fca3aba26cf5e4cfa4614c4f1f03dfe5764559680bf38018f4dbbbbcd7159fff

Analysis

max time kernel
95s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26/03/2024, 17:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Crisis_Response.rar
Size

60.7MB
MD5

f99b9f325d2c7d91e8962cfa422ddf11
SHA1

3e91dfb65a1c563e71cfe71b7939277b03759154
SHA256

fca3aba26cf5e4cfa4614c4f1f03dfe5764559680bf38018f4dbbbbcd7159fff
SHA512

3a2ab9abfef18ffcdc59c727c95b995d10fdad17fca2d2215b2880df3c46f5fff7985ac99cc091ddb81e8e59a96e6e328d46d9f9aced59b28b93645ded55f7a8
SSDEEP

786432:jBNsmbR7jTgJmjhdPHAdHZHfz0oJ9DcTCDaSUhqHtANyZ78uSsmGyRkLwD4emWgQ:0mRTgkjvAVZHbf+O/+1aIuS4TemVYn3J

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
5076	uninstall.exe
4044	Un_A.exe

Loads dropped DLL 3 IoCs

pid	Process
4044	Un_A.exe
4044	Un_A.exe
4044	Un_A.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral2/files/0x0007000000023388-550.dat	nsis_installer_1
behavioral2/files/0x0007000000023388-550.dat	nsis_installer_2

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1608	7zFM.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	1608	7zFM.exe
Token: 35	1608	7zFM.exe
Token: SeSecurityPrivilege	1608	7zFM.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1608	7zFM.exe
1608	7zFM.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3304 wrote to memory of 1608	3304	cmd.exe	89
PID 3304 wrote to memory of 1608	3304	cmd.exe	89
PID 5076 wrote to memory of 4044	5076	uninstall.exe	110
PID 5076 wrote to memory of 4044	5076	uninstall.exe	110
PID 5076 wrote to memory of 4044	5076	uninstall.exe	110

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Crisis_Response.rar
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3304
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Crisis_Response.rar"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:1608

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3988

C:\Users\Admin\Desktop\Crisis Response\uninstall.exe
"C:\Users\Admin\Desktop\Crisis Response\uninstall.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe" _?=C:\Users\Admin\Desktop\Crisis Response\
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nso80C6.tmp\System.dll

Filesize
11KB

MD5
55a26d7800446f1373056064c64c3ce8

SHA1
80256857e9a0a9c8897923b717f3435295a76002

SHA256
904fd5481d72f4e03b01a455f848dedd095d0fb17e33608e0d849f5196fb6ff8

SHA512
04b8ab7a85c26f188c0a06f524488d6f2ac2884bf107c860c82e94ae12c3859f825133d78338fd2b594dfc48f7dc9888ae76fee786c6252a5c77c88755128a5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso80C6.tmp\modern-wizard.bmp

Filesize
150KB

MD5
7d6eb8631fc51e0b2fddc83d90c8870c

SHA1
08228c9eddf92ad497fe625dd3e23d99a5190d3c

SHA256
88d63af9d68e6b490704698edd1c8ab0ae7bab0c701b89d1518c7643f3e083e0

SHA512
d3502ba540e77c8c7b19f5bdf3025fd6d254247661dfe6c4d36ec52ad8ddf84f1b0bea008c77432bc77c198899ac13b8c2d342f4b5867cfa6078cb350debf810

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso80C6.tmp\nsDialogs.dll

Filesize
9KB

MD5
ee449b0adce56fbfa433b0239f3f81be

SHA1
ec1e4f9815ea592a3f19b1fe473329b8ddfa201c

SHA256
c1cc3aa4326e83a73a778dee0cf9afcc03a6bafb0a32cea791a27eb9c2288985

SHA512
22fb25bc7628946213e6e970a865d3fbd50d12ce559c37d6848a82c28fa6be09fedffc3b87d5aea8dcfe8dfc4e0f129d9f02e32dae764b8e6a08332b42386686

Download Submit
C:\Users\Admin\Desktop\Crisis Response\Crisis Response.exe

Filesize
624KB

MD5
31845cf3e90eb272f6a19985132ee5a7

SHA1
093400a7e83dba870c3346fe8135e921ee3e0a23

SHA256
32cdda80fa7fba7e571c94d1a737aff0005afb5d6c4b848f7f0f26c369aaf526

SHA512
9aabd9ae9ea29ec58c57b5bcc47f4cc63ec34eaf90ccc49afc34928b3bd87b1355691e92b6f0e49534902f818f3c5cdb6474b5d9cae092b2d5161311ef32bfc6

