revengerat | hxxps://cdn[.]discordapp[.]com/attachments/1313969251027128395/1317947051119743006/Void-Activator[.]exe?ex=67784457&is=6776f2d7&hm=f6d5e98cc3b69545e18a8b8b1aade95386350d8082702365e8e58134c47d7d18&

Analysis

max time kernel
487s
max time network
490s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241211-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
02-01-2025 23:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/1313969251027128395/1317947051119743006/Void-Activator.exe?ex=67784457&is=6776f2d7&hm=f6d5e98cc3b69545e18a8b8b1aade95386350d8082702365e8e58134c47d7d18&

Score

10^/10

revengerat guest discovery evasion persistence privilege_escalation trojan upx

Malware Config

Extracted

Family

revengerat

Botnet

Guest

0.tcp.ngrok.io:19521

Mutex

RV_MUTEX

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat
Revengerat family
revengerat

Modifies Windows Firewall 2 TTPs 18 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
7128	netsh.exe
5728	netsh.exe
5456	netsh.exe
6596	netsh.exe
6492	netsh.exe
3704	netsh.exe
5700	netsh.exe
5356	netsh.exe
5508	netsh.exe
6816	netsh.exe
5992	netsh.exe
6900	netsh.exe
5760	netsh.exe
5468	netsh.exe
6964	netsh.exe
5988	netsh.exe
6364	netsh.exe
3496	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1411052346-3904498293-150013998-1000\Control Panel\International\Geo\Nation	cmd.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe	RegSvcs.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe	RegSvcs.exe

Executes dropped EXE 3 IoCs

pid	Process
2348	ddraw32.dll
4880	ddraw32.dll
988	svchost.exe

Unexpected DNS network traffic destination 6 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	208.67.222.222

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	Void-Activator.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1411052346-3904498293-150013998-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\svchost.exe"	RegSvcs.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 14 IoCs

Web Service

T1102

flow	ioc
440	raw.githubusercontent.com
616	0.tcp.ngrok.io
465	0.tcp.ngrok.io
575	0.tcp.ngrok.io
624	0.tcp.ngrok.io
441	raw.githubusercontent.com
446	raw.githubusercontent.com
447	raw.githubusercontent.com
496	camo.githubusercontent.com
501	0.tcp.ngrok.io
439	raw.githubusercontent.com
444	raw.githubusercontent.com
445	raw.githubusercontent.com
495	camo.githubusercontent.com

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ddraw32.dll	Bumerang.exe

Suspicious use of SetThreadContext 8 IoCs

description	pid	Process	procid_target
PID 3100 set thread context of 1284	3100	RevengeRAT.exe	155
PID 1284 set thread context of 1020	1284	RegSvcs.exe	156
PID 4968 set thread context of 4536	4968	RevengeRAT.exe	159
PID 4536 set thread context of 2928	4536	RegSvcs.exe	160
PID 1376 set thread context of 3640	1376	RevengeRAT.exe	163
PID 3640 set thread context of 4980	3640	RegSvcs.exe	164
PID 988 set thread context of 60	988	svchost.exe	232
PID 60 set thread context of 924	60	RegSvcs.exe	233

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3696-66-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral1/memory/3696-71-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral1/memory/2348-72-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral1/memory/4880-77-0x0000000000400000-0x0000000000410000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\CBS\CBS.log	TiWorker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 60 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1740	2348	WerFault.exe	146

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
1408	netsh.exe
6416	netsh.exe

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4944	timeout.exe

Gathers network information 2 TTPs 4 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
6588	ipconfig.exe
5992	ipconfig.exe
5624	ipconfig.exe
6260	ipconfig.exe

Gathers system information 1 TTPs 2 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
5828	systeminfo.exe
5444	systeminfo.exe

Kills process with taskkill 4 IoCs

evasion

pid	Process
5820	taskkill.exe
5700	taskkill.exe
5332	taskkill.exe
5420	taskkill.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1411052346-3904498293-150013998-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1411052346-3904498293-150013998-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1411052346-3904498293-150013998-1000_Classes\Local Settings	firefox.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5640	schtasks.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
6444	WMIC.exe
6444	WMIC.exe
6444	WMIC.exe
6444	WMIC.exe
6900	WMIC.exe
6900	WMIC.exe
6900	WMIC.exe
6900	WMIC.exe
2520	WMIC.exe
2520	WMIC.exe
2520	WMIC.exe
2520	WMIC.exe
6316	WMIC.exe
6316	WMIC.exe
6316	WMIC.exe
6316	WMIC.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5444	OpenWith.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3100	RevengeRAT.exe
Token: SeDebugPrivilege	1284	RegSvcs.exe
Token: SeDebugPrivilege	4968	RevengeRAT.exe
Token: SeDebugPrivilege	4536	RegSvcs.exe
Token: SeDebugPrivilege	1376	RevengeRAT.exe
Token: SeDebugPrivilege	3640	RegSvcs.exe
Token: SeDebugPrivilege	988	svchost.exe
Token: SeDebugPrivilege	60	RegSvcs.exe
Token: SeDebugPrivilege	5516	firefox.exe
Token: SeDebugPrivilege	5516	firefox.exe
Token: SeIncreaseQuotaPrivilege	6444	WMIC.exe
Token: SeSecurityPrivilege	6444	WMIC.exe
Token: SeTakeOwnershipPrivilege	6444	WMIC.exe
Token: SeLoadDriverPrivilege	6444	WMIC.exe
Token: SeSystemProfilePrivilege	6444	WMIC.exe
Token: SeSystemtimePrivilege	6444	WMIC.exe
Token: SeProfSingleProcessPrivilege	6444	WMIC.exe
Token: SeIncBasePriorityPrivilege	6444	WMIC.exe
Token: SeCreatePagefilePrivilege	6444	WMIC.exe
Token: SeBackupPrivilege	6444	WMIC.exe
Token: SeRestorePrivilege	6444	WMIC.exe
Token: SeShutdownPrivilege	6444	WMIC.exe
Token: SeDebugPrivilege	6444	WMIC.exe
Token: SeSystemEnvironmentPrivilege	6444	WMIC.exe
Token: SeRemoteShutdownPrivilege	6444	WMIC.exe
Token: SeUndockPrivilege	6444	WMIC.exe
Token: SeManageVolumePrivilege	6444	WMIC.exe
Token: 33	6444	WMIC.exe
Token: 34	6444	WMIC.exe
Token: 35	6444	WMIC.exe
Token: 36	6444	WMIC.exe
Token: SeIncreaseQuotaPrivilege	6444	WMIC.exe
Token: SeSecurityPrivilege	6444	WMIC.exe
Token: SeTakeOwnershipPrivilege	6444	WMIC.exe
Token: SeLoadDriverPrivilege	6444	WMIC.exe
Token: SeSystemProfilePrivilege	6444	WMIC.exe
Token: SeSystemtimePrivilege	6444	WMIC.exe
Token: SeProfSingleProcessPrivilege	6444	WMIC.exe
Token: SeIncBasePriorityPrivilege	6444	WMIC.exe
Token: SeCreatePagefilePrivilege	6444	WMIC.exe
Token: SeBackupPrivilege	6444	WMIC.exe
Token: SeRestorePrivilege	6444	WMIC.exe
Token: SeShutdownPrivilege	6444	WMIC.exe
Token: SeDebugPrivilege	6444	WMIC.exe
Token: SeSystemEnvironmentPrivilege	6444	WMIC.exe
Token: SeRemoteShutdownPrivilege	6444	WMIC.exe
Token: SeUndockPrivilege	6444	WMIC.exe
Token: SeManageVolumePrivilege	6444	WMIC.exe
Token: 33	6444	WMIC.exe
Token: 34	6444	WMIC.exe
Token: 35	6444	WMIC.exe
Token: 36	6444	WMIC.exe
Token: SeIncreaseQuotaPrivilege	6900	WMIC.exe
Token: SeSecurityPrivilege	6900	WMIC.exe
Token: SeTakeOwnershipPrivilege	6900	WMIC.exe
Token: SeLoadDriverPrivilege	6900	WMIC.exe
Token: SeSystemProfilePrivilege	6900	WMIC.exe
Token: SeSystemtimePrivilege	6900	WMIC.exe
Token: SeProfSingleProcessPrivilege	6900	WMIC.exe
Token: SeIncBasePriorityPrivilege	6900	WMIC.exe
Token: SeCreatePagefilePrivilege	6900	WMIC.exe
Token: SeBackupPrivilege	6900	WMIC.exe
Token: SeRestorePrivilege	6900	WMIC.exe
Token: SeShutdownPrivilege	6900	WMIC.exe

Suspicious use of FindShellTrayWindow 21 IoCs

pid	Process
5516	firefox.exe
5516	firefox.exe
5516	firefox.exe
5516	firefox.exe
5516	firefox.exe
5516	firefox.exe
5516	firefox.exe
5516	firefox.exe
5516	firefox.exe
5516	firefox.exe
5516	firefox.exe
5516	firefox.exe
5516	firefox.exe
5516	firefox.exe
5516	firefox.exe
5516	firefox.exe
5516	firefox.exe
5516	firefox.exe
5516	firefox.exe
5516	firefox.exe
5516	firefox.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
5516	firefox.exe
5516	firefox.exe
5516	firefox.exe
5516	firefox.exe
5516	firefox.exe
5516	firefox.exe
5516	firefox.exe
5516	firefox.exe
5516	firefox.exe
5516	firefox.exe
5516	firefox.exe
5516	firefox.exe
5516	firefox.exe
5516	firefox.exe
5516	firefox.exe
5516	firefox.exe
5516	firefox.exe
5516	firefox.exe
5516	firefox.exe
5516	firefox.exe

