6cce97038f9ceeaa13e25972f62eb4646e9566be6e49b1689a5b246bbbbb52bb

Analysis

max time kernel
150s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/06/2026, 16:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Rust Launcher.exe
Size 168.7MB
Sample260628-tlkpyah16y
SHA256 6cce97038f9ceeaa13e25972f62eb4646e9566be6e49b1689a5b246bbbbb52bb
MD5 e9c9fa0db9297ad03fef1539e248f9bc
SHA1 2c543d3cd9eca82c178d9bda35ef4468df03b51c
SHA512 99435e1a95f2a165fef33e5d829e9c08b4d92812ea409847af59680f52782905c1ad9f0de2b1e02c75a08f4163fe8201eb6c06c452889b8c6ac94d97c4fc04e8
SSDEEP 1572864:DOhiqBPiJU33xaD1gWcdcMPEDCNCgDX0Bf+NNvTPQYhl49RIuKj53fHcTLNKJF96:HgmeNxNNZxqV
TLSH
T17A887B13F29651D8F09DD1B18B578236EA72B8460738A6DF2754172A2F77FE02B39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery

Malware Config

Signatures

Enumerates processes with tasklist 1 TTPs 64 IoCs

discovery

Process Discovery

T1057

pid	Process
1828	tasklist.exe
5016	tasklist.exe
3248	tasklist.exe
1816	tasklist.exe
4628	tasklist.exe
3128	tasklist.exe
5668	tasklist.exe
1252	tasklist.exe
816	tasklist.exe
5548	tasklist.exe
2480	tasklist.exe
1252	tasklist.exe
1808	tasklist.exe
5808	tasklist.exe
496	tasklist.exe
4012	tasklist.exe
6044	tasklist.exe
4100	tasklist.exe
6080	tasklist.exe
3216	tasklist.exe
4976	tasklist.exe
4348	tasklist.exe
4940	tasklist.exe
5956	tasklist.exe
580	tasklist.exe
4472	tasklist.exe
2416	tasklist.exe
5036	tasklist.exe
1536	tasklist.exe
1808	tasklist.exe
6016	tasklist.exe
5776	tasklist.exe
5712	tasklist.exe
3484	tasklist.exe
1168	tasklist.exe
3284	tasklist.exe
780	tasklist.exe
4528	tasklist.exe
1696	tasklist.exe
2156	tasklist.exe
4172	tasklist.exe
4780	tasklist.exe
4212	tasklist.exe
2528	tasklist.exe
2940	tasklist.exe
4416	tasklist.exe
5164	tasklist.exe
3596	tasklist.exe
5196	tasklist.exe
1336	tasklist.exe
2300	tasklist.exe
2132	tasklist.exe
3732	tasklist.exe
2480	tasklist.exe
1120	tasklist.exe
5544	tasklist.exe
5620	tasklist.exe
3708	tasklist.exe
4472	tasklist.exe
2220	tasklist.exe
5808	tasklist.exe
2200	tasklist.exe
848	tasklist.exe
5300	tasklist.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	Rust Launcher.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4572	Rust Launcher.exe
4572	Rust Launcher.exe
4572	Rust Launcher.exe
4572	Rust Launcher.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	6044	tasklist.exe
Token: SeShutdownPrivilege	3964	Rust Launcher.exe
Token: SeCreatePagefilePrivilege	3964	Rust Launcher.exe
Token: SeShutdownPrivilege	3964	Rust Launcher.exe
Token: SeCreatePagefilePrivilege	3964	Rust Launcher.exe
Token: SeDebugPrivilege	5712	tasklist.exe
Token: SeShutdownPrivilege	3964	Rust Launcher.exe
Token: SeCreatePagefilePrivilege	3964	Rust Launcher.exe
Token: SeShutdownPrivilege	3964	Rust Launcher.exe
Token: SeCreatePagefilePrivilege	3964	Rust Launcher.exe
Token: SeDebugPrivilege	848	tasklist.exe
