5856ffc80af682c3626515af08a9b59d7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
4df06214c3483fca1e7235ae75eb4b35

SHA1
2bc19ed981827aebe440d51ea0f43d597c2f0ccb

SHA256
9878bc17ccc3a7df5726ba99115247426a8dd5c4c7f923f5b46c660a17cde54e

SHA512
bcad8e9005f62c3cc609e905990bcc2a00bc4f5914a0f6f31b9dfb6fdf730013efc109bcd866ba218233cb268d9c6ef7ae649e5c5ba81366422188de15cb3840

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
2KB

MD5
622176eddd5c3a0d23e403d6ceca3322

SHA1
aec8fa311614e8c56bbe231e38b48418ad7378bb

SHA256
4981eb540ed92c16905931a1270c58a9036fd7daaf25079eea315a3b9b4594ba

SHA512
50b436c497b96a0d5a8e3ac207ffc4a69f203b39db5b5f3c640e79a80e0324450d7c92dee082bf31b35ed7ac92c7dd4954c3937e9aab0f98bf50e173a2fc5c9a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
e81f0fbd36c8879544ecd64350a6bc72

SHA1
edded254d671e3d5ae40e96ce40674db5e133629

SHA256
a187d013ff1ab302822d1b24c70a2d732a5b28b1ad09eea43b87527481f34906

SHA512
316c24f38e3109fa6e3767281c91ff690079bc9e066dae6eedea01418bb3fcc4579db89b3b91104c1ab8ee08d17056be99410de88a392bd89c106e560f558264

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.83.1_0\_locales\en_CA\messages.json

Filesize
851B

MD5
07ffbe5f24ca348723ff8c6c488abfb8

SHA1
6dc2851e39b2ee38f88cf5c35a90171dbea5b690

SHA256
6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c

SHA512
7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.83.1_0\dasherSettingSchema.json

Filesize
854B

MD5
4ec1df2da46182103d2ffc3b92d20ca5

SHA1
fb9d1ba3710cf31a87165317c6edc110e98994ce

SHA256
6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

SHA512
939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
8KB

MD5
37f65d2e4ffaf1ebd7ee17b91bd16491

SHA1
5fcfd9b2846c95c681653e4bc7a6386a01450e7c

SHA256
eec92d8dc0a6ce3cfd7881c9176779f837d275a4068971fe61385c65e682cee5

SHA512
b9df1a5fa35f615de9edaa47b63986bc01104fb3dd3bc367f87ae290bc01c622b4d9e8319dabb03c4dccbf5bca436180a13da197ec94c5a82decb056bf653554

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
7KB

MD5
87aa65b051af9272a58824e7a44f4886

SHA1
5e6a43de024ea7584593431ca9a66c2780ebb167

SHA256
31a54abe68af0750a276ee555ac71997eae15c69d5f3c598c484a5a3c76a48e5

SHA512
414271d4654bf9395c8f66526562cdb5efdbbfe569f075baf4ca2316b2df9844238e643f3ee557fec8ec94705a300793a71cdd09509209dd4c6a98392ef2c1f0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
8KB

MD5
e265684b398943f22ce88b584d5144a6

SHA1
b1f5f2984f4e43fab5e20b955efcdcf112918f89

SHA256
8884787059cef5717a43d7dc6fc5b8fd25408ed1049371da6da9995cfa79075d

SHA512
ff4de0a4197d099a9d4a727861d93f0ad55250e86054ef37febc0cbd68914329e59930bf0b24baddadadc2d253bd9ad1d1b48e2c0d26124300f90e29d5f3fbc3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
9e713931e023422a085d0afa5d923e5f

SHA1
8a67c5109fcf7e253a5a1b478a22f24732dffe0d

SHA256
598436473c0b31ae5c1d73fe8fdd03cf30beb6272dd1e142fbc6f0506ab1695a

SHA512
f1a6b457d94c1716368ebced0bc51a9ee6cb751a7d96b1f29ef2565c0a5c8910e1314d6d2a5c283bcb4bdba0a776a059af229bdc63a71bbd827eab3aed4e1414

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
a2d3c0b5b4f0c748d2c51a4f4e547b35

SHA1
b0b837f063764cb9fe722e80d62676f1f8f84960

SHA256
fddbdecdf1b01ba4c3af7bfb1e41cd14fb5af1760b9faef3310925a6c414aaa5

SHA512
7da0c83328b569c673fbb041bf35e4601215d77ed3f0ea28efab307e05e44e291b4d7e8701962d0f97af9356bfe62e0c911397be322d7d8fc6989fe615c48bd7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
fbcf7a5e88c2a19b66e66a62dc56b26f