Suspicious use of SetWindowsHookEx 18 IoCs

pid	Process
5444	OpenWith.exe
5444	OpenWith.exe
5444	OpenWith.exe
5444	OpenWith.exe
5444	OpenWith.exe
5444	OpenWith.exe
5444	OpenWith.exe
5444	OpenWith.exe
5444	OpenWith.exe
5444	OpenWith.exe
5444	OpenWith.exe
5444	OpenWith.exe
5444	OpenWith.exe
5444	OpenWith.exe
5444	OpenWith.exe
5444	OpenWith.exe
5444	OpenWith.exe
5516	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3088 wrote to memory of 2872	3088	Void-Activator.exe	118
PID 3088 wrote to memory of 2872	3088	Void-Activator.exe	118
PID 2872 wrote to memory of 2812	2872	cmd.exe	120
PID 2872 wrote to memory of 2812	2872	cmd.exe	120
PID 2872 wrote to memory of 4780	2872	cmd.exe	121
PID 2872 wrote to memory of 4780	2872	cmd.exe	121
PID 2872 wrote to memory of 1132	2872	cmd.exe	122
PID 2872 wrote to memory of 1132	2872	cmd.exe	122
PID 1132 wrote to memory of 1516	1132	net.exe	123
PID 1132 wrote to memory of 1516	1132	net.exe	123
PID 2872 wrote to memory of 4944	2872	cmd.exe	125
PID 2872 wrote to memory of 4944	2872	cmd.exe	125
PID 2872 wrote to memory of 2428	2872	cmd.exe	126
PID 2872 wrote to memory of 2428	2872	cmd.exe	126
PID 2872 wrote to memory of 1940	2872	cmd.exe	127
PID 2872 wrote to memory of 1940	2872	cmd.exe	127
PID 2872 wrote to memory of 2324	2872	cmd.exe	128
PID 2872 wrote to memory of 2324	2872	cmd.exe	128
PID 3696 wrote to memory of 2348	3696	Bumerang.exe	146
PID 3696 wrote to memory of 2348	3696	Bumerang.exe	146
PID 3696 wrote to memory of 2348	3696	Bumerang.exe	146
PID 3696 wrote to memory of 4880	3696	Bumerang.exe	147
PID 3696 wrote to memory of 4880	3696	Bumerang.exe	147
PID 3696 wrote to memory of 4880	3696	Bumerang.exe	147
PID 3100 wrote to memory of 1284	3100	RevengeRAT.exe	155
PID 3100 wrote to memory of 1284	3100	RevengeRAT.exe	155
PID 3100 wrote to memory of 1284	3100	RevengeRAT.exe	155
PID 3100 wrote to memory of 1284	3100	RevengeRAT.exe	155
PID 3100 wrote to memory of 1284	3100	RevengeRAT.exe	155
PID 3100 wrote to memory of 1284	3100	RevengeRAT.exe	155
PID 3100 wrote to memory of 1284	3100	RevengeRAT.exe	155
PID 1284 wrote to memory of 1020	1284	RegSvcs.exe	156
PID 1284 wrote to memory of 1020	1284	RegSvcs.exe	156
PID 1284 wrote to memory of 1020	1284	RegSvcs.exe	156
PID 1284 wrote to memory of 1020	1284	RegSvcs.exe	156
PID 1284 wrote to memory of 1020	1284	RegSvcs.exe	156
PID 1284 wrote to memory of 1020	1284	RegSvcs.exe	156
PID 1284 wrote to memory of 1020	1284	RegSvcs.exe	156
PID 1284 wrote to memory of 1020	1284	RegSvcs.exe	156
PID 4968 wrote to memory of 4536	4968	RevengeRAT.exe	159
PID 4968 wrote to memory of 4536	4968	RevengeRAT.exe	159
PID 4968 wrote to memory of 4536	4968	RevengeRAT.exe	159
PID 4968 wrote to memory of 4536	4968	RevengeRAT.exe	159
PID 4968 wrote to memory of 4536	4968	RevengeRAT.exe	159
PID 4968 wrote to memory of 4536	4968	RevengeRAT.exe	159
PID 4968 wrote to memory of 4536	4968	RevengeRAT.exe	159
PID 4536 wrote to memory of 2928	4536	RegSvcs.exe	160
PID 4536 wrote to memory of 2928	4536	RegSvcs.exe	160
PID 4536 wrote to memory of 2928	4536	RegSvcs.exe	160
PID 4536 wrote to memory of 2928	4536	RegSvcs.exe	160
PID 4536 wrote to memory of 2928	4536	RegSvcs.exe	160
PID 4536 wrote to memory of 2928	4536	RegSvcs.exe	160
PID 4536 wrote to memory of 2928	4536	RegSvcs.exe	160
PID 4536 wrote to memory of 2928	4536	RegSvcs.exe	160
PID 1376 wrote to memory of 3640	1376	RevengeRAT.exe	163
PID 1376 wrote to memory of 3640	1376	RevengeRAT.exe	163
PID 1376 wrote to memory of 3640	1376	RevengeRAT.exe	163
PID 1376 wrote to memory of 3640	1376	RevengeRAT.exe	163
PID 1376 wrote to memory of 3640	1376	RevengeRAT.exe	163
PID 1376 wrote to memory of 3640	1376	RevengeRAT.exe	163
PID 1376 wrote to memory of 3640	1376	RevengeRAT.exe	163
PID 3640 wrote to memory of 4980	3640	RegSvcs.exe	164
PID 3640 wrote to memory of 4980	3640	RegSvcs.exe	164
PID 3640 wrote to memory of 4980	3640	RegSvcs.exe	164

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://cdn.discordapp.com/attachments/1313969251027128395/1317947051119743006/Void-Activator.exe?ex=67784457&is=6776f2d7&hm=f6d5e98cc3b69545e18a8b8b1aade95386350d8082702365e8e58134c47d7d18&
1⤵
PID:4644

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations=is-enterprise-managed=no --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --field-trial-handle=5200,i,418820165226066361,4591810059585231024,262144 --variations-seed-version --mojo-platform-channel-handle=3788 /prefetch:1
1⤵
PID:3596

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations=is-enterprise-managed=no --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --field-trial-handle=4148,i,418820165226066361,4591810059585231024,262144 --variations-seed-version --mojo-platform-channel-handle=4024 /prefetch:1
1⤵
PID:1724

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations=is-enterprise-managed=no --field-trial-handle=5588,i,418820165226066361,4591810059585231024,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:8
1⤵
PID:1188

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --string-annotations=is-enterprise-managed=no --field-trial-handle=5624,i,418820165226066361,4591810059585231024,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:8
1⤵
PID:3152

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --string-annotations=is-enterprise-managed=no --field-trial-handle=6392,i,418820165226066361,4591810059585231024,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:8
1⤵
PID:4164

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations=is-enterprise-managed=no --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=29 --field-trial-handle=6412,i,418820165226066361,4591810059585231024,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:1
1⤵
PID:556

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations=is-enterprise-managed=no --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=30 --field-trial-handle=6964,i,418820165226066361,4591810059585231024,262144 --variations-seed-version --mojo-platform-channel-handle=6972 /prefetch:1
1⤵
PID:2688

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations=is-enterprise-managed=no --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=31 --field-trial-handle=4156,i,418820165226066361,4591810059585231024,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:1
1⤵
PID:1168

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --string-annotations=is-enterprise-managed=no --field-trial-handle=7184,i,418820165226066361,4591810059585231024,262144 --variations-seed-version --mojo-platform-channel-handle=7172 /prefetch:8
1⤵
PID:4584

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=no --field-trial-handle=7464,i,418820165226066361,4591810059585231024,262144 --variations-seed-version --mojo-platform-channel-handle=7472 /prefetch:8
1⤵
PID:2396

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2208

C:\Users\Admin\Downloads\Void-Activator.exe
"C:\Users\Admin\Downloads\Void-Activator.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3088
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c "void 0.2.bat"
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2872
- - C:\Windows\system32\mode.com
    mode con cols=123 lines=30
    3⤵
    PID:2812
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:4780
- - C:\Windows\system32\net.exe
    NET FILE
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1132
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 FILE
      4⤵
      PID:1516
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4944
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Windows\system32\slmgr.vbs" /ipk MH37W-N47XK-V7XM9-C7227-GCQG9
    3⤵
    PID:2428
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Windows\system32\slmgr.vbs" /skms kms8.msguides.com
    3⤵
    PID:1940
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Windows\system32\slmgr.vbs" /ato
    3⤵
    PID:2324

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --string-annotations=is-enterprise-managed=no --field-trial-handle=5640,i,418820165226066361,4591810059585231024,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:8
1⤵
PID:1276

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations=is-enterprise-managed=no --instant-process --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=35 --field-trial-handle=5772,i,418820165226066361,4591810059585231024,262144 --variations-seed-version --mojo-platform-channel-handle=4652 /prefetch:1
1⤵
PID:3520

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations=is-enterprise-managed=no --field-trial-handle=6024,i,418820165226066361,4591810059585231024,262144 --variations-seed-version --mojo-platform-channel-handle=7056 /prefetch:8
1⤵
PID:4540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations=is-enterprise-managed=no --field-trial-handle=6388,i,418820165226066361,4591810059585231024,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:8
1⤵
PID:1920

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations=is-enterprise-managed=no --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=38 --field-trial-handle=7488,i,418820165226066361,4591810059585231024,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:1
1⤵
PID:1688

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations=is-enterprise-managed=no --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=39 --field-trial-handle=7648,i,418820165226066361,4591810059585231024,262144 --variations-seed-version --mojo-platform-channel-handle=7688 /prefetch:1
1⤵
PID:1088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations=is-enterprise-managed=no --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=40 --field-trial-handle=7824,i,418820165226066361,4591810059585231024,262144 --variations-seed-version --mojo-platform-channel-handle=7844 /prefetch:1
1⤵
PID:5040

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations=is-enterprise-managed=no --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=41 --field-trial-handle=7764,i,418820165226066361,4591810059585231024,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:1
1⤵
PID:5004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations=is-enterprise-managed=no --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=42 --field-trial-handle=7996,i,418820165226066361,4591810059585231024,262144 --variations-seed-version --mojo-platform-channel-handle=8056 /prefetch:1
1⤵
PID:4620

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations=is-enterprise-managed=no --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=43 --field-trial-handle=7712,i,418820165226066361,4591810059585231024,262144 --variations-seed-version --mojo-platform-channel-handle=7540 /prefetch:1
1⤵
PID:1808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations=is-enterprise-managed=no --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=44 --field-trial-handle=4032,i,418820165226066361,4591810059585231024,262144 --variations-seed-version --mojo-platform-channel-handle=7640 /prefetch:1
1⤵
PID:1096

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations=is-enterprise-managed=no --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=45 --field-trial-handle=5600,i,418820165226066361,4591810059585231024,262144 --variations-seed-version --mojo-platform-channel-handle=7492 /prefetch:1
1⤵
PID:1660

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations=is-enterprise-managed=no --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=46 --field-trial-handle=6072,i,418820165226066361,4591810059585231024,262144 --variations-seed-version --mojo-platform-channel-handle=8384 /prefetch:1
1⤵
PID:2708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --string-annotations=is-enterprise-managed=no --field-trial-handle=3164,i,418820165226066361,4591810059585231024,262144 --variations-seed-version --mojo-platform-channel-handle=8540 /prefetch:8
1⤵
PID:3100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations=is-enterprise-managed=no --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=48 --field-trial-handle=8680,i,418820165226066361,4591810059585231024,262144 --variations-seed-version --mojo-platform-channel-handle=8720 /prefetch:1
1⤵
PID:1808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=no --field-trial-handle=8872,i,418820165226066361,4591810059585231024,262144 --variations-seed-version --mojo-platform-channel-handle=8636 /prefetch:8
1⤵
PID:1916