Token: SeShutdownPrivilege	3964	Rust Launcher.exe
Token: SeCreatePagefilePrivilege	3964	Rust Launcher.exe
Token: SeShutdownPrivilege	3964	Rust Launcher.exe
Token: SeCreatePagefilePrivilege	3964	Rust Launcher.exe
Token: SeDebugPrivilege	5508	tasklist.exe
Token: SeShutdownPrivilege	3964	Rust Launcher.exe
Token: SeCreatePagefilePrivilege	3964	Rust Launcher.exe
Token: SeShutdownPrivilege	3964	Rust Launcher.exe
Token: SeCreatePagefilePrivilege	3964	Rust Launcher.exe
Token: SeDebugPrivilege	5596	tasklist.exe
Token: SeShutdownPrivilege	3964	Rust Launcher.exe
Token: SeCreatePagefilePrivilege	3964	Rust Launcher.exe
Token: SeShutdownPrivilege	3964	Rust Launcher.exe
Token: SeCreatePagefilePrivilege	3964	Rust Launcher.exe
Token: SeDebugPrivilege	2300	tasklist.exe
Token: SeShutdownPrivilege	3964	Rust Launcher.exe
Token: SeCreatePagefilePrivilege	3964	Rust Launcher.exe
Token: SeDebugPrivilege	1828	tasklist.exe
Token: SeShutdownPrivilege	3964	Rust Launcher.exe
Token: SeCreatePagefilePrivilege	3964	Rust Launcher.exe
Token: SeDebugPrivilege	2220	tasklist.exe
Token: SeShutdownPrivilege	3964	Rust Launcher.exe
Token: SeCreatePagefilePrivilege	3964	Rust Launcher.exe
Token: SeDebugPrivilege	5164	tasklist.exe
Token: SeShutdownPrivilege	3964	Rust Launcher.exe
Token: SeCreatePagefilePrivilege	3964	Rust Launcher.exe
Token: SeShutdownPrivilege	3964	Rust Launcher.exe
Token: SeCreatePagefilePrivilege	3964	Rust Launcher.exe
Token: SeDebugPrivilege	1160	tasklist.exe
Token: SeShutdownPrivilege	3964	Rust Launcher.exe
Token: SeCreatePagefilePrivilege	3964	Rust Launcher.exe
Token: SeShutdownPrivilege	3964	Rust Launcher.exe
Token: SeCreatePagefilePrivilege	3964	Rust Launcher.exe
Token: SeShutdownPrivilege	3964	Rust Launcher.exe
Token: SeCreatePagefilePrivilege	3964	Rust Launcher.exe
Token: SeDebugPrivilege	3128	tasklist.exe
Token: SeShutdownPrivilege	3964	Rust Launcher.exe
Token: SeCreatePagefilePrivilege	3964	Rust Launcher.exe
Token: SeShutdownPrivilege	3964	Rust Launcher.exe
Token: SeCreatePagefilePrivilege	3964	Rust Launcher.exe
Token: SeDebugPrivilege	5008	tasklist.exe
Token: SeShutdownPrivilege	3964	Rust Launcher.exe
Token: SeCreatePagefilePrivilege	3964	Rust Launcher.exe
Token: SeDebugPrivilege	5548	tasklist.exe
Token: SeDebugPrivilege	5016	tasklist.exe
Token: SeShutdownPrivilege	3964	Rust Launcher.exe
Token: SeCreatePagefilePrivilege	3964	Rust Launcher.exe
Token: SeShutdownPrivilege	3964	Rust Launcher.exe
Token: SeCreatePagefilePrivilege	3964	Rust Launcher.exe
Token: SeDebugPrivilege	5956	tasklist.exe
Token: SeShutdownPrivilege	3964	Rust Launcher.exe
Token: SeCreatePagefilePrivilege	3964	Rust Launcher.exe
Token: SeShutdownPrivilege	3964	Rust Launcher.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
3964	Rust Launcher.exe
3964	Rust Launcher.exe
3964	Rust Launcher.exe
3964	Rust Launcher.exe
3964	Rust Launcher.exe