SHA1
2e2144281d69cef074af5ce424949dec443e9e05

SHA256
f3ae895c9ff8001b31be6247631ab92e6c95eb340f64b034f55989f9e60486e8

SHA512
89e153d54a956cf4e274e79b34f5d06ff07e1eaec0db6b4ac7cab68f811c01eee0b088425c3ceac812f7444135616d08cb29c93ceefbf1e2a517c0e3ac090602

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
b9fcf9abc2301ec60f8df19e8860ec3d

SHA1
e0ede27b4982c9ad5390f5128425cec329551151

SHA256
bf415a2c78ee215261beeafca565833841efff73dc0cc35caa8d035999aee073

SHA512
c7344d7926111972ab330e8e6539be7551b560756077425d4ea2a26949eb09f18dbef652eb683d9ae33fc75363d5fae3d0bd6fc75adec21e091591ff303ac387

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
354B

MD5
a49c0cf07433e879aed1cdf1bce456e9

SHA1
96bc8487b9c761bec4b6ba8db381ce0f1378da77

SHA256
d58b62b23086cbe728832c92604a31686d046e58986ec2c6bf3b1adc5da590b0

SHA512
2068eb7e3a1e17362148dad988dd8d04b3a44b72fc38b0c40dd7bcdd91b9aebceef2b11d6ceaa7ab387dce51ae763bf01855c484e37d9bbcb48ef72324c6eae7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
8ed85484c834ff2b5851139b807f1203

SHA1
a839448c62212e779f0aa5fb8cb8171f17137dc2

SHA256
8357108c3b94ef726eaf20e9f5392ee1ad199a40b9186eb89faf9bcbd7b57e08

SHA512
7a6f2f8f09494b0a080b08b9e3ecd219bbda96fc9b1c0fdafbc67e07f58bb5d19689f74a3c73b04922285840c78196b7a299786c58ae3d296696d8bf4fbfc56d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
2ca963b7dd52bbd9a09db72b9e2b23d0

SHA1
26afc2b082956212480f3d77667372eaf97ed198

SHA256
a9b26ab41eb7d45522368a6fd1f0dbe6509b31599329110178f21675bf7ca38a

SHA512
d1009d719a9cc7981d5571c34bd5cf999ec0a9e40452919b4d4186aa95bbc686a3f0b20f51278efe24b3b118649d20350b69bdb1cdfd5c563fa6ce0aa07af864

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
fb95623e995cbb052a29b3f3185514f2

SHA1
744642993ca6324461371da7b8d613ef10dab06a

SHA256
78c195a2abf42454a3b27c2e991897b6556ca5ead82a0a4fabc785416e941688

SHA512
da7eb03cd4229088356f5387ae7bce0cfb0e1e8f1ef9b739111d5e2718a66c6ae5b7416290cd4e061e142089788099874413cef4a812dd66eb62479adcd0bdc1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
edbe4d7cda612ee3eb490aa22bf6e333

SHA1
639d093311896bee560054cebd8a37eeb55cc022

SHA256
7e9eb611aedb8181f408ac8755fa3dc4eeda2287590915f22fce31880f84a10c

SHA512
4c38b5471ab94da668d108631b8898cc28d31ec6f7e7c6fffff668795aa2cfd3afe40a1f35b6044c2eb6fae669bbfd6d4d8b9fa8d2632257ceb5096267226952

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
6ae3341689bcd90b29c4bab01ca47483

SHA1
dbeef0ea076d021f826ab75eb90c0bed62b46abe

SHA256
0877cd23560d0e3a98d622a202f658d79fe761a648954f7cd3836a5d803eed91

SHA512
2ca63fba9275653818faf7d69dfbf5225edf7a696ebb94b8f88b5918c680e94c8ed4cba256f25e65b5f70afe66880108c3110720f8d712992066caf0a9484580

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
197e380b377bdad681e868b8fd850891

SHA1
51e1a8ee1710b6135ca231713ef1f177a70cc5e7

SHA256
b7e7766c4ab78ec3d044a667be1909f1cb0240babb76a83ae40aa2cb41cea0e1

SHA512
219a5d6e4b19b6115230898bd9d381ab52b50e0cb8b20cda059e9383ae96dd3f0652451d24bfa0f3fa0b16c22e519b4eff70559cf140be33578fabf9e0974483

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
91c0367feb0a51cb24004095cef393fd