C:\Users\Admin\Downloads\Bumerang.exe
"C:\Users\Admin\Downloads\Bumerang.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3696
- C:\Windows\SysWOW64\ddraw32.dll
  C:\Windows\system32\ddraw32.dll
  2⤵
  - Executes dropped EXE
  PID:2348
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2348 -s 360
    3⤵
    - Program crash
    PID:1740
- C:\Windows\SysWOW64\ddraw32.dll
  C:\Windows\system32\ddraw32.dll :C:\Users\Admin\Downloads\Bumerang.exe
  2⤵
  - Executes dropped EXE
  PID:4880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2348 -ip 2348
1⤵
PID:3632

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations=is-enterprise-managed=no --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=50 --field-trial-handle=8444,i,418820165226066361,4591810059585231024,262144 --variations-seed-version --mojo-platform-channel-handle=8448 /prefetch:1
1⤵
PID:1056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=no --field-trial-handle=8736,i,418820165226066361,4591810059585231024,262144 --variations-seed-version --mojo-platform-channel-handle=8764 /prefetch:8
1⤵
PID:4420

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --string-annotations=is-enterprise-managed=no --field-trial-handle=8236,i,418820165226066361,4591810059585231024,262144 --variations-seed-version --mojo-platform-channel-handle=8384 /prefetch:8
1⤵
PID:1280

C:\Users\Admin\Downloads\RevengeRAT.exe
"C:\Users\Admin\Downloads\RevengeRAT.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3100
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
  2⤵
  - Drops startup file
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1284
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
    3⤵
    PID:1020
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\t52-b__l.cmdline"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1372
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1139.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcC67D24038A144D7D9C6390A617514FF9.TMP"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1972
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\a2fi9_5e.cmdline"
    3⤵
    PID:2284
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1242.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcFF75E43FE84E4BAD8BA88C283F9C846C.TMP"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1656
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\gp00q6p2.cmdline"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1968
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES130E.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc5B46B90E50384C008E4E3E3423C719.TMP"
      4⤵
      PID:4460
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\uoa7l-qs.cmdline"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1972
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES13D9.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc8192B8A46CE447C5A874B580DEC4898.TMP"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1928
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\emcg_p7h.cmdline"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4236
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1494.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc526EA5B66C343B685C51128A4DB7693.TMP"
      4⤵
      PID:2216
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\58u8j2hg.cmdline"
    3⤵
    PID:420
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES155F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc2550D4C780D84ABEA1D1F14E9C69EC50.TMP"
      4⤵
      PID:1968
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\fyrerjkh.cmdline"
    3⤵
    PID:3704
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES161B.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcF097608B63E14DD4B8F59492DE7CB7.TMP"
      4⤵
      PID:1656
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\_s3pvbcm.cmdline"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1312
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1724.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc21116D12A40245B6B46DDA93DC08CA3.TMP"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1972
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\i43gm9ql.cmdline"
    3⤵
    PID:1372
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES17E0.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA925537DCA9D439BB4999A4B1BCD918A.TMP"
      4⤵
      System Location Discovery: System Language Discovery
      PID:420
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\oq1ayfn3.cmdline"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1656
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES187C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4C26A6AADD39413399792498A1DDA12E.TMP"
      4⤵
      PID:4236
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\lmrp6uuw.cmdline"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1972
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1918.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB7A1C0AD7F7E4EB286771DF8A7B562.TMP"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2284
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\9enfmnf1.cmdline"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3704
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES19C4.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc66FE09AF35DE4141A61FD7A05DB92EA0.TMP"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1928
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\t8h-vze6.cmdline"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3632
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1A80.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc6F77F9C9D90F4038916CA67BC972D013.TMP"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2508
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\mcn8m_w5.cmdline"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1928
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1B1C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc686F731C9115434A86CC3DF73786AE71.TMP"
      4⤵
      PID:1840
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\mkqkyy8x.cmdline"
    3⤵
    PID:2508
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1BC8.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc1AFF730168E426F8D339923463A3A90.TMP"
      4⤵
      System Location Discovery: System Language Discovery
      PID:420
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\9eznh1kq.cmdline"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4236
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1C74.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc3D4191AA3024962B819259DA39DB39.TMP"
      4⤵
      PID:1656
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\b7omdnui.cmdline"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1968
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1D4F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc9531F80040F94F0B8A5AB5EC1DB86376.TMP"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1372
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\z6nz167u.cmdline"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4236
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1DDB.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcCF95A658176C4EF08FFC19243CA9BD17.TMP"
      4⤵
      System Location Discovery: System Language Discovery
      PID:420
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\cckajf8b.cmdline"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2216
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1EB6.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc1BB68ACFC5C8426CB3FDF54F3961755.TMP"
      4⤵
      PID:3704
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\z4pzeyzl.cmdline"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1092
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1F62.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc47ADC9519E7946D98F9E4A772D32B137.TMP"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1656
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\z6dlnfmo.cmdline"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1656
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES201D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc8B4CDC6B3929494AA4542DA72B757F40.TMP"
      4⤵
      PID:2284
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of AdjustPrivilegeToken
    PID:988
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      Drops startup file
      Adds Run key to start application
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:60
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:924
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:5640
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\2rehftyo.cmdline"
        5⤵
        
        PID:5720
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC2F5.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc565910F3ED1A438CBE4C6CDA4FE3FA14.TMP"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5788
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\rsvkb6g-.cmdline"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5832
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC45C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcF96BDBB158EC4A83B1352FB46A995137.TMP"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5900
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\t8_8h-nn.cmdline"
        5⤵
        
        PID:5940
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC4E9.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD70D6F0949234BA393C416EB4F656FD3.TMP"
        6⤵
        
        PID:6004
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ekqcvnid.cmdline"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7016
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES83DF.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD009403E1B92485BAB251A2EA979AED.TMP"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6508
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\sv4fnhmw.cmdline"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6336
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ecafidul.cmdline"
        5⤵
        
        PID:1376
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES84B9.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc20055CFE2DA342B0AABB49BA2413F585.TMP"
        6⤵
        
        PID:4088
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\bitv9vyw.cmdline"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6260
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8585.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc772C2A72B2DC481595E5D04FA454D42B.TMP"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6296
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\yjehqkbg.cmdline"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5216
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8630.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc6939FC62B7C44784A9C62BE729F2B7DA.TMP"
        6⤵
        
        PID:6596
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\dbqnesli.cmdline"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:236
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES86DC.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc8909082966D74F999668E3B7B1D285B1.TMP"
        6⤵
        
        PID:6600
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\vqgr-mtc.cmdline"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6612
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8769.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc7D25A1AF5D0D4476BE9885F1C03EED6E.TMP"
        6⤵
        
        PID:6444
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ed0pghve.cmdline"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5336
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8824.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc82A964612F9E440CADD27240C51AAF57.TMP"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5908
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\dl3utfjr.cmdline"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5544
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES88E0.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc721F58DCA9B94B9EA15935279CDDFE2D.TMP"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1788
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ipij9mzm.cmdline"
        5⤵
        
        PID:6724
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES898C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB5559F4019B44B00A05B7189DC7CFE.TMP"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5836
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\xepqduqh.cmdline"
        5⤵
        
        PID:6196
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8A18.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4677F27B94074A38AC2F68B3234CBDE.TMP"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3576
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\r0u8zeto.cmdline"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5016
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8AC4.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc53EEB602D9B42DCACE81C7149CB265.TMP"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2980
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\avauezuk.cmdline"
        5⤵
        
        PID:3812
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8B61.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc2620D638DE3341D995288B2C67EBFF86.TMP"
        6⤵
        
        PID:4196
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\bbazu1o8.cmdline"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2036
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8C0C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcF0F58B35FA647AD9A9AAA74D59AB10.TMP"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2900
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\2v-jzfa5.cmdline"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6204
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8C99.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc5542008683244D308B678FE659CD497.TMP"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6524
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\dj4hwkog.cmdline"
        5⤵
        
        PID:3168
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8D64.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc757156A852994AF688EE32958F2239DA.TMP"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5480
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\wfsx9l6y.cmdline"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4160
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8E10.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc8BF87F78348B4CD2BDD0799C9A1783A5.TMP"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6084
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\pw9jzkzx.cmdline"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6104
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8EBC.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcC277A189872841BC87F07F3194A3DB44.TMP"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7140
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\fvu92_97.cmdline"
        5⤵
        
        PID:1408
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8F58.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcECC5BF71CB3247858410C5A444C9938A.TMP"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2812
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\zkv9d99f.cmdline"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6260
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9014.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc9B8094726A204A32803B4F7A42F067BD.TMP"
        6⤵
        
        PID:6384

C:\Users\Admin\Downloads\RevengeRAT.exe
"C:\Users\Admin\Downloads\RevengeRAT.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4968
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4536
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2928

C:\Users\Admin\Downloads\RevengeRAT.exe
"C:\Users\Admin\Downloads\RevengeRAT.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1376
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3640
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4980

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations=is-enterprise-managed=no --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=53 --field-trial-handle=8836,i,418820165226066361,4591810059585231024,262144 --variations-seed-version --mojo-platform-channel-handle=8852 /prefetch:1
1⤵
PID:4420

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations=is-enterprise-managed=no --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=54 --field-trial-handle=8520,i,418820165226066361,4591810059585231024,262144 --variations-seed-version --mojo-platform-channel-handle=8700 /prefetch:1
1⤵
PID:2756

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations=is-enterprise-managed=no --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=55 --field-trial-handle=8928,i,418820165226066361,4591810059585231024,262144 --variations-seed-version --mojo-platform-channel-handle=8620 /prefetch:1
1⤵
PID:2172

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations=is-enterprise-managed=no --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=56 --field-trial-handle=8744,i,418820165226066361,4591810059585231024,262144 --variations-seed-version --mojo-platform-channel-handle=8752 /prefetch:1
1⤵
PID:3088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations=is-enterprise-managed=no --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=57 --field-trial-handle=9432,i,418820165226066361,4591810059585231024,262144 --variations-seed-version --mojo-platform-channel-handle=9452 /prefetch:1
1⤵
PID:5232

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations=is-enterprise-managed=no --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=58 --field-trial-handle=9644,i,418820165226066361,4591810059585231024,262144 --variations-seed-version --mojo-platform-channel-handle=9664 /prefetch:1
1⤵
PID:5312

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations=is-enterprise-managed=no --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=59 --field-trial-handle=9508,i,418820165226066361,4591810059585231024,262144 --variations-seed-version --mojo-platform-channel-handle=9840 /prefetch:1
1⤵
PID:5408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --lang=en-US --service-sandbox-type=service --string-annotations=is-enterprise-managed=no --field-trial-handle=9820,i,418820165226066361,4591810059585231024,262144 --variations-seed-version --mojo-platform-channel-handle=9784 /prefetch:8
1⤵
PID:5416