Download Submit
C:\Users\Admin\Desktop\Crisis Response\Crisis Response_Data\GI\level3\03\0301c89270cd36101ca903ea96efe047.caw

Filesize
14KB

MD5
40340e416ffa6e7a4bd742bc4b56dde1

SHA1
d6fd0c9b2de781564aea7273f3813f5e6100da01

SHA256
0dadbf64df158727e10a146846d20a5790d4883380b10dbc2100616d7e7feea6

SHA512
a87653df8589b74c4b744fb49233e4c11cf7433dbee113bba3634d9f720e97b0e5a019d05b3587d5debc0ddc904a5b102cf1655f8c057e3b9d9f5325b148d07f

Download Submit
C:\Users\Admin\Desktop\Crisis Response\Crisis Response_Data\GI\level3\03\0301c89270cd36101ca903ea96efe047.ecm

Filesize
12KB

MD5
9562f1214e06c1e8669a69eeec588b1a

SHA1
cf02d7008665e746798b955ed2f044d93e03639b

SHA256
2ba289c3590970766812ba1ad5a6141815be89b25317f28c6f7c60ea2742f4dd

SHA512
b7780b746ae852c6ad7936ce854541d1258c34fbbca64178e9969b76884ffa9c7b2d6bfa4f2a9518e7ed3591d4d0d9de7cd70aa6feed3d119a96e1a4aaf2b688

Download Submit
C:\Users\Admin\Desktop\Crisis Response\Crisis Response_Data\GI\level3\03\0301c89270cd36101ca903ea96efe047.iws.sse

Filesize
29KB

MD5
96b1ab9ab1098ff1d4b41b43c214b7a5

SHA1
4f7ee9d5fb70f455bf70687b7643474198d1a181

SHA256
656e81f474535c4d4a3c966f1d639fa308261215973781df9865e7e1d938bfc3

SHA512
e99ae8c8bfc1dcc7b6f84f2c9d2b791c095aa932d80e102f10a54695ad985a9866fe9120eb972a76dc94f7bb47ed8ce7242bf9ab553fe88c0ae20adcde6581bc

Download Submit
C:\Users\Admin\Desktop\Crisis Response\Crisis Response_Data\GI\level3\03\0301c89270cd36101ca903ea96efe047.rgb

Filesize
12KB

MD5
825289f0151b9dcb9843a3d471bf7d6c

SHA1
a18579b2b40d6f22a1696d4c7c23e74f03ef507d

SHA256
b008ff98c4c07e788c35fb08e179db3eac8cb964b8c2742e0f4e37c7fe6c21de

SHA512
774fc37e6df97e158b9248635d033115954e3e907de9ad6458b9c5ce395bc595d78f71baec8d9805803165ddb7c27fe452af7ff22625fce0cabedee34fcc7696

Download Submit
C:\Users\Admin\Desktop\Crisis Response\Crisis Response_Data\GI\level3\03\0301c89270cd36101ca903ea96efe047.rsc.sse

Filesize
372KB

MD5
5ce43cb9b924098cf2449bc925d0f2a6

SHA1
93cfcc37c80c8da3770280735c251c6cb3801d14

SHA256
507974b871436e2fe2fca7f2d8114d2523fb5504dacae142c81bfd21e6fd03a7

SHA512
ee9b70d95e83a41f9b1812606068b5be665ce846d5b6876dd692d68bd5969907ef8e731d74b70034ff48be4ff999787eab24f6b9e510fabd86d2459535e7cf8a

Download Submit
C:\Users\Admin\Desktop\Crisis Response\Crisis Response_Data\GI\level3\03\0301c89270cd36101ca903ea96efe047.vis

Filesize
21KB

MD5
201460c4c10cb06f8756e7697608aab6

SHA1
b0d6a0c0dad82ab83dda178e166f4e5fadd0efb2

SHA256
11270a5b66baeefa867c90ceaea924619a740b5cdd246926eb249d57fb1cd7cb

SHA512
571df309541ddc015f44b7fd200ead66cf3b6c98a8f2633b1695ad8a55480b4b82f6a387d2a5fc05d1bffd9dacb5076acee80515989d9f5d71348292dd75e985

Download Submit
C:\Users\Admin\Desktop\Crisis Response\Crisis Response_Data\GI\level3\09\092b63ac28f40c63dd0cd2086f972303.caw