SHA1
7b31f2631b687a380fa4b8df97cb35492ca489bc

SHA256
67148c2f4b2fe66db0a4945349d8ce5e17b8f85bdfa58fe9a1f2afbe1197be85

SHA512
bf3700262f2a25d8f86fede81897f0677b8e6dcaadbdadd95ae19585d7ca366d3406c54b0779ec1b0e838c5b8a08d40aa1078515e1f48ac2efff322345c2a85c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
8b931047dcaf7c1e6fe1725a3eac75c0

SHA1
63843fc8a9dee0d5f06945b89ca485aa8ed4fa89

SHA256
c588782a83826a2bed7283aa96e6de3540be773d8b632141cefa3dba24f525b5

SHA512
8a0c79e0213a79a67695820c4a279e4e530b6ebfc3e8206425a2957f54b854a8713d57c5c718ac74dec57c03076c73c6051f1e4b745659484b22ac8be623c569

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
9fc1a63740402ff447bdadd77926da54

SHA1
fd2b6699d4db83b76b3a318dcd026f891c6a7fb6

SHA256
48f2d9f39f6848c2c140ed69a1d034ab99b92f270384dd267aa2c6ec7b637ab5

SHA512
610a1adc588df4bcdf78bf5bf34df0aca5c98b74534a161c473d3a5b6349b1484b6851e41804907cbfcdb51d446ca1ff017da95abd8c70d5c53c3029d59d1e4b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
dc280620d957a9167e24f6114c5b6cb1

SHA1
61bab10fa9d7c23aeb8cb9a79b1a7acc3757f402

SHA256
1eaa5f62c99063c2c5e46970d53a4f64eeba09511792555754c55c7d5376a5bd

SHA512
9cf1ad215026b61f347311b4ff6ba193346d2c66ddb70b12cc3105a4266a803338e39c7a16c9df4117f8f3949e0951956d7a5fcd2be3382bbf704be9afcb72a9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
dbaa7b2a14a5ba705c67731edc3e900f

SHA1
d09f4c1241a9915fc7f1b25dee0eb2e4ed6b896f

SHA256
0380c2ec742f19ce7da5ad6bea120e1adcb8aa8202eb1bb44cb0400bf4ab7358

SHA512
13bdf2efe165c4164a0095cef8e94b946d164701f519d07b31600856d626cd17df0800e8db0ce3fe433f091b40e90be47f6e71df2edd22cda29a058c7c529145

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
dd9c40a670fa6b86305253b3f083ab17

SHA1
9efa3ec0f98528535914331aaee93e48043f435e

SHA256
f19d1e2a6eefb9b47ae2f4321ac75b897dc1747960df5392956b7a849f16d823

SHA512
575f591e6fe59f22a473c2948dee1134648779d2ae7d99b4c07382347daaa267c8a0c15083fabf3ad5804cb59114d5a43a8c46a6447dfaa5c3a3dd30b1a6d4a8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
de3ca888d65363e38f2ea4463bf7e49a

SHA1
90965b71327546d68339eaa8063b8662aeb363ba

SHA256
c3092e161acc1a1d2218e846f0b5891fe595273d85b100262eaaf0de6a344bdd

SHA512
1534855e4b8626dac6153abc974ba4bf6c793503955abdf7092698f90f1b6ff14fc14eb2452564c5b4b6a2b54cdccb21b87f55ec6a56acd0204f955a99555f41

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
a0af9aa21c3121f02492b67d4d61bd41

SHA1
ea57175f91c1adc600504c12f88295c87a2a96cb

SHA256
14bdbcfc0307ab86ef5423bfde691866767ac176158175b25605eaa2050cf2d6

SHA512
e337226422e3f7b3f1b6db7d47431d747ba1f2d56f7e070a59a605a13774f85062d6ef8ef096d95d7a4e28ed1f6e914afba00ecef1f3505d3ab11a95018050eb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
c02698c54e20e656a5300627a9e3b6ed

SHA1
32e72395f817e6999a1d81b7572e32c877caa009

SHA256
6e5a1fee5cd2276985aba13af17dc2e7519698703e9e2b1e1d9bcf45925c6497

SHA512
15a9c8052d180c19a01305f31d52c0272c66c567bd4bae01dbfaefda00293eac0ca9291390487663c233ccdf3270abb268a0d847c6b96c88591f06c4494fbfb6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
003e217544251cdd8263d0153b454f5d

SHA1
0a49f6ccd6fe4ba8170ea75bbb11de6d72cffa85

SHA256
a836e5feed373b8939b97cfbdd0eaa342e85eb0478af941a6588e2dc46b88ec6

SHA512
a283530ae429a5fbb4137ffa32bce5a09e951741e98d03ee907700171db3504c1349a7d8da469e73319615a124f6b80459315a7aa7657685fbe4771636978ce8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
60df9cbc32d24f4e324eebe1874f8262