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=no --field-trial-handle=9396,i,418820165226066361,4591810059585231024,262144 --variations-seed-version --mojo-platform-channel-handle=9816 /prefetch:8
1⤵
PID:5516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations=is-enterprise-managed=no --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=62 --field-trial-handle=9740,i,418820165226066361,4591810059585231024,262144 --variations-seed-version --mojo-platform-channel-handle=9668 /prefetch:1
1⤵
PID:4020

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=no --field-trial-handle=9764,i,418820165226066361,4591810059585231024,262144 --variations-seed-version --mojo-platform-channel-handle=9976 /prefetch:8
1⤵
PID:1924

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5444
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Downloads\DridexLoader.bin.exe.c26203af4b3e9c81a9e634178b603601"
  2⤵
  PID:5588
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\Downloads\DridexLoader.bin.exe.c26203af4b3e9c81a9e634178b603601
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:5516
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1940 -parentBuildID 20240401114208 -prefsHandle 1868 -prefMapHandle 1856 -prefsLen 23839 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {def1ac83-977f-4105-9c28-aa75b9b659c4} 5516 "\\.\pipe\gecko-crash-server-pipe.5516" gpu
      4⤵
      PID:5896
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2392 -parentBuildID 20240401114208 -prefsHandle 2384 -prefMapHandle 2380 -prefsLen 24759 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1f904495-9622-457a-933d-35eb64d55eea} 5516 "\\.\pipe\gecko-crash-server-pipe.5516" socket
      4⤵
      Checks processor information in registry
      PID:5868
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3100 -childID 1 -isForBrowser -prefsHandle 3112 -prefMapHandle 2684 -prefsLen 24900 -prefMapSize 244658 -jsInitHandle 1280 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d80ab44c-fbe9-4242-b1e7-634d4481e1ef} 5516 "\\.\pipe\gecko-crash-server-pipe.5516" tab
      4⤵
      PID:1788
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4104 -childID 2 -isForBrowser -prefsHandle 4116 -prefMapHandle 4112 -prefsLen 29249 -prefMapSize 244658 -jsInitHandle 1280 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {50bc220e-fd4e-4e6b-8744-cc352f1fc718} 5516 "\\.\pipe\gecko-crash-server-pipe.5516" tab
      4⤵
      PID:4504
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4940 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 5012 -prefMapHandle 5008 -prefsLen 29303 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9fa286cd-dcf4-4211-aaec-c64b0f30c462} 5516 "\\.\pipe\gecko-crash-server-pipe.5516" utility
      4⤵
      Checks processor information in registry
      PID:6908
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5412 -childID 3 -isForBrowser -prefsHandle 5460 -prefMapHandle 5432 -prefsLen 27145 -prefMapSize 244658 -jsInitHandle 1280 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {548f3d43-4fd2-48a1-82df-7ba3dd97ce49} 5516 "\\.\pipe\gecko-crash-server-pipe.5516" tab
      4⤵
      PID:6348
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5596 -childID 4 -isForBrowser -prefsHandle 5676 -prefMapHandle 5672 -prefsLen 27145 -prefMapSize 244658 -jsInitHandle 1280 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {057c6942-622b-4dc3-a9ef-ad0aca8d95af} 5516 "\\.\pipe\gecko-crash-server-pipe.5516" tab
      4⤵
      PID:6324
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5804 -childID 5 -isForBrowser -prefsHandle 5880 -prefMapHandle 5876 -prefsLen 27145 -prefMapSize 244658 -jsInitHandle 1280 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9c7156e6-ace8-4cdd-822a-50087d9ea831} 5516 "\\.\pipe\gecko-crash-server-pipe.5516" tab
      4⤵
      PID:6368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations=is-enterprise-managed=no --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=64 --field-trial-handle=10040,i,418820165226066361,4591810059585231024,262144 --variations-seed-version --mojo-platform-channel-handle=9952 /prefetch:1
1⤵
PID:7112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations=is-enterprise-managed=no --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=65 --field-trial-handle=9692,i,418820165226066361,4591810059585231024,262144 --variations-seed-version --mojo-platform-channel-handle=9488 /prefetch:1
1⤵
PID:4708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations=is-enterprise-managed=no --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=66 --field-trial-handle=9856,i,418820165226066361,4591810059585231024,262144 --variations-seed-version --mojo-platform-channel-handle=10112 /prefetch:1
1⤵
PID:6332

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --lang=en-US --service-sandbox-type=service --string-annotations=is-enterprise-managed=no --field-trial-handle=9224,i,418820165226066361,4591810059585231024,262144 --variations-seed-version --mojo-platform-channel-handle=9220 /prefetch:8
1⤵
PID:6372

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=no --field-trial-handle=9968,i,418820165226066361,4591810059585231024,262144 --variations-seed-version --mojo-platform-channel-handle=10468 /prefetch:8
1⤵
PID:5880

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations=is-enterprise-managed=no --field-trial-handle=9348,i,418820165226066361,4591810059585231024,262144 --variations-seed-version --mojo-platform-channel-handle=9460 /prefetch:8
1⤵
PID:6188

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\9a2be4cabbe3eb29b470400e6092327a-5ac86aff5c0b6b05dcbdcb1998abf6d3072e676f\Malware.bat" "
1⤵
PID:6200
- C:\Windows\system32\nslookup.exe
  nslookup myip.opendns.com resolver1.opendns.com
  2⤵
  PID:6620
- C:\Windows\system32\netsh.exe
  netsh wlan show profiles
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:6416
- C:\Windows\system32\ipconfig.exe
  ipconfig
  2⤵
  - Gathers network information
  PID:6588
- C:\Windows\system32\ipconfig.exe
  ipconfig
  2⤵
  - Gathers network information
  PID:5992
- C:\Windows\system32\find.exe
  find /i "IPv4"
  2⤵
  PID:2736
- C:\Windows\System32\Wbem\WMIC.exe
  wmic diskdrive get size
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6444
- C:\Windows\System32\Wbem\WMIC.exe
  wmic cpu get name
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6900
- C:\Windows\system32\systeminfo.exe
  systeminfo
  2⤵
  - Gathers system information
  PID:5828
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall add rule name="Port 1122 TCP" dir=in action=allow protocol=TCP localport=
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:3704
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall add rule name="Port 1122 UDP" dir=in action=allow protocol=UDP localport=
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:7128
- C:\Windows\system32\netsh.exe
  netsh firewall set opmode disable
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:5700
- C:\Windows\system32\netsh.exe
  netsh firewall set opmode mode=DISABLE
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:5728
- C:\Windows\system32\netsh.exe
  netsh advfirewall set currentprofile state off
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:5760
- C:\Windows\system32\netsh.exe
  netsh advfirewall set domainprofile state off
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:5356
- C:\Windows\system32\netsh.exe
  netsh advfirewall set privateprofile state off
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:5456
- C:\Windows\system32\netsh.exe
  netsh advfirewall set publicprofile state off
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:5468
- C:\Windows\system32\netsh.exe
  netsh advfirewall set allprofiles state off
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:5508

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.4467_none_7e0f83e07c8c1985\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.4467_none_7e0f83e07c8c1985\TiWorker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:5968

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Desktop\9a2be4cabbe3eb29b470400e6092327a-5ac86aff5c0b6b05dcbdcb1998abf6d3072e676f\Malware.bat"
1⤵
PID:6532
- C:\Windows\system32\nslookup.exe
  nslookup myip.opendns.com resolver1.opendns.com
  2⤵
  PID:1840
- C:\Windows\system32\netsh.exe
  netsh wlan show profiles
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:1408
- C:\Windows\system32\ipconfig.exe
  ipconfig
  2⤵
  - Gathers network information
  PID:5624
- C:\Windows\system32\ipconfig.exe
  ipconfig
  2⤵
  - Gathers network information
  PID:6260
- C:\Windows\system32\find.exe
  find /i "IPv4"
  2⤵
  PID:4624
- C:\Windows\System32\Wbem\WMIC.exe
  wmic diskdrive get size
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2520
- C:\Windows\System32\Wbem\WMIC.exe
  wmic cpu get name
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6316
- C:\Windows\system32\systeminfo.exe
  systeminfo
  2⤵
  - Gathers system information
  PID:5444
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall add rule name="Port 1122 TCP" dir=in action=allow protocol=TCP localport=
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:6596
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall add rule name="Port 1122 UDP" dir=in action=allow protocol=UDP localport=
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:6816
- C:\Windows\system32\netsh.exe
  netsh firewall set opmode disable
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:6364
- C:\Windows\system32\netsh.exe
  netsh firewall set opmode mode=DISABLE
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:6492
- C:\Windows\system32\netsh.exe
  netsh advfirewall set currentprofile state off
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:5992
- C:\Windows\system32\netsh.exe
  netsh advfirewall set domainprofile state off
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:6964
- C:\Windows\system32\netsh.exe
  netsh advfirewall set privateprofile state off
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:6900
- C:\Windows\system32\netsh.exe
  netsh advfirewall set publicprofile state off
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:5988
- C:\Windows\system32\netsh.exe
  netsh advfirewall set allprofiles state off
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:3496
- C:\Windows\system32\mode.com
  mode 1000
  2⤵
  PID:2460
- C:\Windows\system32\net.exe
  net stop "Windows Defender Service"
  2⤵
  PID:6128
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "Windows Defender Service"
    3⤵
    PID:5312
- C:\Windows\system32\net.exe
  net stop "Windows Firewall"
  2⤵
  PID:5352
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "Windows Firewall"
    3⤵
    PID:5836
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM "chrome.exe" /T
  2⤵
  - Kills process with taskkill
  PID:5820
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM "firefox.exe" /T
  2⤵
  - Kills process with taskkill
  PID:5700
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM "ProcessHacker.exe" /T
  2⤵
  - Kills process with taskkill
  PID:5332
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM "explorer.exe" /T
  2⤵
  - Kills process with taskkill
  PID:5420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\svchost\vcredist2012_x86_0_vcRuntimeMinimum_x86.ico

Filesize
4KB

MD5
fde1b01ca49aa70922404cdfcf32a643

SHA1
b0a2002c39a37a0ccaf219d42f1075471fd8b481

SHA256
741fe085e34db44b7c8ae83288697fab1359b028411c45dab2a3ca8b9ea548a5

SHA512
b6b4af427069602e929c1a6ce9d88c4634f0927b7292efb4070d15fb40ce39fc5ce868452dcd5642b2864730502de7a4c33679c936beb1a86c26a753d3f4dc25

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\igamsxea.default-release\activity-stream.discovery_stream.json