Filesize
11KB

MD5
06cf44635ff3f907efddbc13fbb4496c

SHA1
ac4059b5e102e70526310eb57fb4f1c59034b7ec

SHA256
ed5021ade791559937e0d4e989c775fccc2b18bffeb35d9cb4776843eeeb52cc

SHA512
d78c9fec57859e7840b82ccb8b7ffb17cb6fde44a41a81ccd5001c8aa7d77cc48c56ce5b9fc5c45ad1d86d35515b6bcb1127fb15ad4071636a64a9f3f40aee68

Download Submit
C:\Users\Admin\Desktop\Crisis Response\Crisis Response_Data\GI\level3\09\092b63ac28f40c63dd0cd2086f972303.ecm

Filesize
16KB

MD5
d170d2f66b40565aa4020decfb07e629

SHA1
c9cfc4faba33f8b1fff9ae7436c41e12b6bf39c3

SHA256
76b618b31824e6ef57ad9c53b2fd2cea4fcba9ea5ecdde052fb5fca5fffa29a8

SHA512
b962e6e3934aea80b69b231be030639530b08950b6451f8a7eed632ecc59529563ad0987f6d99b45f01e33f6809fb915838ec9a71a2d392eebc6a97e8adf1b43

Download Submit
C:\Users\Admin\Desktop\Crisis Response\Crisis Response_Data\GI\level3\09\092b63ac28f40c63dd0cd2086f972303.iws.sse

Filesize
26KB

MD5
68614cb5b87e38f4d9786d1dba65211d

SHA1
aa08cb87f2ed393edad3600a60bae26d3cd3cfa6

SHA256
b5af0c684acf623530131c242e86dacd478f996fecd8fbad07aedd195fb84538

SHA512
b8c2f589c30d63cce63e03ed6dfa2d65c27fdd502db1a655a05759d6e97404af473de648d207fc9811920870e6d2e2641a8c7f41029872474839435ace8e7f19

Download Submit
C:\Users\Admin\Desktop\Crisis Response\Crisis Response_Data\GI\level3\09\092b63ac28f40c63dd0cd2086f972303.rgb

Filesize
16KB

MD5
4a4b9c35d2006777e2028335e67a2e93

SHA1
ef20c99cd384e062a6dac0e4bd83f09b0c95546b

SHA256
616fa94dba2e7c70f726102407235f686245bb09f9007509b5f2765b12560508

SHA512
adf0b0e35819d83d33ebca88d2c7f07457a3fe626941eb03b8bc26faa64b32ab0ef79f14ad2e3b3a8c04b4995a62cab09aeed1b77958ead5311da83db70808d4

Download Submit
C:\Users\Admin\Desktop\Crisis Response\Crisis Response_Data\GI\level3\09\092b63ac28f40c63dd0cd2086f972303.rsc.sse

Filesize
339KB

MD5
1b3ac20cdb88a5870f6f644710e78fb2

SHA1
f17a2c3cab629b24701a7492c41ec9012365e431

SHA256
8f9371ea53bbffcd9e873e3025e9066bbb06f25b0c694ae4a25a5a35fb765a47

SHA512
05ba3afd571a00de710632e4b251bd147e54896ce32e8b8666c780a4f6cbc4b0f8e2d63dc893cf180997d84b8877f1eaf0857f64dd319f387bf8bb25288e6c07

Download Submit
C:\Users\Admin\Desktop\Crisis Response\Crisis Response_Data\GI\level3\09\092b63ac28f40c63dd0cd2086f972303.vis

Filesize
8KB

MD5
1b3d716bae04a1bc62fdbe803ecaeb70

SHA1
c1647e539ebad9cc69f00dcff7b55e3a5273a969

SHA256
0243316fd2d5b1aebd40c86d543e9419d75f9a8b1c04be60592781bedb6d9ec5

SHA512
dd00da3e82bac595770e2290bd62160f41b187b5d9efff6e29f70c528580d312df8540e4535d7370dc49635320ad097322d0165b186781ec7cd61897a65bdd1e

Download Submit
C:\Users\Admin\Desktop\Crisis Response\Crisis Response_Data\GI\level3\0a\0af451c6c77675179a074155a94da2f3.caw