SHA1
b2e34c22d275afbd196717ff40d053cb3a749f9f

SHA256
dc800899a95566ce7426a7a48c23ef5e6997686efd0149c05378a147aa66c27a

SHA512
64d119b50fb6b80817fb49902fd2befa8cb429e37fd51975a3a0244052b4320783bec3273cf093b7c85fd8aaf4b5082a0bdd7c8bff57212f5a624237e81435f4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
5527adb7d510bf4b5aafc74ff4863df0

SHA1
f218d3b8811b6856f56de9d7da14c89bd16e8739

SHA256
8cada21d04d148b715cf2745dd5ddbbe608aaba8cba54487401a573dde94377c

SHA512
98c8f0b1ded7001b380b2cc15f86a88a5e0da4c03c75e15b3b8352c018d866fdeb26e0e68dca66c6ece7d57e5272aec72d482a905ae37847ec4b62e4eecf00dc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
a936c1da6867c8b48eac61485805c533

SHA1
15cdf40a293e895e5ea331d41a91648440d22952

SHA256
a20ab834ede75107194fcbb73ecdee41b0759378eb0d8d44d7faf0d0cecccedb

SHA512
1a063283968bb1576ec11ca222c000809067b2e29e4130cce8da1fc676c224191ec61433c8c57ede501e69c3f1b11cf7743b6ef23b88b84a0b0ec22fb78c6cb3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
08b9e469a3c598e0b9c956c2e7149a12

SHA1
303a766ef9148620ac7bda0e1ec591f178dd3030

SHA256
038740aac503a76cb29ea82a12bfd9bc06d0b4ec128ecb5689c89f7709ab7114

SHA512
b3d4664bcce3e4e5f842fab352faf220e0a96352de5dbc1be7c44d27c98b568c4f404eace0018095f8405e051e99cd232099e2409666fe2c0b6b8d260a825fe7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
dc4b83d70ea1c903009b56e9abe1ce82

SHA1
1b731143dc89462297a0d47e4685bf2437083fc6

SHA256
1a18098d959792632e394a2f9a60da8e650ca0196bf010e3661f45f5d4d4f487

SHA512
5eadaaf7afd01c04ab01bc1b20a9f342199b55ae84ae6ae8650cd5b702ba3696d3c875d8b37c43980d1e226ddb90fc7524aae13e207e02bf119b1e93cdc48877

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
33f024a943b39e12d10f3140516c520f

SHA1
b5c57e977472537436c4b76af07396ad3f2e35c8

SHA256
48ccbb7fe21da312a26e26a73a3931a1a9fe569fd1397d67d23b12c3672e2a7b

SHA512
0753c3298fbbe6c2bea4083c820cfe5acdf1e4c47d434b3378150d8ab573aee0780f265548ff8050e33ffc7cb83ae79ce892d77ca70348841f3a3ce665da0e5b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
190b5f2cf84e5581b7fd6969b25a3384

SHA1
05db0244ab2f2dee184369413772348f7271ee0a

SHA256
d8e25ab09b67f87814339980d96aa599ddc82d44bf1f0e426a17a3373ff85346

SHA512
3a03be7f304fd6e0b039e07d27b0a1e58f0d142066e1bd52a5c79f0465636bd9ff28a1b4d01ba9583bd42dcb2c43d5d9d6b9048a3b702022e0547e92cf9a02de

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
c01ba9618771901ce481c1a771306622

SHA1
e58c755e4f2e2f1d2ccc34265370f39c59adc315

SHA256
d37a12dd08a4c6d139a994bedd3437160e53839407bc5b21c8c8897629f786e0

SHA512
3220e67377df49b9da75cca857371536d1ccec53014b863705ace2e87a7dd3f7c81485da949cd28d59f6c6d959111f44d089526e88250c6b2211e0bf8376b63a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
13fe4173a01b4d0b6756afa9a673611d

SHA1
6a3cb43584229736ac1a4e35bd7224558c3d131b

SHA256
c13d0dd62b570ca54976c7dc4e72ee41fe2d09ccc58b900135a52173468eb929

SHA512
76e927f18e42a516d0a804824f74434b67d77ff1363e2f963e143de6462abe091fdd3e2956cfe152df46f883100506d958a96bcab8d301d6f800127b41459c33

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
c6aa96f197698f35047311c7b7fbe1da