Filesize
22KB

MD5
9ed6b94319adc7f97fce6793f19edd63

SHA1
77fe588422166bb42d16b145e5246241e04c72b4

SHA256
0dd608b19bde4d28d72b561547b3038598bb4b48fecab33439699f2300b41338

SHA512
b66f4cfe775579131ac1ee533c7b8287e782f8a85b63f3f79b50ae03a9d6299ea7249ee255f38b239b44f5773f9af60cafad9d102afd7259d313818281cfdb80

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\igamsxea.default-release\AlternateServices.bin

Filesize
6KB

MD5
90fb3a9017661c66071130186cc35da2

SHA1
6206cea4c273f8eb66f4154663b0052987cc9eb3

SHA256
3d826b4b5841a46cd4f2679d7b16c5234496c21b24a50bc51f9964cf26d9a1f3

SHA512
5df0c09acba8f1e4fb7a51d06d393ec171013617d970ba31857834a05998b75d0f933e5f67d6fa6d52c07ce20ee1931f0f865106263797383562a092d7997a24

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\igamsxea.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
0c30d45df93286b3de3a41a9e546d73e

SHA1
5334f27fc95fda5a4e0794c166a52849d8b7baa2

SHA256
4eb044c0856b85da7a7d2646c6f22259ddeba482396b5c20569808dc424d97ed

SHA512
ed03e87528fb1924b39ef0ec6bd833d77346818d7ce75d620909da1f6dad71d18bd115f40c2b9ebacaacda274d00f2491ddf2ff1f12b03fcde07147658776b57

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\igamsxea.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
6ad3d51120b4ba3ae713c102d3141a95

SHA1
f4dd94175ac4ee05b29b824282c67e37a71a2ddc

SHA256
dddac20efad117f2fad7416f329778ec681cad2886c922eae68a58dd1a6f3c70

SHA512
c72881214aba6cf9488ae7bc9e8eb389cd9988c6b0fec616decea48d56572e04dc2d1b30a9efdb5346867ffc4a06bcfec24c3e47955cf4163c2b624dd429f6b6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\igamsxea.default-release\datareporting\glean\pending_pings\8fbab1a7-68b2-4044-b27c-08006d3b9d43

Filesize
24KB

MD5
f8c4141e8551b1af51a3f4c883f35262

SHA1
bab16b28ed9ef7e6c20f82bccd90231172681ea8

SHA256
9432431a00770a16508b556f796b2674cbba0d1bff01f67f3390278e3bff6de2

SHA512
2ac918a05be2a31980c025f9b91d252fa96d09773abf2cab29485397c384686808fd70f98fa5856f18b5707ad65527a734e8d59188c69dd976c12a57cd36f7a2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\igamsxea.default-release\datareporting\glean\pending_pings\98ecf3d3-5177-4255-8f85-31754158e3bf

Filesize
982B

MD5
688c34f4a2646867a011202afd3c2063

SHA1
f7583d80b9974c407ddb69f51eac0f2d4d890307

SHA256
9d9e4421331e8962e583c42f4a837f5cfcbc66fbf412b0c361f6a7ea003d10c1

SHA512
2da9a970d9444459185f43cc90751dc3aff1bac95d838fa236891f9d5428fd114797b29f22a863b4ffdef765ef63f5464a5901499ad463588397d8ae17cd5143

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\igamsxea.default-release\datareporting\glean\pending_pings\e3c3d7b8-cba9-4f38-b68b-c54c5ecc09ac

Filesize
671B

MD5
4961224fae69fd0ac50ae1f4779cbe24

SHA1
ce5b69fdb41f736c35a4fb7c80a78bf9774e58e6

SHA256
ba18c0a8a59460c3a4298999a0e04773253475e5e7939fb555c2699b0b118c16

SHA512
5b412d2d8fca5ee71282b7b9a9b64ea89a0ab513ca920a5ecef0c8395d2b35b5c57bf2e5235b66d38b033db1fdf332d5320c04a82295f14a8f28a99b67ac478c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\igamsxea.default-release\prefs-1.js

Filesize
10KB

MD5
f3a0db8ff08bcaba152735c54af7d420

SHA1
75e52d0f609937b7f53d0071160e2346b51ca31f

SHA256
01568b2b6218e66dfd0569453ded258b930cb5467965a9c5bdc4b3379b86dfce

SHA512
fa87f9ea865a168b27deadc03b051fd589ebd9725edd73df8fced705e59250581945470a6ef124560ded523720384e9877d5790fdffc5bed946be723aa3de29f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\igamsxea.default-release\prefs.js

Filesize
10KB

MD5
989ba699dae2efa2597a9bca5f59025d

SHA1
1aecf2ece554d9dfa3bb4b4029e1d5ccc939bccd

SHA256
eabef7b3626f577cc55ce6c783c37cf5b3d524369377476f466fc37622bb76e5

SHA512
804bb49f2c24f55c8d6f9fd5f41d14e0266686f6414741f5a42b825321d9884d71acd37551b972b976bd84fcb4afaace66d1578e9f7b8eed16e8744daea5db03

Download Submit
C:\Users\Admin\Desktop\AssertSearch.pptx

Filesize
104KB

MD5
f47f4ceb8dcf98bb943bebd03b8f8e93

SHA1
f5a9f72789fa5727a8e8c88017b4ed093ec8be53

SHA256
fcf645f003339812fc708e7f2a89e00a27ee0804b52989587e7f23c56b23be27

SHA512
a84befb785273a122e31d4ad0ec1db76cbb1ac7c8cac903e1efdda1a3625e1fa4af809e82b53bae07cf0563071e4e2e57c6641f7ba371503e8204d8019da82f2

Download Submit
C:\Users\Admin\Desktop\BackupClear.lnk

Filesize
359KB

MD5
16f8fa2cb5dfdeadc071b52fda9b9d9d

SHA1
476e58703b0120561e1e843eb29b401a9822c5eb

SHA256
0e689ea36def5fb603153dba4aab78dbdcc21bcef128d0578b1794c4576ae3cb

SHA512
9173783e4d83a492a4c66c38f7f5e6dc60893047e22c5a2908f175ba384f6dc052864efc688562a69c48c453944f053c362ec62a7c500b524c43a8eefc85ddec

Download Submit
C:\Users\Admin\Desktop\CheckpointDisable.AAC

Filesize
261KB

MD5
44abacac7c23358ce320de649521fae0

SHA1
71e6df3553be0790d3c746ceb2eba332f8484297

SHA256
ef0b761d772f243530f661b7ed36c973bc056cf1200e5a978e036af5be1cc7bf

SHA512
087de20c6f6bf323b33820ca5f649560cc80a8792a444e7366cf4a73a3a3b016d0b752c69923f2322b5fb9268aac5515d668d8c2c4d8478ad991f5df0c2d26dd

Download Submit
C:\Users\Admin\Desktop\ClearDeny.xps

Filesize
235KB

MD5
116243e73ad5e36f4c87f93f0a1e9cb6

SHA1
34cb4e1a0fc57868d48ec0dd7a7f60937e05b193

SHA256
f530cd9440a8799759aac06d5c35c07517dae107ca7f5f96a16b0948be804ba3

SHA512
c07b86bebb04ec685ab875f54130efa24b5794fa94288b939a6651f46a79619c79bac43f804871b299c655aab2b9b9af5f06eaadf3f15c24d3698227d93e5738

Download Submit
C:\Users\Admin\Desktop\ClearRevoke.dib

Filesize
143KB

MD5
806a77cc52755a5208d238117e64a7c5

SHA1
a34fafafec539ff0f0039f5c1b17aa0046be5c7c

SHA256
5bcfa9319945ea7efe557fce06d72edc683f1cb862ff162a77211e60cff900c7

SHA512
d03489894f0f79bdf6e27c53f2ad57570d0975fd14485c3aee9054a8c36ae91bf2e99277f57f6ca78abb129e1c71d86a785eba486028a312ceb47d7e815f0e79

Download Submit
C:\Users\Admin\Desktop\CloseInvoke.ps1

Filesize
163KB

MD5
2e15f2b50137b58cdbca2ab704654bb5

SHA1
ff78ace95b0fa8638d57b6d548a82f5e165c3550

SHA256
9a608782b19785d0105c721ece3cfac11cac5aff8d38b5d63b7c4f6ca2db69e1

SHA512
0116adbbf69358136dfbf83821290a91643657582396f758127b4db94118386e63214ca83c03eede8e81af0b7ebc7f87c1c744ee674433328a17be8d72be0fbf

Download Submit
C:\Users\Admin\Desktop\CompleteCheckpoint.DVR-MS

Filesize
97KB

MD5
7f207b7898384c6305e6e1a7d6745951

SHA1
722e3978e06dc6bf401016d7a86c385122d0b708

SHA256
25b943618891bea7a99f60e65f361a2e7410f8aec26f9ce63b787ba1c101dec3

SHA512
05fb4536d8ab7b96387f898405e839cb3fe7c32034afe8ea3f2b0abf69f754fa5c675d3dbc752ab295f7339fbffb6ad445985111bb1dd885c8558ef07b89639b

Download Submit
C:\Users\Admin\Desktop\ConvertFromBlock.ADTS

Filesize
169KB

MD5
9bfb8e27d9ed5fd2a7963b863b31fc66

SHA1
223763daf9d87f7b1516991c90ff1729a6675f44

SHA256
bac8878914ce4aa923e1e21ca853cded2a86e7fd2003a6de58b2e9f8c0302ca5

SHA512
e8eeaeb3567621b5653b14fbe402a6471888145bb7bab671f85c90ae08f9abd8bf0998e07b137d624374901d0d744b41f9d978e2d54582f7512812627a8fa3f0

Download Submit
C:\Users\Admin\Desktop\DisableClear.jpg

Filesize
208KB

MD5
f0a385d324470b86c2e901f800f596e3

SHA1
0f64532f3addef4e544837dac381a18004065202

SHA256
d5b4f24affedf84a850db7ba6052cc9aa181ed144f2d7633a99c72ea13f8ef33

SHA512
2660a6630a227f801d2bd8bd8e677313d9e60f2892b38a73a96aa816cfbd01f3a3fb01ca4c26623755ad3d7eb7405bf79aff42f55fd71f51dfd8396213d1c6ac

Download Submit
C:\Users\Admin\Desktop\DisableRename.TTS

Filesize
189KB

MD5
78d955a4d68561f1e147ae3d1a183c79

SHA1
9be87320259d83e5ded9a8ac4d80583a80aaa611

SHA256
b592313e62515b86f37acd2c27fd955c9795dd00736fc498ba3b5a96f4b0313b

SHA512
a857a73382078818f35d39a345761c97fa508c917e9fcc80059b6eb0a021bdfe718d7e432492cbff6ec5451eb83c2910bec961526e6182a7ce99d8efbcf703c8