Filesize
13KB

MD5
b65fc139f6ec5ba805864181d4b91739

SHA1
fbbaee696e00a399d79fcf97fd190a1650d8cd74

SHA256
67ffd0a68e21d27a069d8d2ad83901c11be03e7bd5a649d97ff9ce74ad4cc5cc

SHA512
caecb44e1ec611437a73ec397ae482e398ea159dcd5f05557428229d6a87dd4a0dac913a1fe8c8f04d922ce2ef53176712962548861b1c6ed9049403c0459b2f

Download Submit
C:\Users\Admin\Desktop\Crisis Response\Crisis Response_Data\GI\level3\0a\0af451c6c77675179a074155a94da2f3.ecm

Filesize
15KB

MD5
3a2b6a0a653108900d24f6436806c909

SHA1
500d568d225bbbdecb4e8f7e14c3ecf77abb29c7

SHA256
08fcce6876565ac58a867cec296f55e1078d36ab773104fe5a2e66e25013db45

SHA512
3d51e7966d8d8e3e7ad01d443172426b77a07dfc7e9e08c9be501a5b99972d038a359e21b98ab55d8a6b8610a57bd34ae9a598ececc6150dba6b30e33d55cafb

Download Submit
C:\Users\Admin\Desktop\Crisis Response\Crisis Response_Data\GI\level3\0a\0af451c6c77675179a074155a94da2f3.iws.sse

Filesize
27KB

MD5
794784c293d532928a66997ea4693ef2

SHA1
24445a2454505b1fc0e7c8ceaace98a7d5e589b4

SHA256
c1701c0017ee2372a30811ed6697a4d22a5fee1828e5f6bb8ed65d53aa43ddbe

SHA512
568beb1853f0699f3e4908447e6a9771ae573589a0d3dc4bc6639e6387a7ae4e45378f0f4e1c7ea8d246c6316bfc6927257906d424c80494b907f385bcfac2aa

Download Submit
C:\Users\Admin\Desktop\Crisis Response\Crisis Response_Data\GI\level3\0a\0af451c6c77675179a074155a94da2f3.rgb

Filesize
15KB

MD5
f9fc96d77b6d361ee168dfd13305dd9e

SHA1
42220f19a82b489e857ce9fb8ae456f971e1bd87

SHA256
7f072211630e4b8b12696e9af31f78169f3f23865008829aedbeee303f772372

SHA512
b3b5c1a56474bdc86e50f8ea3a765e28b68ce04a5b14fb677524eda6daf2700806d83b1610b7613aa68ecedbdf79aac0a5ae6de25d9c44e3b5ffac30dd4d6b91

Download Submit
C:\Users\Admin\Desktop\Crisis Response\Crisis Response_Data\GI\level3\0a\0af451c6c77675179a074155a94da2f3.rsc.sse

Filesize
323KB

MD5
2efc0a18b5cf1987974cb77b5ebe0543

SHA1
afa7fcea9599df155909758e773032f57721b3c8

SHA256
4ff041fa99dc93aebb08a2b88b618223bf77a1f7657f00d794736bb0af38751c

SHA512
2a9a1b0e1dcb4f7bada1d5559faf3d9f32d38f9614649086a6ebf691d42bca1d514ac16517359090ba723c088ee9d147192bba3ded13927b77dfada551d54cc3

Download Submit
C:\Users\Admin\Desktop\Crisis Response\Crisis Response_Data\GI\level3\0a\0af451c6c77675179a074155a94da2f3.vis

Filesize
9KB

MD5
491263188794ce2f1aa74f1e80864257

SHA1
d9ca0f5712acfbfd6b2a384877d315f1dc2fb0a2

SHA256
4b338e596b0ce0749e4548ebb117862d99651f60030823931be9790038c35b2e

SHA512
579c6237c46035702bd90919fb88665d03ca10bce363756789a6985820c18f012d38ae2fb01af1ab7b53466919459281ed26f6ffbd65635bb28dc74a1409d662

Download Submit
C:\Users\Admin\Desktop\Crisis Response\Crisis Response_Data\GI\level3\32\32365a3c7b9b808001959040b373e1cc.caw

Filesize
7KB

MD5
68c8e8b86b1b7d540e51137aa6e84b6e

SHA1
ab4ea8c1c148d4f46edf4c98025eb47f33c45b9a

SHA256
74e6026107a0063a82580285bca2d608c613477f798530db0a3d56f596393d9f

SHA512
7a1ededcb78f0c50cd2a732346dfd7588e5ef567f1db2cda52697f748a39139a21d1cc2bedd8e908c906a545b3bbff72248be9c7b0b1c9401267bd14656b1a7d