Suspicious use of SendNotifyMessage 7 IoCs

pid	Process
3964	Rust Launcher.exe
3964	Rust Launcher.exe
3964	Rust Launcher.exe
3964	Rust Launcher.exe
3964	Rust Launcher.exe
3964	Rust Launcher.exe
3964	Rust Launcher.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3964 wrote to memory of 4340	3964	Rust Launcher.exe	80
PID 3964 wrote to memory of 4340	3964	Rust Launcher.exe	80
PID 3964 wrote to memory of 4668	3964	Rust Launcher.exe	81
PID 3964 wrote to memory of 4604	3964	Rust Launcher.exe	82
PID 3964 wrote to memory of 5684	3964	Rust Launcher.exe	83
PID 3964 wrote to memory of 5684	3964	Rust Launcher.exe	83
PID 3964 wrote to memory of 5684	3964	Rust Launcher.exe	83
PID 4604 wrote to memory of 6044	4604	cmd.exe	85
PID 3964 wrote to memory of 5696	3964	Rust Launcher.exe	87
PID 5696 wrote to memory of 5712	5696	cmd.exe	89
PID 3964 wrote to memory of 2256	3964	Rust Launcher.exe	90
PID 2256 wrote to memory of 848	2256	cmd.exe	92
PID 3964 wrote to memory of 5532	3964	Rust Launcher.exe	93
PID 5532 wrote to memory of 5508	5532	cmd.exe	95
PID 3964 wrote to memory of 4988	3964	Rust Launcher.exe	96
PID 4988 wrote to memory of 5596	4988	cmd.exe	98
PID 3964 wrote to memory of 5604	3964	Rust Launcher.exe	99
PID 5604 wrote to memory of 2300	5604	cmd.exe	101
PID 3964 wrote to memory of 3636	3964	Rust Launcher.exe	102
PID 3636 wrote to memory of 1828	3636	cmd.exe	104
PID 3964 wrote to memory of 2536	3964	Rust Launcher.exe	105
PID 2536 wrote to memory of 2220	2536	cmd.exe	107
PID 3964 wrote to memory of 5628	3964	Rust Launcher.exe	108
PID 5628 wrote to memory of 5164	5628	cmd.exe	110
PID 3964 wrote to memory of 1944	3964	Rust Launcher.exe	111
PID 1944 wrote to memory of 1160	1944	cmd.exe	113
PID 3964 wrote to memory of 5568	3964	Rust Launcher.exe	114
PID 5568 wrote to memory of 3128	5568	cmd.exe	116
PID 3964 wrote to memory of 2972	3964	Rust Launcher.exe	117
PID 2972 wrote to memory of 5008	2972	cmd.exe	119
PID 3964 wrote to memory of 5976	3964	Rust Launcher.exe	120
PID 3964 wrote to memory of 1180	3964	Rust Launcher.exe	121
PID 5976 wrote to memory of 5548	5976	cmd.exe	124
PID 1180 wrote to memory of 5016	1180	cmd.exe	125
PID 3964 wrote to memory of 4800	3964	Rust Launcher.exe	126
PID 4800 wrote to memory of 5956	4800	cmd.exe	128
PID 3964 wrote to memory of 3536	3964	Rust Launcher.exe	129
PID 3536 wrote to memory of 3596	3536	cmd.exe	131
PID 3964 wrote to memory of 220	3964	Rust Launcher.exe	132
PID 220 wrote to memory of 3732	220	cmd.exe	134
PID 3964 wrote to memory of 5088	3964	Rust Launcher.exe	135
PID 5088 wrote to memory of 3248	5088	cmd.exe	137
PID 3964 wrote to memory of 6088	3964	Rust Launcher.exe	138
PID 6088 wrote to memory of 5808	6088	cmd.exe	140
PID 3964 wrote to memory of 2796	3964	Rust Launcher.exe	141
PID 2796 wrote to memory of 2480	2796	cmd.exe	143
PID 3964 wrote to memory of 3500	3964	Rust Launcher.exe	144
PID 3500 wrote to memory of 4100	3500	cmd.exe	146
PID 3964 wrote to memory of 1980	3964	Rust Launcher.exe	147
PID 1980 wrote to memory of 580	1980	cmd.exe	149
PID 3964 wrote to memory of 5556	3964	Rust Launcher.exe	150
PID 5556 wrote to memory of 4192	5556	cmd.exe	152
PID 3964 wrote to memory of 5280	3964	Rust Launcher.exe	153
PID 5280 wrote to memory of 3484	5280	cmd.exe	155
PID 3964 wrote to memory of 4376	3964	Rust Launcher.exe	156
PID 4376 wrote to memory of 4472	4376	cmd.exe	158
PID 3964 wrote to memory of 5676	3964	Rust Launcher.exe	159
PID 5676 wrote to memory of 5668	5676	cmd.exe	161
PID 3964 wrote to memory of 2056	3964	Rust Launcher.exe	162
PID 2056 wrote to memory of 5300	2056	cmd.exe	164
PID 3964 wrote to memory of 4032	3964	Rust Launcher.exe	165
PID 4032 wrote to memory of 2132	4032	cmd.exe	167
PID 3964 wrote to memory of 6060	3964	Rust Launcher.exe	168
PID 6060 wrote to memory of 1168	6060	cmd.exe	170