Download Submit
C:\Users\Admin\Desktop\DisconnectUnblock.mid

Filesize
176KB

MD5
5a3c263d1798daff050281752073e1f6

SHA1
07c89e6f2fa0530cdcc6fb86b620dbf715787a26

SHA256
a25da3cf7ad93a974936f2595638ac1c5234a235b4d06b3e77796826b66fb4f0

SHA512
ea1a7cd1eafaf997d691e541b8fba9a1fffe0faff3c073fba277c23a3795f350d35dde46aade54ea5c815847d21b9547b04e8eed6585f3dff08191093fe21aff

Download Submit
C:\Users\Admin\Desktop\ExportSave.pcx

Filesize
241KB

MD5
27061f86af91f0e976754f716fc63b32

SHA1
6410b647077fd0f8429e561d955e24ff3e033b35

SHA256
87ac40f5f4fe6adedce97dde30a3d26a7b4a7befb465f2e99eb694628295dd4c

SHA512
62ad4837158cc07798f81605e8cbaf1ceede080bfa4ead49428deb06bd5c5cf5f10c7b336bd9e205e2fa2e6529d1fff4bda376895c2ba93455a69e2bd0f65c90

Download Submit
C:\Users\Admin\Desktop\InvokeClose.php

Filesize
215KB

MD5
20284b9e444d53e272380ac10c2b4e32

SHA1
0c32d1d01ae3794c8489684d8e3e40e60806ce56

SHA256
400ce54f9ce1aa9cba5698e6c0fac3a66415770f4bb0e601365aa98dee5d22f6

SHA512
6d82c1595a4252cb7ffef251dab8e49e1cae637c2b20deb9a84b3dbc3417acd626a4916c0e396e374f490c84cf488bfb1f92bcbbee66f2c38b58d021c19206d1

Download Submit
C:\Users\Admin\Desktop\InvokeConvert.m4v

Filesize
117KB

MD5
2ac07ae6652b4f3bdab397f0eb90722c

SHA1
9fb572892e5c8329d913cb5ea3532e7f31a5d0ff

SHA256
64c9ae9753148397f7d3aa8854ef4605c201009b2dd7fd5ca218a7a7ca3c0190

SHA512
768150baa7dccc6fcef5408ad5587c29a4fd8b7cc66deed3f4bdf5ac5434797be67907fbc688fd86a067a6e21ecbeec4086d5a5c08c7226d7c8d8544c87a3657

Download Submit
C:\Users\Admin\Desktop\JoinUndo.svgz

Filesize
130KB

MD5
b71cf7aec199576781ffc707af33a538

SHA1
fd316f8d2050fc60561f12cda6f3c30c11a921ad

SHA256
68fdb39a995efc8dfe74f1a91fa4d664ff43f5118bba98959f6fcbc84d79cda1

SHA512
6a96473aab7b90d03d2d2943c8e0d4ac8272d0693f2d69fe162a056114430e49f1b19e8ffd7c4c422d152fabb142281388c4b7ee9a15524566244742d764e4c3

Download Submit
C:\Users\Admin\Desktop\NewApprove.DVR

Filesize
195KB

MD5
439fbd1c7d53104935a28b9b4d598cfc

SHA1
1c490e73668bb8a49a153d1aa5d66e354e905dbe

SHA256
13d8f292e765bd2ca22820cb276ffd6c886c57eee842ada3bc2ba8df5b7842c7

SHA512
694c1ecaed525a4a4c82ecdf78450ffe6fd191ef3f40daf8fb233774c690b54d61a89b9f8f72430b662ae2b7ddf6882c06a9c7741b25a4e9f76e5db08c1293d9

Download Submit
C:\Users\Admin\Desktop\ProtectEnter.docx

Filesize
12KB

MD5
b0358315d6817d9d506a96d83c48f7c8

SHA1
c3b7c74b11da4d790048ed918af857579de276fb

SHA256
30132ea38ece5c98322b983da74e4ef48614520f354ebdd508694b4991ff9270

SHA512
f2faf29b094c92429c122d47f713e7e155b2dfe92e210f383e7db78bb3c37d2c3b72ebd722cef64dcba5d22ae1a7e8394f51d89c1c62e527beece3f2205e8c90

Download Submit
C:\Users\Admin\Desktop\RequestRedo.AAC

Filesize
254KB

MD5
ce6ae4c4b20ce18745e74d0612d70491

SHA1
87d5faaf8d1493e2d6ce2beab6448370e0f11183

SHA256
80ad7a72ba8da271968e6a40a1a9b35e9cb6d3adf6cb275c98ec4dae6768d25f

SHA512
d9a5a25f90ccae1f87f82059e2226646a98cfa0b30d9abbfae73d2fb212e438a30e03563767351f980e0ad601727ffadc737e9e983db7082dc3b0569529bd715

Download Submit
C:\Users\Admin\Desktop\ResumeEdit.gif

Filesize
124KB

MD5
84c5e23b76d9cb4eb4f23b26380b56ba

SHA1
c56c65131425d46848ae6b3a10b1016dbe852aba

SHA256
1dde6f783926aa68b42bb576d4e7f642416ef22ef61d3c32e79e3ae842eb0590

SHA512
65880ea6314d8b15d14b8dd02b8da2776be971b759300dd9f18a49fa61175214fa36f8942c4c3f39be91077eb9b8cb0b98d1ae9b573e0f8eb7c986d31bd1f1b5

Download Submit
C:\Users\Admin\Desktop\ResumeExit.xlsx

Filesize
12KB

MD5
aee796f6c401ef3b56c04d28a68b52f7

SHA1
1ff86c8d505f7749c15b6619c778cb675f7cc349

SHA256
ad7b23454be29435b374472b3c7310bcfc6089c4245d46396ae9f98b47a4a39e

SHA512
d3cf50759a70b546820896ca41446d964b5c2cde668d2db026a6415bcc7d37ccb17b7230efab45a2cf39f8d6e3ef19e07e3ccb4d7e3f17c8ca7b3345094ebe19

Download Submit
C:\Users\Admin\Desktop\SaveSubmit.ini

Filesize
91KB

MD5
3fb5063a716edc495f54ed27e6fcc453

SHA1
8f98b847d9226a1e04c80c93b2d58a7ae2d3c3bf

SHA256
4fda9a68951c4693cf68d89f0ec08476ac7ae8c89c535c91ae0699a21dfec909

SHA512
56f521e19becdeea83e16008532555118a3fb70312a6c1a616b0eaa58965fad9e8decd47a8051e59c54e64aa72385df4dfcaf5b852fcbf9f10a21ae447eb007a

Download Submit
C:\Users\Admin\Desktop\SearchWrite.reg

Filesize
156KB

MD5
7c3dfbd0b3d6ce87e2329a007f19f95c

SHA1
b188d0e0797e7a937a789f019e8cd4f516bb475f

SHA256
fbf24b03e5a11b84d798ed069c6886baa94fc529f39d850be8aecd64b8f5922c

SHA512
d69c72fa13fd78f4a0809ac73471f070edebd9e71872ff5a18e02ff8482d0b448312c7a21f194385a35ed42dc29bb84639f354670ea141866931f25bb8bb7b16

Download Submit
C:\Users\Admin\Desktop\SetStart.M2TS

Filesize
202KB

MD5
583247b16005a9f7f561bf21c48c62de

SHA1
c2b5d1f18ff565f79d6a586328ebe58f9e8b3f16

SHA256
6741058b972af6ac11efba2a50be957f7bfef5eb9b25acd8c8a880143c575dcf

SHA512
994fe41325ed4da550a08045c739653dc276c495945f5e542fdeed998a9caa19b621b766b09f84f5331f047d512a603bd40036266058a8e23315ad4ebd05533f

Download Submit
C:\Users\Admin\Desktop\ShowBackup.jpg

Filesize
182KB

MD5
4d644c9aa396733ddcf2f90cdb7f2420

SHA1
aa9efad6ae1c969cb9f27ddfba953264fa708c5d

SHA256
0cd07b894d4c29de8b23e3b81f9a415452a38c0a7a3bcc9fd02dd8f5e3d49e64

SHA512
bf4af27fab6d375b324f0e990424391ec4510e1cf1779177f4a5da2ab72f538ecddc55fd357697388d0e7adf773b6adfe17054a2f26e0ee2c079e52f78345aaf

Download Submit
C:\Users\Admin\Desktop\StartCompare.png

Filesize
150KB

MD5
7f33dfc0b68524c3d7e10b7232bc1550

SHA1
0dc9617f627747c6dd0dfe99e91fa0f0a0e3c643

SHA256
536422a84c6ad945c69f8894b111a92e5e30584cc9ac95925a7252844028856a

SHA512
5dbed8281d465654292143c44143368a75e26effb9f735c75df89912f3a96e18f39f74a2a3031369eac0bcb2cd89ca77833f7ab60c77de5582c8d28c609d25ec

Download Submit
C:\Users\Admin\Desktop\StepSplit.htm

Filesize
111KB

MD5
eb19ea5e247b1aa01e8e756ee7fc7b66

SHA1
959171c2173bec6f45fac12df0bba44c8dbe508a

SHA256
c8c0ad23573c6c30e3f2dbdd74f0d184b8283fd1f636ce7ea8a2c9d0f27694a2

SHA512
56aaa2044fe526b6cf15a9c520a80152fb8311a6701a5e60db979b6f50c605e3f2dd29dbc626226ee6b3557bb55f953d7a845d8cfaccc36b998e94ad6ce92463

Download Submit
C:\Users\Admin\Desktop\SubmitUnprotect.ram

Filesize
137KB

MD5
42ef1e05f65e8fa775c8bded0471a4c2

SHA1
569954c654b21edae86698fdcc35ce5e57690890

SHA256
89404190e48ff2a6f26462291285fc589308407b842f9efd576fb8320eac954c

SHA512
74195babc7ff2db398a788b8d49eef2170cc262ce87e4d038f7eda6abc00c48a874e129f0c643a8a2bba28fa0a107cf59fe36d0bac36d4db4cb2ccf8eb75c164

Download Submit
C:\Users\Admin\Desktop\SuspendCompress.dot

Filesize
228KB

MD5
3d15e79f28fc29ebc0a9c8ccf1b1f417

SHA1
6b7d16454f192bf04f3b44a576dae77d4f6692e4

SHA256
a703b3afc731264474b3b0f1d2ecfd91d1cb05cc3d378e61e03b1a063a8268c4

SHA512
9416a653b00f5413fbc081e16ee1484e2c91b89fbddcd5ae128ea424abec669fa4008b5acdc5d7d616c61b94cee7c4ff9ec7acbc56ca0debc4c12b5afdb5ee7a