Download Submit
C:\Users\Admin\Desktop\Crisis Response\Crisis Response_Data\GI\level3\32\32365a3c7b9b808001959040b373e1cc.ecm

Filesize
10KB

MD5
39f6cbeb2339050f63aa52ddb42e66b2

SHA1
afa6123b394842f703f94bda95fe4883bc115a4e

SHA256
42da257bd2bedd1fef031055fb1366db09f2e1a3aec9a00d12359ebbf79da805

SHA512
d284767bf491d09f920adf7068f413b5eb52f6dcd72a27626cbc9f8d1fe90de8e3d3b56d10e0754aafc887796341c5768ff45efba5fd754450be81d1b287289f

Download Submit
C:\Users\Admin\Desktop\Crisis Response\Crisis Response_Data\GI\level3\32\32365a3c7b9b808001959040b373e1cc.iws.sse

Filesize
14KB

MD5
77aab8c2d71330d071dece6c86770489

SHA1
fc5713864990221c6d449083a5e55640b88870ca

SHA256
0513d066db8e91e1ec056254552a56e5f81d46e24f5e928f55c4aeb2fcc194ad

SHA512
8c2468260d1772f24015ac87621e13d1133ae70151b7e11ad15191969237fd8c7f590e35e1a10e6531e3bb1ea2927471d1d5ded63c59aa4ba71721df3ac191d4

Download Submit
C:\Users\Admin\Desktop\Crisis Response\Crisis Response_Data\GI\level3\32\32365a3c7b9b808001959040b373e1cc.rgb

Filesize
10KB

MD5
12881b8695eb3d7b94e2cee35ffd2c89

SHA1
937aa26b156fc027aeb0bc834e705cec0869211b

SHA256
ac9123a73ae5c9e328e6b445e5769eab3dfe733b65f3bd6356b730799a090962

SHA512
937fd097a6b084bbbc095f3d18e4acf15002ab8f4bcdbf0e8582dd2689a97771ffc792e0b55d86959e1f3ab754bf4362198d1fb6330a865c8ac1a2181808c058

Download Submit
C:\Users\Admin\Desktop\Crisis Response\Crisis Response_Data\GI\level3\32\32365a3c7b9b808001959040b373e1cc.rsc.sse

Filesize
198KB

MD5
6f3f50ee128fea47ece30469b76e26eb

SHA1
2fcbf38c19b3ed3566b1328e41c31988efde9f31

SHA256
38d44ab64c279d992c31f650cf5aa04ecb5b2ec57fa0542f4a5e26c3ea00a544

SHA512
9661e82d47578be864ea13d37d63dd66fb99341a9e42e1781ecea898ae633c17ac3f11c36f44a38efa205fa2a027b6448363c5a7501cd9b5ebc1fba408f5aa28

Download Submit
C:\Users\Admin\Desktop\Crisis Response\Crisis Response_Data\GI\level3\32\32365a3c7b9b808001959040b373e1cc.vis

Filesize
5KB

MD5
5de65d9d50ffa88fc4f89a6225b53636

SHA1
9dca82cf863964fc4f4c298cda10e3882aa37181

SHA256
2a956d251d7d4665cf3149380ffffadebff8e524e8d621001ff5c28874f08949

SHA512
f7a7d7a502ea37f1df78ddb74ee6e1fd3ef91266a306085cfdea2eac3a6c7f3b717c17f80d1f3eefd551f68e835f4ac20f602528101ead887b9a4174bb6366a3

Download Submit
C:\Users\Admin\Desktop\Crisis Response\Crisis Response_Data\GI\level3\32\3268dfeff5036955919c05d5e7654aa8.caw

Filesize
12KB

MD5
a278b6bedad58365248b1cceafd7263c

SHA1
a12ccc8ae97b917a09a29997f3af3c2cb83cf4db

SHA256
82ad7935dab385ce9487a30c9975d81a23f3f5a0ca71ef386479ad9b0a29fe41

SHA512
fdddaa9170b902dab26ccb2b2564dd4b60508bd5e1e74adbf1ec5831c23b2b7ee90207f4462f322221439df2a6b49b1add5702fac05aea90d77d0424e0ed0cb5

Download Submit
C:\Users\Admin\Desktop\Crisis Response\Crisis Response_Data\GI\level3\32\3268dfeff5036955919c05d5e7654aa8.ecm