SHA1
c67aad4d7c499988d803f87df0863ce0dfc3ac93

SHA256
670daea6aa3b63626df035b5cb4c1dc0964c846b1800db83b41c647a8df78763

SHA512
dca32899bed63092f97275849c3382db2fbecd5f900e3761274234fb201801a3ebd0edec533602f3c076bd3aca2de207c6c35f3f7e207bee94e61544126b0029

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\2\CacheStorage\index.txt

Filesize
76B

MD5
a7a2f6dbe4e14a9267f786d0d5e06097

SHA1
5513aebb0bda58551acacbfc338d903316851a7b

SHA256
dd9045ea2f3beaf0282320db70fdf395854071bf212ad747e8765837ec390cbc

SHA512
aa5d81e7ee3a646afec55aee5435dc84fe06d84d3e7e1c45c934f258292c0c4dc2f2853a13d2f2b37a98fe2f1dcc7639eacf51b09e7dcccb2e29c2cbd3ba1835

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\2\CacheStorage\index.txt~RFe587dd6.TMP

Filesize
140B

MD5
fba1046145fb3c85059fc30074ea4eab

SHA1
b4ea4733f7f95b7b76a87e833ade1ca50d1e834d

SHA256
30d73344355333b675f1dc1163ceb24510f415786fdc0fc06b9db5d8a2bdbf94

SHA512
cb3f81c89f8a6c2a9b8da855113114854237b65c5248422170fc37d7beebc0f722c85aa34cf53e83694160091b9de8e106b4bb0b36c76a9a1199e5d68ee987a3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\2\IndexedDB\indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
231KB

MD5
1ffab7da336ab3a96848e300e23b3d7a

SHA1
efab2749bf883862499ccad6ea65ae80719a1c3a

SHA256
d0483bd01f41862bfc13ee85dbfbc5f1c96b4385f603bd962841cc643c4524a3

SHA512
718efe4db6d11e4ba6791950eb830eb92a9d660d0081be4c6555186f547b040ac3a649b7ba357637406442b92960410272f510628242b1848d4ad0b4a2613dbb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
231KB

MD5
d53a4a787681f9084bca2131b2c8bae7

SHA1
b8837c48aaf285332a20163cba67557026772721

SHA256
30bb8638871053ced605e14e633779eac8a3770b7fe703de171587de298ac37d

SHA512
d88898f619759101d21f1cf67be887f9e7e2f087b1a417b70c2db40b9610f34fa660aeb8c055013c0a4e744b01fc45d7244953c0fab4f51e7cf9f591795cc98b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
231KB

MD5
e4d15f42ba9ca5707c4e9c14ca63e9b7

SHA1
19863e14a8f6379ba4411e91d44466e38b623ad6

SHA256
411815a762826c2da2f8fca779a721c2228a4e8156e5a0cc2465812bac5bf6bc

SHA512
72d123495edd3c6c6416462a2fb21d284d54818eb68355dacd4796c3e42f0a5f36f52bc1286272bda4aceed9d8bc22f68feafc76a0575f2bdc31915d4fde80f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\RegSvcs.exe.log

Filesize
120B

MD5
50dec1858e13f033e6dca3cbfad5e8de

SHA1
79ae1e9131b0faf215b499d2f7b4c595aa120925

SHA256
14a557e226e3ba8620bb3a70035e1e316f1e9fb5c9e8f74c07110ee90b8d8ae4

SHA512
1bd73338df685a5b57b0546e102ecfdee65800410d6f77845e50456ac70de72929088af19b59647f01cba7a5acfb399c52d9ef2402a9451366586862ef88e7bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\WarzoneRAT.exe.log

Filesize
507B

MD5
8cf94b5356be60247d331660005941ec

SHA1
fdedb361f40f22cb6a086c808fc0056d4e421131

SHA256
52a5b2d36f2b72cb02c695cf7ef46444dda73d4ea82a73e0894c805fa9987bc0

SHA512
b886dfc8bf03f8627f051fb6e2ac40ae2e7713584695a365728eb2e2c87217830029aa35bd129c642fa03dde3f7a7dd5690b16248676be60a6bb5f497fb23651

Download Submit
C:\Users\Admin\AppData\Local\Temp\4_k-5yof.0.vb

Filesize
355B

MD5
acd609faf5d65b35619397dc8a3bc721

SHA1
ba681e91613d275de4b51317a83e19de2dbf1399

SHA256
4cfd86d51d0133dda53ba74f67ffe1833b4c0e9aae57afe2405f181fc602f518

SHA512
400ffd60ce7201d65e685734cea47a96abca58ca2babda8654b1d25f82d2766ca862a34f46c827249a4dc191d48f56005a9f242765d7becdda1344b8741a9d8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\4_k-5yof.cmdline