Download Submit
C:\Users\Admin\Desktop\SuspendConvertTo.3gp

Filesize
222KB

MD5
96d6dd8c37f9275bb5160b156488deb2

SHA1
20fb1957b1d0590f0dfef4ab260e621f5dc02fd8

SHA256
51b4f7480d53e90265194ca7bb6d7a122e33bf2e22cae44e9fa8a5cd42fb5098

SHA512
9d96227bf3dec8e71d6444f2ed3fd584d343124bd2b5ff0c56f7ed7fa4537dc2ccb57cf0eeeb1eccbdd4035f774cfebb0f9ef678603c97561d040a1c9e072446

Download Submit
C:\Users\Admin\Desktop\UnprotectShow.zip

Filesize
248KB

MD5
fb33347869037269b63be96f1189e2d2

SHA1
573a91cfd2e59966389bef8cadd3c3c35b0074b1

SHA256
50ff03a47a112f9a30e56d6bb7eb1d341bb41c20a198454d4efed93e925ab5b1

SHA512
c0a065fb13683f3ee57d2a5b0b3c27a8e3bb9dcd7c470ad3324274a62dc0aa2e63930676b3f46b9564c0ed9ce4c1a2e7968beacf101963a4c0d5265b6290091e

Download Submit
C:\Users\Admin\Downloads\AddReset.wmf

Filesize
496KB

MD5
e5af4ff6824fd80566d9cccb9242b3c2

SHA1
1c6533a44c8d12cf5a39831e44b818bb72d0d2c5

SHA256
c9f0d107846307795a7b0c321938060f4b9f93a74a0d1e47c03ec1c0c6dc37bf

SHA512
ed6f6f516ae8ca7317ba25ff9dedd4c851175a70d40ba3e64e380bd655db000b71000323400311ca222b461d5c5543264fd51056f6fe45eefce1b30c5c2f4cf0

Download Submit
C:\Users\Admin\Downloads\AssertDeny.mht

Filesize
372KB

MD5
11aa47e2cd2c0e1bb00aab234f5d79ab

SHA1
86c6d06cdef5f24baa7e45657ca19c2bc6d99ccd

SHA256
066f14f7a5d21a77f3e97cce6eaf1ade8eaf7ee7b68367c45bbc4abe124f1d1c

SHA512
3644f994fb845f8acf3c8d7cb4e3d637eb2ce432fcb9a1b1e27eaa774e1a271de44ec0670696dc98d781959df475c90e45cdf58527b42c830ab3e45a93a0abfc

Download Submit
C:\Users\Admin\Downloads\BlockOut.xml

Filesize
396KB

MD5
0f485acef4d86dac0a15cdfe028244fa

SHA1
8faf1d5c18e9699eb5ff8bfe6393e9112429d888

SHA256
76ad3cd62900e93b94ba0b21eb9550755714ccf1195e8d55f008711abf1a75c5

SHA512
9b57158b874c29ad160f94ca93f1bba34a90d1b29ef0ea3e045f3c111b615cb2b0f107893fe3c535765abfa8af3ce8d2bf51eb548ab245de479cd59449fe4dbe

Download Submit
C:\Users\Admin\Downloads\CompressRead.wvx

Filesize
545KB

MD5
20944bf479a2d3aa283221c59e6cff38

SHA1
f2e81ac1b3e1d680d4523e247bb8242a1a1506e5

SHA256
91785f350412ce76356393352d73cdd32b1d5d55dda01388338b51297cd5437a

SHA512
5e44bca3d853a6ab24a910a7216fdbda0fb3f6924396ba3950d92295bc4d8cd9c7ebc28021fac63e8e9c12f224919e1c31c166c6c9336e2e3d106ee9ef664d92

Download Submit
C:\Users\Admin\Downloads\CompressRevoke.vsdx

Filesize
285KB

MD5
7e3354688f069fd841e570d6fbfbe2ca

SHA1
1d3ae7af69995483f2adbb9daae32c5ae13523ae

SHA256
4aa04c94e100524aa6c329f402ec4040dd89c9da36c6d03c17af482fd3c51e78

SHA512
2c42238a188b5837a2b130a608cc00dbc391afbe2cb87713265988f8fbb9d17de33cabd19b1044fa174015061880f89b0041bf81c823bd0fe2a4d017ddb0046c

Download Submit
C:\Users\Admin\Downloads\ConfirmSuspend.lnk

Filesize
434KB

MD5
5a0f1f69b3c814adea7769676fe68285

SHA1
f47c049d51971174cac1402b079807a97025d580

SHA256
a417cbf29f9a83c9c229c9f73969cee2c0b37c672a7c92adc56928dbc26754b6

SHA512
d3e8706b45feada2acff81fc66969da0d07ed4947655d8e88f10fd6c79542faa9bdf71d006fab5ae5847afb96837b729ff38c5d134cbe86f93722a2fe585e88a

Download Submit
C:\Users\Admin\Downloads\CopyUnprotect.clr

Filesize
520KB

MD5
d8476410bcb414445e8d9ac568345c65

SHA1
29d5e8d6b3cc756338ebd1352dc5785edeaedf54

SHA256
919f40bdecba78e3dbcfafb30101aebe60b848327a175ec3ae257d31790dd6ab

SHA512
4a50fb85a963512f27ed68b226c3780e94337648e3984bff5f7c8f627ccbc5f58aeb4709ca87410287889b08ea40798f0ccd8833f5f343b4ed08c95b0e2d0fa9

Download Submit
C:\Users\Admin\Downloads\DebugExport.ram

Filesize
533KB

MD5
b02e3668d8b7f8093be32d48a153e941

SHA1
b35bddeb592f015df69e989f3a0cb816e2a68dfd

SHA256
eebb0c804d6b4b5e2c47ddf147c64f0f1897f7862835454faa7d8363c9310a33

SHA512
0e8ff2534f334ab7d10a63da1f37b5d164da69a2a59da1bf06e0b8c783f5133f7603cbf964bf244c0f6c76d0cbe99958fb7a4616b082c5d1c51a49dc20fcd509

Download Submit
C:\Users\Admin\Downloads\DebugGroup.7z

Filesize
248KB

MD5
e8908376f7f6dd852367aef6c092e80a

SHA1
df7e23b0185985a55ea10acd504fe819648a89d7

SHA256
965e9aeff0c5bc4666d2095a18c071f98c2e79bb0e69fc1eba6879762ae54662

SHA512
a47966004833ff36ae303353e24d9b1e2e0855fce34aa2ee5478e0cbe81e0350289922962c670345ea5ce18b029b7e4ee6f211150c5369761543030d83ea76b2

Download Submit
C:\Users\Admin\Downloads\DenyConvert.jfif

Filesize
421KB

MD5
076768db63bb122fbaa221e8954e3d73

SHA1
90b922c09c7d6d655805e44704e6749e8963ba12

SHA256
14a89f12655cb4774c5c41740d80302eda75998aab6ee82aa7bfc410ec3c9d1f

SHA512
ee5bc842566b6f2d562d5c3ab50241b243d27784e2a71df5954339021228627177d4b59f4e0f47314677cbb1ae0b223b5bd67c250b5835ee4a3ba8d16de20e58

Download Submit
C:\Users\Admin\Downloads\EditUnblock.ppt

Filesize
210KB

MD5
956cb27136cbfed4a288d894851a62b1

SHA1
e6609f570fb4f4584d94be301d15d89cb73cb6e4

SHA256
d12d40ec560402916be0c41c0d4e9e1624a6deeef501ff97c2ab6ae74e1cbb1b

SHA512
973df914e9d2e04083110e7be93f5775dcbfcbbcff5c301c99c4bf9fb6dc68ca990977b6dbdae5fad14a0b06df6a2d99ceb0e0c823e2f6edb93fd8a10f3b58b4

Download Submit
C:\Users\Admin\Downloads\EnableRepair.html

Filesize
570KB

MD5
7e1c51789a9cb4ac77f02ba4d5fd5cac

SHA1
caafb2caf74e74467abf19b8b0fe69c01ffe7f8c

SHA256
32648d65d1fb7dfeb97edfaa12d519b3097e97cb5263ae6ae0a128a1219feb93

SHA512
78ca241bf7d0e2ec77f45ce9947c6e0ee4ec817537463ef4b30a572a4d36376dc19e9225f3b1640f0d6944b87265e77216a6fcce8a1d84390d69abf226d1d091

Download Submit
C:\Users\Admin\Downloads\EnableRestart.xht

Filesize
272KB

MD5
a3bd9c97c71579454f0d857965e7e663

SHA1
22ea1e4708986c47f563c0e67e365908ab0e3547

SHA256
a9c777649659a476161d19b9313898366223b04e9c0103fb87ff9e56526400ca

SHA512
f5ec103fdff830d1558f4e9d9a4a60747d5a32b2e8f0dda312856d1466dc392aea82b941e33ac7e066ba8214099ec153e9f1c523c3704d8a99e3f477a59221fd

Download Submit
C:\Users\Admin\Downloads\FindReceive.svg

Filesize
359KB

MD5
d996a5d9f96288fa23c2dd9ba57a4304

SHA1
e3da0aa3076bcdbf4ef2d83f5c1d90daf4c76617

SHA256
18ab1e32d3b2eb845991737280bb176dfa2f4b0a74d5c991dfdd02f6a38bb507

SHA512
f09013cc64962bbaf10719ac015b5f26a4fd67308b9882ef52f2ba0fb4a5f88ca285d2f6dcd043475c1b43a5e5b738331a89a5159054f72a40fb869c1ee1534d

Download Submit
C:\Users\Admin\Downloads\GetSelect.asx

Filesize
260KB

MD5
7cddd904caafb698129de56deda35179

SHA1
d0117ecda307d30b128360a14711099c845351f9

SHA256
a5ed951a7e870c0cdcae6a430328159ddd2288fc58202350ba2fafe0e02b9ca1

SHA512
88de9eee6f0a9bd3bf3be27fd35b9e01da1598111541727337d86a7ea58f126816188175520f63390df189fd7375313f8c828064175ff681e62a2e76d3e300fd

Download Submit
C:\Users\Admin\Downloads\InitializeInstall.odt

Filesize
384KB

MD5
1d7473702a0a3a8b87b1dda8b5a311a2

SHA1
1ac29e4aa47f277b67781a3d58480943ebb195da

SHA256
5964596827c75647846aa7df0beb3a713e72cc0821faf744a6f8e8bb7bcdc2ca

SHA512
2fb6b8bd1be76dfdb0d56ba313d6db4e25d798cc3d8d3984bab3d689e4645b4bc1d2ad69527e3508341f2306070e6cc46084eae30b9793c2d12edcfc45858f6a