Filesize
11KB

MD5
81fd79ad3ae098180bb9f39a062fb43c

SHA1
628e4db3d682a8600c3adb7260b4bb04fbb0ee51

SHA256
e7c087ce6a1ef8fbd1f82aa4293b514aa1df759b144406f701e75579ab5b67c0

SHA512
6b873599395f7ad79e3659e0a3b3609a3b89c082277058a12878eb70deddb2d1ae46a389dabee7d19bb5cfbc4562a7fcde16f4019a94e4b4283079c1988758c2

Download Submit
C:\Users\Admin\Desktop\Crisis Response\Crisis Response_Data\GI\level3\32\3268dfeff5036955919c05d5e7654aa8.iws.sse

Filesize
39KB

MD5
c6aa6b92d2df34a7d8914662ced8d755

SHA1
b73b2ae041ca3e7562577e28136096bf20d78acb

SHA256
5b0518d76c55aa72c82133fa9abb4abf318bb7d0af4386c1cac4eab05cc19281

SHA512
175e0a010bc2686667097a09f4c9a3ebcb9102feee477ef4271e09d9f69f7676188a7619e6ac93ea32209f91e768ab981a04ebda01f2546213de368e294d26ff

Download Submit
C:\Users\Admin\Desktop\Crisis Response\Crisis Response_Data\GI\level3\32\3268dfeff5036955919c05d5e7654aa8.rgb

Filesize
11KB

MD5
77432c610a8680f466cd0e16830a02fb

SHA1
a14e1e031988f159c22e67d790fcebdae19f89dd

SHA256
d82b387712cef3e4063bdd44edbe6edbbce863aba43f0cfb884b465f13a0aacf

SHA512
9608a45017868ba18717f9aaf5528f549f0905da27533ca34652cd5c2b9a370fecc464d6df4e36fe6d916594a51c9a198d8cb3c4bbf9b19f3f8f9e7f100076ba

Download Submit
C:\Users\Admin\Desktop\Crisis Response\Crisis Response_Data\GI\level3\32\3268dfeff5036955919c05d5e7654aa8.rsc.sse

Filesize
262KB

MD5
25a171a3190bb01095503e809fdf9175

SHA1
e2c3b605fe79a6125f9ee21bb35e957e6f19184a

SHA256
13efb22bc148eda980018baaf84867d63ec15f90aa6a581095a90bffc420a9c9

SHA512
8d1b9cb8cd53db2ff0d87fa986000fc584d015b8469bdd1cb1d7c7c3bfdee586c9b75b650855313de52cd117446776e74ab2a2b141acc125503b55f47e694a33

Download Submit
C:\Users\Admin\Desktop\Crisis Response\Crisis Response_Data\GI\level3\32\3268dfeff5036955919c05d5e7654aa8.vis

Filesize
11KB

MD5
a163fc70d0b1faf1a059949acabbcbe9

SHA1
d138aaf4df8ef9c21007e93801119446c10489e9

SHA256
69a13fab3d4a90e01143590d396d68d56a2dffb7bd885bdcf6bb9096566ed266

SHA512
a3b433537a73d9d6b7f4258b729bb99615e59c5c1b2018af054a273d652099fed945bd03e5224bd8e9b605d50e2b0510f06f433ccb9bb1669e58230d78a0bd60

Download Submit
C:\Users\Admin\Desktop\Crisis Response\Crisis Response_Data\GI\level3\39\39ebba1858926eaf885081b8dbb14f62.caw

Filesize
10KB

MD5
fa452bd38045a4662e81baffaf4dd1dc

SHA1
010fcaa9b3511ab1a463271889a4e667bc3c9bea

SHA256
16f8568dd42bfadb14c283c6ddfb51d327f27367ea566df93e2140ce9752e735

SHA512
b905dc75d4c63ed70619ee2a42287806270554821164072ffe8b31f2fb1ae2d0523de229994d772553404a0dcd5ec70e3a9021722b7b0f4f45aac18c32ad8574

Download Submit
C:\Users\Admin\Desktop\Crisis Response\Crisis Response_Data\GI\level3\39\39ebba1858926eaf885081b8dbb14f62.ecm

Filesize
12KB

MD5
78e81d8c3358911aabd2dbe60dd0a70a

SHA1
6e91521053ff60b263830c49e2d25f353a36c05a

SHA256
5511ec531a7cf481ab1b79f229141d8db7cc681af2e9ce7d378601562a33d48b

SHA512
40b9e194252ebdf7fd211503038efbd0561468b85ace5f1fc82b8e64f8469e60136dc7bba1e727c4336f7768b2791c6ec95951c11a473e67202b77db0a8354b3