Filesize
224B

MD5
a1f7ea5c3a54bef67956b94fc41d0538

SHA1
72834d0849d8e598b0ce7324191a0383eccd6a26

SHA256
70c44687bfc3e9d16550c71581f145f7f97cd66f3ad7e16ed57e4bc6df54e87b

SHA512
7fa70dd20b1866796ae6e7dfe56ff543bab59c74aec5a66b24b521b2e98831be19a0494cf57c898eb0a8f51f402a51935a7fee605212472cf18b451ba91e9f26

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES4930.tmp

Filesize
5KB

MD5
01e929fa697b99440b711b0728840c2f

SHA1
5703b0364ac98554ec803da04528d2a0c8a9dbef

SHA256
add36aedf0a5caf8198532d163f0ce16729d168b943234acaa5173f7e737451e

SHA512
02d85566eb300bdcabd8872ab56aca123517387c10e9b287a1d2db4ef2f232a1202106880c28fef89e1a07009f81042c467f74f7bfeef4b7083dfe7399ec0695

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES4A49.tmp

Filesize
5KB

MD5
edde9d12de94ddd1eb892f6734874e6c

SHA1
87f4ad8d53c65a2e835b05966cd99b8781836503

SHA256
487993b065bf9baa04bb0113a47e906933ea6d8a5ef07d2af5275ac37f9f63ac

SHA512
9fb2d659d1a5ac8df836a15d27b364d6a018f4b192293c23e49c084a8a8fefdb7b122f616de61cdd326ef1904f8444f8cb466fd2a462bf2f3c3deddf3b098821

Download Submit
C:\Users\Admin\AppData\Local\Temp\f5ejf2rw.0.vb

Filesize
369B

MD5
e4a08a8771d09ebc9b6f8c2579f79e49

SHA1
e9fcba487e1a511f4a3650ab5581911b5e88395d

SHA256
ef4c31d167a9ab650ace2442feeec1bf247e7c9813b86fbea973d2642fac1fb6

SHA512
48135e0de7b1a95d254ae351ccac0cb39c0d9a46c294507e4bf2b582c780c1b537487161396dd69584c23455950f88512e9931dbff4287c1072938e812a34dd1

Download Submit
C:\Users\Admin\AppData\Local\Temp\f5ejf2rw.cmdline

Filesize
253B

MD5
680657d958f03f64742f14f0e12b41ff

SHA1
c078c87c55a68e3dbef68e21b271931ca38d5e2f

SHA256
5a24ec4d95b2555c6cbab076898c2ae8e5d5f342602211ba47362d34af641970

SHA512
945413e6fe487755de3da34ab1cc3054f199d0f017e81d8e90f78fec0f96884419117a77b052a062582aa8eebf990de5036f420ce17bb984909c73d478607a5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir464_665746685\6424f816-8b33-4d13-8df5-b05bc12dbcc2.tmp

Filesize
132KB

MD5
da75bb05d10acc967eecaac040d3d733

SHA1
95c08e067df713af8992db113f7e9aec84f17181

SHA256
33ae9b8f06dc777bb1a65a6ba6c3f2a01b25cd1afc291426b46d1df27ea6e7e2

SHA512
56533de53872f023809a20d1ea8532cdc2260d40b05c5a7012c8e61576ff092f006a197f759c92c6b8c429eeec4bb542073b491ddcfd5b22cd4ecbe1a8a7c6ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir464_665746685\CRX_INSTALL\_locales\en_CA\messages.json

Filesize
711B

MD5
558659936250e03cc14b60ebf648aa09

SHA1
32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825

SHA256
2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b

SHA512
1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpECBC.tmp

Filesize
1KB

MD5
8012ef52233d0a09515ebe33f9531a2b

SHA1
94b109f4968335643329d91ca25c9c407377d3ba

SHA256
28d6a470f4a2711bef60e7096fffb7577a06bae1e3f8f186725abc85d86ff924

SHA512
9e5846cd762423383f527799e636c28fa112867e4fae5c2699f1081d613076be44ff782ea69c3e5f26d784d9994a340089baa542cdc90b64877e9c684f87c109