Download Submit
C:\Users\Admin\Downloads\InvokeSync.AAC

Filesize
558KB

MD5
796fe1f9f5241d934a7c38d795f18eb0

SHA1
11c4c5c12785c68fae8fdfa488f4ae08bbf993c7

SHA256
ff975fa0d46d11ed1ccfdc60bdededdd8e0613f72bdabcaf3a4b23c22b5d1a88

SHA512
9c878daa455320be407964611bf63b7b66c1477601576a8fa85aff7af0223cd63a83570769f1a978ad378af50114b655b24444ddc0a19120a47b0edf3a3d638e

Download Submit
C:\Users\Admin\Downloads\LimitSuspend.vb

Filesize
297KB

MD5
b4c0d2bc8d5c1044a05eac487b2f2f75

SHA1
2a221f01c8c98d260b404020a8a7a05c849923f9

SHA256
2c856203c62b91f688155b4fde32ac88b7535543b18aa9f1ae536971c757257c

SHA512
127242bc345bd4b28f6fe446a569eda293cd70ec273db3677f18632c38aa63edc7513c725674dcb4ae90c605b60cd06cdbbc2da7583c5a54d11079f65766491e

Download Submit
C:\Users\Admin\Downloads\NewShow.ADTS

Filesize
607KB

MD5
1835110b57fbf8ceebb77d72c364fe32

SHA1
40e96ed1b4f5d5e8ea08a10cb35fbbabd788aab9

SHA256
5423a5ef2bfde6c2b57a38687a69bff67334aa7cb079b72a7f27548553c10867

SHA512
3d7416a65ce9d09bf354fc2eb62b3a98b90e7e7d4175cca5bdd2ff836f0773110871a2377e67f7d2e893d21307110372d7165ceedd03d37f001e9b81820b0406

Download Submit
C:\Users\Admin\Downloads\OptimizeInstall.ods

Filesize
446KB

MD5
9ef69040a9d0becd567dd01279256908

SHA1
a5332809387fbb2fe9b162a273d1e09b8fadb7f1

SHA256
4e2488e1fc1dc9242bae8ccf7606f418f7f55c41a5d2d26539564588bd08b6fa

SHA512
075631db6f251f8c41038634f099defc47d55813c3d00b560937ce883e3432b695c4680b073db2d38cd633768847fedcb82afe0b8771e483465f31cb888190bd

Download Submit
C:\Users\Admin\Downloads\OutUnprotect.gif

Filesize
471KB

MD5
215d3f93f2744bc530ec183b99d33c39

SHA1
dc1e9eef7ed6924eb2f222bcde6990e89200171d

SHA256
71d72e282ee7de8e4261bb9593fe51a1f2ad706d3e7a98df369997c9455404ca

SHA512
ea87d5806b7dad0e337f33c7c7ca3ca4ac1e0ab050e32a520d62f5a61850be1f4fa7fd347ae4c6169baf8f7eaa612cb259ce5c488eb588ffa2e87c9b00176451

Download Submit
C:\Users\Admin\Downloads\ProtectGrant.TTS

Filesize
322KB

MD5
593d917f5bfe5bcd89d7b3eb4371590d

SHA1
049c7da4281de949a72a42a20ea3f422fccac302

SHA256
9bcad33571d60ad94947d127ac0c64b2435ff377b5043c7d2cc0360b24153120

SHA512
c5b9b63af9206e06992e52201fbcb2796de4f17f1a73fb1296e17957b00e2e4394832b40d66e3b94188597a166cafd4011c58b42e17f03a52bb5eabe5795bfcb

Download Submit
C:\Users\Admin\Downloads\PublishConvertTo.css

Filesize
235KB

MD5
444330f5e8aa6adb4f9374e3241ec64c

SHA1
0244abfb35e877324d79c56fa05e6f20c34f70d0

SHA256
bae09283b6ec1cb6de712480b42d591df990b4e6b7c10b29aa0643b312ec263b

SHA512
e2cf485d5ed5ba9e01a5939ed3d414928fb543f8b6743df7cb0f64313d5b80dd9009b5a64e0be2b7d5e5bee0ef4d392b6d7c3a52971da81a192028757175f062

Download Submit
C:\Users\Admin\Downloads\PublishSet.ex_

Filesize
508KB

MD5
07bccb49e746aa1844bf104fb04c1214

SHA1
1cbe280901aca3d801096080f83a1c84d949362b

SHA256
4962e41c7913d6999f732753c7ca18849c168417cafc15e3148fb02e8e1ec9ec

SHA512
1d9066603c0b83aa584345ed2f515c5f797905e0cce008c8947bf94e536d719d94d6c88952ac2a3d5fed25d3128d8bd4ce018f7d01f79787e9035f04076dedcd

Download Submit
C:\Users\Admin\Downloads\RepairProtect.vbs

Filesize
409KB

MD5
6351e58d8e432a02fb299de16f76d3ce

SHA1
6f7a7fa79106b9f195b1edf846f4daece8126b3e

SHA256
bcee881eba2d57c4917ea36addcad8db78175344d1b85449b1368f6409564c69

SHA512
5f8e28956c8e1668a6e001b945cc96573483e4dcd1e14790521dfd6ee02454e541f3c9fb04c29a44942468c506531adc31986d20100dbe00071a407e5e6025d8

Download Submit
C:\Users\Admin\Downloads\ResizeGroup.scf

Filesize
334KB

MD5
7751ea787c166cc7ce2f30ce6a8a073f

SHA1
b467f14f4b22e254c34cacd5f6a74465ab1f054b

SHA256
3bd667177255662f9a60849d2e447f22c0383ee384d7e34ee79a6d8bd85b756e

SHA512
b36ec8068be0bdf46a0745f2734f49698f901d6e5e48a10f0ac29bdf6e5b77f67556fa4a37c620dfba8d170e1614d620ddbf3d8a1bdf5c544270076628223100

Download Submit
C:\Users\Admin\Downloads\ResizeInvoke.wma

Filesize
483KB

MD5
d5eb07aa89b6bcb6c8335672b2fc7ab7

SHA1
6d678cdcb7d8b7e4b9762f8c50a8d8d24afcd3d3

SHA256
169cd2cc15bf92218a58e2b55ac351e1d9655c5a8ceefae8a11858114eab2ebc

SHA512
899fecb81165fa25dc056471eff497f06f0f4181cefb136a424986ead01a1d1208ecd20e34018da9638aaa7c9de1f9ff73a4d6d1f5cb859bc6e5435bdc694bdc

Download Submit
C:\Users\Admin\Downloads\SaveTest.vsx

Filesize
223KB

MD5
645f066973a68256d94d5fa45865925d

SHA1
ac9c1b35da20292b868f18ef6c74e006cfe3f551

SHA256
a1aba8db62cb6f0195d50faba81384a45cbeedff31143c8b4bda04b48fde73bd

SHA512
89906262d5f3b53951d9eeb5580faa2c395e125a7d9cbe73f6fd10831741379ffff3e717436421fdaf0e64b47581b4aeaf51cc7e61f289a46cad5905a1267d3c

Download Submit
C:\Users\Admin\Downloads\SyncRegister.7z

Filesize
458KB

MD5
2c2062d8f96aada62b6493622fe38239

SHA1
7be200028445c8bb7389521266f1eca2250b184a

SHA256
e885581a10dc8794dc17be3539fc71097f48ac13ea291521b8f1220c52a9dfd7

SHA512
7fdd8fc48139b42d4fd725a57b509ba108f3be88d80e8de34d274cd88949ca4863a65b2e323cb0370fc4ae18cb6e1eb370dbf679c9baaa91a10080d54dd61fb6

Download Submit
C:\Users\Admin\Downloads\UseGrant.tiff

Filesize
310KB

MD5
aea6ccfd4a6ab862a723f68a318752b6

SHA1
b6f138d05028e53b28fa5cddce75e2b4a6e88714

SHA256
a2b0bef46b4ff8bcfa8a0c92e69efbce10951f05870227076a7685f5c9a2f473

SHA512
d5df4be6d5adceb31409439cde1db3e330c2a84d456226dd783c5e98e70d6a79fbbae75ee5a357dc4eb601adb969aeefa6553d6e209a7e01b626189fb208d2d5

Download Submit
C:\Users\Public\Desktop\Acrobat Reader DC.lnk

Filesize
2KB

MD5
1e243f48f83c12e7327e0a631aeb19d4

SHA1
5e1d1eb2b9eb844983a96b6ec77bd601685e5870

SHA256
ef1c90e8883feecdcd43d65a0a2b8d2856a7c510b1afd3a5b0d9ec6d01327c50

SHA512
7a84023d4080c2ac2d4cbc8b6a4aa55f8151f2dfb1edb581abb15b74f25605a4faf623ea137de241a4cada53cf195e84c64b112c21bab832097b7867a9e7ea5c

Download Submit
C:\Users\Public\Desktop\Firefox.lnk

Filesize
1000B

MD5
6fcd644a7c32a6a8e958f3f869f50116

SHA1
7982bea09f2d1f9c6ec7443730900b649a743832

SHA256
289d9b37fab0e44663e90011c50eb34d10fc0986db5929cd9eada7231c28fad1

SHA512
1b7060825555a7ef19346d70cba6a893c42a3d46bc938570894416f40e0e81e902b0a8e45d796f6c3efe27c63358d7d429ea387a2f713f2161fdb4ad38243f1f

Download Submit
C:\Users\Public\Desktop\Google Chrome.lnk

Filesize
2KB

MD5
fcde8f71f73fee42dc0d53eeeafdd1ee

SHA1
9ddab438cfaf2a71b76b2be6cfb8b15470d32f70

SHA256
dd364349e566e77928e6f12a70bc6d09b9c5eb3ed1337283a6ed47a623edf822

SHA512
938bdbb9db11cd515c0d7e703e6abf0536d35ea78e790a50bac79df3f522aedf57b5170a3018b52517e24b56c883cad43a9f679bd2205111ff007179f49db4b2

Download Submit
C:\Users\Public\Desktop\VLC media player.lnk

Filesize
923B

MD5
6f5af59ff4f1ac1ea281131516a70b00

SHA1
9574031fde45911d5d0dfa035af7ad8114de1710

SHA256
45b7e962bf97288f6a7f2dd6016eb5cca6c76d036ba416749a6874bf7c525e55

SHA512
5c7a39d6fb5f10a11fd2a71c8cee836e19c4952a30901fe66ac1df437be1b2c19acc9d1dde21c3136edfa9689c960ecccf2bde3a6c92b854b05695f6763940f8

Download Submit
memory/1020-83-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1284-82-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2348-72-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/3100-78-0x000000001BCB0000-0x000000001C17E000-memory.dmp

Filesize
4.8MB

Download
memory/3100-79-0x000000001C180000-0x000000001C226000-memory.dmp

Filesize
664KB

Download
memory/3100-80-0x000000001C2F0000-0x000000001C352000-memory.dmp

Filesize
392KB

Download
memory/3696-71-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/3696-66-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/4880-77-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download