Download Submit
C:\Users\Admin\Desktop\Crisis Response\Crisis Response_Data\GI\level3\39\39ebba1858926eaf885081b8dbb14f62.iws.sse

Filesize
31KB

MD5
cb18e8283bb86668471a2861e296918d

SHA1
4ad45354ad4c871f5cdc438a731cb3c195526ce8

SHA256
eda2c1f9b8860a2bf4aa25eb427e459271ede34f0482030df213a84d616814b5

SHA512
4c0b09c3b2cff69c8d246b988ae45b06db1baf4e3ccbfd807f33f67806ad737cfcb787ac2baec5f3237d14a66c18991044ffd1fe153e5ed2e8fc65816f31bddc

Download Submit
C:\Users\Admin\Desktop\Crisis Response\Crisis Response_Data\GI\level3\39\39ebba1858926eaf885081b8dbb14f62.rgb

Filesize
12KB

MD5
7ee812f7ab7f57fb59a89b7c5f48ac55

SHA1
768d8527d12f8e7a95972db85fd8fb4ebeb6e915

SHA256
998131d84d07b2e56e994af99d7867cc01f583d30d9ed0becb64e4e59f44ffe0

SHA512
92c53ed9efb1663e5bd47150394f47a4dde37a5b1fc4c0bad083c05d3a5e8f7d69c900b4204709bf0bd286344df5238f8f86ec8df842dbdfe5683a113ab4e57b

Download Submit
C:\Users\Admin\Desktop\Crisis Response\Crisis Response_Data\GI\level3\39\39ebba1858926eaf885081b8dbb14f62.rsc.sse

Filesize
279KB

MD5
3f00972bffdeea1b92dacff581673041

SHA1
5fb6d28334082bcd30bab91b91c307c5ace3a99e

SHA256
e8aa0f527da050c6c4627c9c6cd65992e7484c3468aaa22711dcb49cccd06e29

SHA512
3272fbb295fac2cc7e4c9c4db37360c2340baaff30b1723228eddcf1c9e58766da851e060ec23248fcaec0d5660c43fa53399da521aff5315f0dd4b91b3769f3

Download Submit
C:\Users\Admin\Desktop\Crisis Response\Crisis Response_Data\GI\level3\39\39ebba1858926eaf885081b8dbb14f62.vis

Filesize
16KB

MD5
c43165097940ad3c1826f97f18e28cd6

SHA1
99ed8707cbf168c08f0258516f3da218a50b59af

SHA256
a323d41e2e93491ffbd9d5068ef6092737c43917b33c8fbba859975b1b550ec6

SHA512
e16fcf5cbd8a9a46ee2e0216662d149de8c1d4a69fa4ad1f61fd1482857b33e904398e7513ee48330297b1497d8a7b8d2e5b1b4fe17442f29d1f4fa994fb050b

Download Submit
C:\Users\Admin\Desktop\Crisis Response\Crisis Response_Data\GI\level3\3f\3f8d70b1a6c743bc57fb76f8823ddfbf.caw

Filesize
15KB

MD5
637d773896cf4f0356b6eedc7f5b6986

SHA1
9331cb95b6e920354ae40b47a118574afb62ef51

SHA256
38e01100e7528d999a31a65fa09007fd516132e28e50fe40a185e4b8f853ff05

SHA512
6ae469ebf348a16d5524eb530c50937a1c96bc4bcc068495a5516c43341c4f0a3a43423d6efda833c9f5cb1e9cbba6d8e075d6d81a34ec1fde5640a790498768

Download Submit
C:\Users\Admin\Desktop\Crisis Response\Crisis Response_Data\GI\level3\3f\3f8d70b1a6c743bc57fb76f8823ddfbf.ecm

Filesize
12KB

MD5
3460b5981f3a1cee459ab274137827b3

SHA1
44ca1c34fd486dc128a36bcc20c17f2aac238f0d

SHA256
57b377ea2e209ce1fb1b10c29a014df222d5e5cb3b222e798639e297d44fffd5

SHA512
1a7fdeef849b0d08173334b356cb2228eb024f7dec51bbca473cfc0286f90e0d5abca6f5415bedc91812ec6fd6c2c7fefce6ffbd7a62cbbae4e90ab7a70d0c18