Download Submit
C:\Users\Admin\AppData\Local\Temp\uRClgZblR.txt

Filesize
39B

MD5
502984a8e7a0925ac8f79ef407382140

SHA1
0e047aa443d2101eb33ac4742720cb528d9d9dba

SHA256
d25b36f2f4f5ec765a39b82f9084a9bde7eb53ac12a001e7f02df9397b83446c

SHA512
6c721b4ae08538c7ec29979da81bc433c59d6d781e0ce68174e2d0ca1abf4dbc1c353510ce65639697380ccd637b9315662d1f686fea634b7e52621590bfef17

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc2174888A7D4C475E9156EAC11AFCBF54.TMP

Filesize
668B

MD5
3906bddee0286f09007add3cffcaa5d5

SHA1
0e7ec4da19db060ab3c90b19070d39699561aae2

SHA256
0deb26dcfb2f74e666344c39bd16544fcaae1a950be704b1fd4e146e77b12c00

SHA512
0a73de0e70211323d9a8469ec60042a6892426e30ad798a39864ba123c1905d6e22cb8458a446e2f45ec19cf0233fa18d90e5f87ec987b657a35e35a49fea3b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc95D436BAE898464EBFEE569898CC413E.TMP

Filesize
5KB

MD5
abeaa4a5b438ffa58d07d9459e5c1d6c

SHA1
69631de7891162dd4840112a251f6531feae7509

SHA256
ce174412cb2889bbf162b7ebe4476da5a9c928ba5b13111d338753ccc4c0f5fd

SHA512
c9cae8bcc14661e993d97a3c7b658310a8b9c19044817589f92eab66f1bcfcecb3468b0de8b45cd68e218c23cd9c60aeef1d391af36ec03afab5c8b86d7937d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbcA04ABE86725640A7A46E1C638448D6A.TMP

Filesize
644B

MD5
dac60af34e6b37e2ce48ac2551aee4e7

SHA1
968c21d77c1f80b3e962d928c35893dbc8f12c09

SHA256
2edc4ef99552bd0fbc52d0792de6aaa85527621f5c56d0340d9a2963cbc9eed6

SHA512
1f1badd87be7c366221eaa184ae9b9ae0593a793f37e3c1ce2d4669c83f06de470053550890ad6781b323b201a8b9d45a5e2df5b88e01c460df45278e1228084

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbcBAC8E5FE34184245A6835B245DB0FFB6.TMP

Filesize
676B

MD5
85c61c03055878407f9433e0cc278eb7

SHA1
15a60f1519aefb81cb63c5993400dd7d31b1202f

SHA256
f0c9936a6fa84969548f9ffb4185b7380ceef7e8b17a3e7520e4acd1e369234b

SHA512
7099b06ac453208b8d7692882a76baceec3749d5e19abc1287783691a10c739210f6bdc3ee60592de8402ca0b9a864eb6613f77914b76aec1fc35157d0741756

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbcE2FFBC77EF948FB8EAB1B24C3386E5.TMP

Filesize
5KB

MD5
249d49f34404bfbe7ed958880be39f61

SHA1
51ec83fb9190df984bf73f2c5cd1edc0edf1882a

SHA256
fcb5a4d24f24fbeaf4dc9d8e29f2701b2bb71411acb13c4fa67fe7025892912b

SHA512
082f47f59b9184dd6c88f64214e10b82656a09c5a5cf3f0eccbf7935505db473eeb9a395cb5b59ec5009e731f2aa1891670c94ff6315a0b2d4fcc0392cff0e98

Download Submit
C:\Users\Admin\AppData\Local\Temp\voh1lfk3.0.vb

Filesize
369B

MD5
83f6067bca9ba771f1e1b22f3ad09be3

SHA1
f9144948829a08e507b26084b1d1b83acef1baca

SHA256
098cd6d0243a78a14ce3b52628b309b3a6ac6176e185baf6173e8083182d2231

SHA512
b93883c7018fdd015b2ef2e0f4f15184f2954c522fd818e4d8680c06063e018c6c2c7ae9d738b462268b0a4a0fe3e8418db49942105534361429aa431fb9db19

Download Submit
C:\Users\Admin\AppData\Local\Temp\voh1lfk3.cmdline

Filesize
253B

MD5
535f5525d76aa5cbbf0264b384534c5e

SHA1
83beb495e99bda6bf06cac9396f6d841bd95e7f2

SHA256
cebf8d4a8599326ea04d1845fac0a4cb5dea4bf84c4b780ae9640cfa489635a1

SHA512
2e2a302e6728eefe87dd5863266587a9b81198db9554a03b77cbd14a36e59441aa3a0cc857c2033f7abd9700ff2fc4c9d9ce85ad8bfe07cc6c5624514ffd2ff3