C:\Users\Admin\AppData\Local\Temp\Rust Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Rust Launcher.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3964
- C:\Users\Admin\AppData\Local\Temp\Rust Launcher.exe
  "C:\Users\Admin\AppData\Local\Temp\Rust Launcher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\rust-launcher" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1600 --field-trial-handle=1648,i,17524005289579908393,2069861337409523585,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2
  2⤵
  PID:4340
- C:\Users\Admin\AppData\Local\Temp\Rust Launcher.exe
  "C:\Users\Admin\AppData\Local\Temp\Rust Launcher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\rust-launcher" --mojo-platform-channel-handle=2000 --field-trial-handle=1648,i,17524005289579908393,2069861337409523585,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:8
  2⤵
  PID:4668
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq Discord.exe" /FO CSV"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4604
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq Discord.exe" /FO CSV
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:6044
- C:\Users\Admin\AppData\Local\Temp\Rust Launcher.exe
  "C:\Users\Admin\AppData\Local\Temp\Rust Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\rust-launcher" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2368 --field-trial-handle=1648,i,17524005289579908393,2069861337409523585,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:1
  2⤵
  PID:5684
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5696
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:5712
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2256
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:848
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5532
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5508
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4988
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5596
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5604
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2300
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq Discord.exe" /FO CSV"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3636
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq Discord.exe" /FO CSV
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1828
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2536
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2220
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5628
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:5164
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1944
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1160
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5568
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3128
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2972
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5976
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:5548
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq Discord.exe" /FO CSV"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1180
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq Discord.exe" /FO CSV
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:5016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4800
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:5956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3536
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV
    3⤵
    - Enumerates processes with tasklist
    PID:3596
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:220
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV
    3⤵
    PID:3732
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5088
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV
    3⤵
    - Enumerates processes with tasklist
    PID:3248
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6088
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV
    3⤵
    - Enumerates processes with tasklist
    PID:5808
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq Discord.exe" /FO CSV"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2796
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq Discord.exe" /FO CSV
    3⤵
    - Enumerates processes with tasklist
    PID:2480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3500
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV
    3⤵
    - Enumerates processes with tasklist
    PID:4100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1980
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV
    3⤵
    - Enumerates processes with tasklist
    PID:580
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5556
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV
    3⤵
    PID:4192
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5280
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV
    3⤵
    - Enumerates processes with tasklist
    PID:3484
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4376
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV
    3⤵
    - Enumerates processes with tasklist
    PID:4472
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq Discord.exe" /FO CSV"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5676
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq Discord.exe" /FO CSV
    3⤵
    - Enumerates processes with tasklist
    PID:5668
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2056
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV
    3⤵
    - Enumerates processes with tasklist
    PID:5300
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4032
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV
    3⤵
    - Enumerates processes with tasklist
    PID:2132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6060
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV
    3⤵
    - Enumerates processes with tasklist
    PID:1168
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV"
  2⤵
  PID:1308
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV
    3⤵
    - Enumerates processes with tasklist
    PID:3284
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV"
  2⤵
  PID:5764
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV
    3⤵
    - Enumerates processes with tasklist
    PID:2416
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq Discord.exe" /FO CSV"
  2⤵
  PID:3432
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq Discord.exe" /FO CSV
    3⤵
    - Enumerates processes with tasklist
    PID:2156
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV"
  2⤵
  PID:6076
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV
    3⤵
    - Enumerates processes with tasklist
    PID:5196
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV"
  2⤵
  PID:5616
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV
    3⤵
    - Enumerates processes with tasklist
    PID:6080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV"
  2⤵
  PID:5348
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV
    3⤵
    - Enumerates processes with tasklist
    PID:4172
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV"
  2⤵
  PID:3612
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV
    3⤵
    - Enumerates processes with tasklist
    PID:3216
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV"
  2⤵
  PID:2440
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV
    3⤵
    - Enumerates processes with tasklist
    PID:1252
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV"
  2⤵
  PID:2264
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV
    3⤵
    - Enumerates processes with tasklist
    PID:780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq Discord.exe" /FO CSV"
  2⤵
  PID:664
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq Discord.exe" /FO CSV
    3⤵
    - Enumerates processes with tasklist
    PID:2200
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV"
  2⤵
  PID:1372
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV
    3⤵
    - Enumerates processes with tasklist
    PID:1808
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV"
  2⤵
  PID:3128
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV
    3⤵
    - Enumerates processes with tasklist
    PID:4528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV"
  2⤵
  PID:5108
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV
    3⤵
    - Enumerates processes with tasklist
    PID:4780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV"
  2⤵
  PID:1116
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV
    3⤵
    PID:2888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV"
  2⤵
  PID:5744
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV
    3⤵
    - Enumerates processes with tasklist
    PID:5544
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq Discord.exe" /FO CSV"
  2⤵
  PID:4220
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq Discord.exe" /FO CSV
    3⤵
    PID:2076
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV"
  2⤵
  PID:3232
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV
    3⤵
    - Enumerates processes with tasklist
    PID:3732
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV"
  2⤵
  PID:4564
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV
    3⤵
    - Enumerates processes with tasklist
    PID:4976
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV"
  2⤵
  PID:1512
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV
    3⤵
    - Enumerates processes with tasklist
    PID:5808
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV"
  2⤵
  PID:3136
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV
    3⤵
    - Enumerates processes with tasklist
    PID:2480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV"
  2⤵
  PID:5964
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV
    3⤵
    - Enumerates processes with tasklist
    PID:5036
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq Discord.exe" /FO CSV"
  2⤵
  PID:5440
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq Discord.exe" /FO CSV
    3⤵
    - Enumerates processes with tasklist
    PID:1120
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV"
  2⤵
  PID:580
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV
    3⤵
    PID:2940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV"
  2⤵
  PID:5888
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV
    3⤵
    - Enumerates processes with tasklist
    PID:1336
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV"
  2⤵
  PID:1592
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV
    3⤵
    PID:4532
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV"
  2⤵
  PID:4644
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV
    3⤵
    - Enumerates processes with tasklist
    PID:5776
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV"
  2⤵
  PID:4676
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV
    3⤵
    - Enumerates processes with tasklist
    PID:496
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV"
  2⤵
  PID:5300
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV
    3⤵
    - Enumerates processes with tasklist
    PID:4212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq Discord.exe" /FO CSV"
  2⤵
  PID:2268
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq Discord.exe" /FO CSV
    3⤵
    PID:1168