Download Submit
C:\Users\Admin\Downloads\Hydra.exe

Filesize
43KB

MD5
b2eca909a91e1946457a0b36eaf90930

SHA1
3200c4e4d0d4ece2b2aadb6939be59b91954bcfa

SHA256
0b6c0af51cde971b3e5f8aa204f8205418ab8c180b79a5ac1c11a6e0676f0f7c

SHA512
607d20e4a46932c7f4d9609ef9451e2303cd79e7c4778fe03f444e7dc800d6de7537fd2648c7c476b9f098588dc447e8c39d8b21cd528d002dfa513a19c6ebbf

Download Submit
C:\Users\Admin\Downloads\RevengeRAT.exe

Filesize
4.0MB

MD5
1d9045870dbd31e2e399a4e8ecd9302f

SHA1
7857c1ebfd1b37756d106027ed03121d8e7887cf

SHA256
9b4826b8876ca2f1378b1dfe47b0c0d6e972bf9f0b3a36e299b26fbc86283885

SHA512
9419ed0a1c5e43f48a3534e36be9b2b03738e017c327e13586601381a8342c4c9b09aa9b89f80414d0d458284d2d17f48d27934a6b2d6d49450d045f49c10909

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 90383.crdownload

Filesize
321KB

MD5
600e0dbaefc03f7bf50abb0def3fb465

SHA1
1b5f0ac48e06edc4ed8243be61d71077f770f2b4

SHA256
61e6a93f43049712b5f2d949fd233fa8015fe4bef01b9e1285d3d87b12f894f2

SHA512
151eebac8f8f6e72d130114f030f048dff5bce0f99ff8d3a22e8fed7616155b3e87d29acf79f488d6b53ed2c5c9b05b57f76f1f91a568c21fe9bca228efb23d9

Download Submit
\??\pipe\crashpad_464_QNNCBDEAHDTZTDGJ

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1984-1035-0x000000001C910000-0x000000001C972000-memory.dmp

Filesize
392KB

Download
memory/1984-1034-0x000000001BDA0000-0x000000001BE46000-memory.dmp

Filesize
664KB

Download
memory/1984-1033-0x000000001C330000-0x000000001C7FE000-memory.dmp

Filesize
4.8MB

Download
memory/2128-1038-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2128-1395-0x00000000004A0000-0x00000000004B0000-memory.dmp

Filesize
64KB

Download
memory/2128-1396-0x0000000004F00000-0x0000000004F0A000-memory.dmp

Filesize
40KB

Download
memory/2288-914-0x0000000004EF0000-0x0000000004EF8000-memory.dmp

Filesize
32KB

Download
memory/2288-913-0x0000000004F20000-0x0000000004FB2000-memory.dmp

Filesize
584KB

Download
memory/2288-911-0x0000000000120000-0x0000000000176000-memory.dmp

Filesize
344KB

Download
memory/2288-912-0x0000000005330000-0x00000000058D4000-memory.dmp

Filesize
5.6MB

Download
memory/2288-916-0x00000000052A0000-0x00000000052C8000-memory.dmp

Filesize
160KB

Download
memory/2288-915-0x00000000058E0000-0x000000000597C000-memory.dmp

Filesize
624KB

Download
memory/3356-1068-0x000001E7BEE40000-0x000001E7BEE41000-memory.dmp

Filesize
4KB

Download
memory/3356-1063-0x000001E7BEE40000-0x000001E7BEE41000-memory.dmp

Filesize
4KB

Download
memory/3356-1064-0x000001E7BEE40000-0x000001E7BEE41000-memory.dmp

Filesize
4KB

Download
memory/3356-1065-0x000001E7BEE40000-0x000001E7BEE41000-memory.dmp

Filesize
4KB

Download
memory/3356-1066-0x000001E7BEE40000-0x000001E7BEE41000-memory.dmp

Filesize
4KB

Download
memory/3356-1067-0x000001E7BEE40000-0x000001E7BEE41000-memory.dmp

Filesize
4KB

Download
memory/3356-1062-0x000001E7BEE40000-0x000001E7BEE41000-memory.dmp

Filesize
4KB

Download
memory/3356-1058-0x000001E7BEE40000-0x000001E7BEE41000-memory.dmp

Filesize
4KB

Download
memory/3356-1057-0x000001E7BEE40000-0x000001E7BEE41000-memory.dmp

Filesize
4KB

Download
memory/3356-1056-0x000001E7BEE40000-0x000001E7BEE41000-memory.dmp

Filesize
4KB

Download
memory/3384-924-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/3384-922-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/5096-1330-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download