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV"
  2⤵
  PID:5712
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV
    3⤵
    - Enumerates processes with tasklist
    PID:1536
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV"
  2⤵
  PID:3236
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV
    3⤵
    - Enumerates processes with tasklist
    PID:5620
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV"
  2⤵
  PID:5636
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV
    3⤵
    - Enumerates processes with tasklist
    PID:1816
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV"
  2⤵
  PID:4392
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV
    3⤵
    - Enumerates processes with tasklist
    PID:4348
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV"
  2⤵
  PID:2036
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV
    3⤵
    - Enumerates processes with tasklist
    PID:2528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq Discord.exe" /FO CSV"
  2⤵
  PID:1492
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq Discord.exe" /FO CSV
    3⤵
    - Enumerates processes with tasklist
    PID:1252
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV"
  2⤵
  PID:5424
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV
    3⤵
    PID:2140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV"
  2⤵
  PID:1548
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV
    3⤵
    PID:1792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV"
  2⤵
  PID:1520
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV
    3⤵
    - Enumerates processes with tasklist
    PID:1808
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV"
  2⤵
  PID:4744
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV
    3⤵
    - Enumerates processes with tasklist
    PID:3708
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV"
  2⤵
  PID:656
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV
    3⤵
    - Enumerates processes with tasklist
    PID:4012
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq Discord.exe" /FO CSV"
  2⤵
  PID:4616
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq Discord.exe" /FO CSV
    3⤵
    PID:5492
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV"
  2⤵
  PID:2888
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV
    3⤵
    PID:32
- C:\Users\Admin\AppData\Local\Temp\Rust Launcher.exe
  "C:\Users\Admin\AppData\Local\Temp\Rust Launcher.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --user-data-dir="C:\Users\Admin\AppData\Roaming\rust-launcher" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2200 --field-trial-handle=1648,i,17524005289579908393,2069861337409523585,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4572
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV"
  2⤵
  PID:1596
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV
    3⤵
    PID:1796
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV"
  2⤵
  PID:3756
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV
    3⤵
    PID:5872
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV"
  2⤵
  PID:2276
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV
    3⤵
    - Enumerates processes with tasklist
    PID:1696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV"
  2⤵
  PID:4192
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV
    3⤵
    - Enumerates processes with tasklist
    PID:2940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq Discord.exe" /FO CSV"
  2⤵
  PID:5304
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq Discord.exe" /FO CSV
    3⤵
    PID:1336
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV"
  2⤵
  PID:3412
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV
    3⤵
    PID:3484
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV"
  2⤵
  PID:4592
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV
    3⤵
    - Enumerates processes with tasklist
    PID:4472
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV"
  2⤵
  PID:5940
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV
    3⤵
    - Enumerates processes with tasklist
    PID:816
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV"
  2⤵
  PID:3600
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV
    3⤵
    PID:3604
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV"
  2⤵
  PID:2700
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV
    3⤵
    - Enumerates processes with tasklist
    PID:4940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV"
  2⤵
  PID:2416
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV
    3⤵
    PID:1000
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq Discord.exe" /FO CSV"
  2⤵
  PID:4108
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq Discord.exe" /FO CSV
    3⤵
    PID:3900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV"
  2⤵
  PID:5812
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV
    3⤵
    - Enumerates processes with tasklist
    PID:6016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV"
  2⤵
  PID:5980
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV
    3⤵
    - Enumerates processes with tasklist
    PID:4416
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV"
  2⤵
  PID:432
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV
    3⤵
    PID:5092
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV"
  2⤵
  PID:3684
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV
    3⤵
    - Enumerates processes with tasklist
    PID:4628
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV"
  2⤵
  PID:1652
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq RustClient.exe" /FO CSV
    3⤵
    PID:1044

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

c9664b7e-f148-4230-9e56-09bdbc91bbf7.tmp.ico

Path C:\Users\Admin\AppData\Local\Temp\c9664b7e-f148-4230-9e56-09bdbc91bbf7.tmp.ico
Size 73KB
SHA256 a376c1231886a06b3998684c4bcef2be1c2be9080954bc05294cea96941e07cb
MD5 0f408b008ecc883506165870b7bd9e2f
SHA1 8c6990147faef106cd533f5d1585e89a1d514fcc
SHA512 8c5d69431f3642b9761167a9bb82a997a9ba2e6c8ae09b41b04766d3bcd0e17d6a0239650695264ec131f25860e4b41ac65cb798f4117ce43d8c1ccb4b4507a4
SSDEEP 1536:7qmVRT8gjhcZXDTw0LmnfklQ4IW5LTE0m6QKDW8JUa+Twgr8vY:emVR4RXHqnfkOW5LTE0mRKDPKTJ8g
TLSH
T1D073020367932CC9FC8B1EC6472F40885967D510A92A676C9D4B833F4C7B944E6EB477
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

41561f09-34bd-4a31-8cf8-2a1d4cfd4660.tmp

Path C:\Users\Admin\AppData\Roaming\rust-launcher\41561f09-34bd-4a31-8cf8-2a1d4cfd4660.tmp
Size 57B
SHA256 be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de
MD5 58127c59cb9e1da127904c341d15372b
SHA1 62445484661d8036ce9788baeaba31d204e9a5fc
SHA512 8d1815b277a93ad590ff79b6f52c576cf920c38c4353c24193f707d66884c942f39ff3989530055d2fade540ade243b41b6eb03cd0cc361c3b5d514cca28b50a
TLSH
T101900297652634755E1F1D65400B889B5CF905704E0B5E0641D032969A2A45D088705F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\rust-launcher\Network\Network Persistent State
Size 386B
SHA256 996c8c6063250de6e8e08070091c27d0553da65f1d903dfc5c4ad1d0155bb004
MD5 f0752a6d13f315611bb823c8a1ea0d0c
SHA1 9c2eb817c70895b6ff41a0857ea1b150fcb4fce0
SHA512 8a8e676b725bdab0471c40d5a03f91e5507b313d181bf682c45e67db1afb0b2286943374a34e3fb2473c0e1b07963e3a36ab813cb2afc543db501a3fa336371b
TLSH
T1E7E068EBD3E40DBE4B5183F42B193D23C6FE0829831C6D1289D4AB1E43BA8B8A50044B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe593629.TMP

Path C:\Users\Admin\AppData\Roaming\rust-launcher\Network\Network Persistent State~RFe593629.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

profiles.json

Path C:\Users\Admin\AppData\Roaming\rust-launcher\profiles.json
Size 806B
SHA256 455ab34e9a8b364c24ab2076e49c4700e2fd1192b8e48e4ac94a4e6b6dc55ec5
MD5 840c4d80d1eccc70ade83cf657f3e19b
SHA1 ff4c440ecff04e2e629a77f113affc61bdd41687
SHA512 2aa71f3be6aae1f672882ee7645885db69689cf665dc14cd51e1e4e90df015ec0c19118c21892fab7355210615da9aab1a6d6682472e7477c231de790d4ad185
TLSH
T1AF0126A8D8751EA710A87668FD6D04172720895B5C663C10B70C460C6F4EB2E1BFBDEE
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4572-103-0x000002163CD30000-0x000002163CD31000-memory.dmp

Download

memory/4572-102-0x000002163CD30000-0x000002163CD31000-memory.dmp

Download

memory/4572-101-0x000002163CD30000-0x000002163CD31000-memory.dmp

Download

memory/4572-113-0x000002163CD30000-0x000002163CD31000-memory.dmp

Download

memory/4572-112-0x000002163CD30000-0x000002163CD31000-memory.dmp

Download

memory/4572-111-0x000002163CD30000-0x000002163CD31000-memory.dmp

Download

memory/4572-110-0x000002163CD30000-0x000002163CD31000-memory.dmp

Download

memory/4572-109-0x000002163CD30000-0x000002163CD31000-memory.dmp

Download

memory/4572-108-0x000002163CD30000-0x000002163CD31000-memory.dmp

Download

memory/4572-107-0x000002163CD30000-0x000002163CD31000-memory.dmp

Download

memory/5684-45-0x00007FFF098F0000-0x00007FFF098F1000-memory.dmp

Download

memory/5684-46-0x00007FFF08CF0000-0x00007FFF08CF1000-memory.dmp

Download