Download Submit
C:\Users\Admin\Desktop\Crisis Response\Crisis Response_Data\GI\level3\3f\3f8d70b1a6c743bc57fb76f8823ddfbf.iws.sse

Filesize
48KB

MD5
2d9805851be2c3f75a138cfc1e8d8490

SHA1
c2ee05e2b8ee1eed62d45eddcaf899353bf5e3fa

SHA256
9e840ff1d3a6062d331023aaa579418cea65de7ffc9b5e4273744b88a818bc05

SHA512
7f30f851ad7061140e99de6a993383b921f3f4c8f8cb66f3189d3a1d90706588cef0b0436ee468b863ac28cd0675fb3bdd09b540df9cc9d31b4578253b12f011

Download Submit
C:\Users\Admin\Desktop\Crisis Response\Crisis Response_Data\GI\level3\3f\3f8d70b1a6c743bc57fb76f8823ddfbf.rgb

Filesize
12KB

MD5
5cb86328bb03be41db495ba0cd7c9be0

SHA1
1eb360e61ba175ac25930f4613f8630c81189bde

SHA256
25dd4573d9a4043f69d18a0b5c2e22f4e446c563bc131ee0b7d852802b064e94

SHA512
6dd50d4dd28a38352fcac58fbb0d3bbaae0d7885cf2d3efdadfb7894d88e79cc630bbf30870661e2d5234b4eb0a3863a5b2facdd72517dbdc49ecdc08a9cbe92

Download Submit
C:\Users\Admin\Desktop\Crisis Response\Crisis Response_Data\GI\level3\3f\3f8d70b1a6c743bc57fb76f8823ddfbf.rsc.sse

Filesize
295KB

MD5
f3e7cacbc520ce31e56a88331d02ec0c

SHA1
7e2c43111982dfc6c569508822b450841af9219d

SHA256
5af5b847d80f84f678128f84229ae573012fc89af5d99c987d8c2244c98d038a

SHA512
5ed58b995c5ac229ef4df35d8a6de50bf1a06cb3386483b2a40f30ce5d97ac423a01da4712c77e19239e9e23274ae92f29c0c85cb5317518947636963865a185

Download Submit
C:\Users\Admin\Desktop\Crisis Response\Crisis Response_Data\GI\level3\3f\3f8d70b1a6c743bc57fb76f8823ddfbf.vis

Filesize
23KB

MD5
f92da0fcbad578a806a73cb260afaaf2

SHA1
a667e323e1c8f1cea2e381ab65c2ef99ea2d648f

SHA256
fd8c743350bfcc83ca9b8f9e9bdedcbfaa7eff4f91f1bd18f6453b83d2e9eff0

SHA512
e4bfdb1e7cafcbc1ad9801123dc6c4a7a0f120d0c70c65f9061c60675a9d546290df35e2a66132321ddae1da332b3e5839163aef5e2f78ae599fd86080c60c50

Download Submit
C:\Users\Admin\Desktop\Crisis Response\Crisis Response_Data\GI\level3\4a\4aff57efb34fd142373a8dfbe6500ad1.caw

Filesize
4KB

MD5
6348adc83d3fe7b0310987097e9596fe

SHA1
bc9dc7d544c304603bccafc144044fea73589845

SHA256
4e6a642f51d8ade6d74ea1f9d03e6cb751921e48299879502dcfa32fc9491f42

SHA512
b4242b1015cd9ff4c55ccc220dee9ac06c1689a64b6bddb5d15900de201b071516bdeae3f838239fb964380a9122b8baa2639942f1351dbe4a17e3e4326276ab

Download Submit
C:\Users\Admin\Desktop\Crisis Response\Crisis Response_Data\GI\level3\4a\4aff57efb34fd142373a8dfbe6500ad1.ecm

Filesize
6KB

MD5
a6d646fc426b76fd8bbac2d8bdf8e9df

SHA1
3c2a201a345c5124b1a5d31000d5424c56c4ff09

SHA256
e932372d9dcb6cb5d590a494fec3900863f50f7d17d82435b9a9296690df5f88

SHA512
9ca2f9a4b5d84062337f78b7cf5f15f76849578ae035f672368bb3b57a46dcca2cb607fdc948286e3637e9a64326d2a81dd954457189554a877e028582956b14

Download Submit
C:\Users\Admin\Desktop\Crisis Response\Crisis Response_Data\GI\level3\4a\4aff57efb34fd142373a8dfbe6500ad1.iws.sse

Filesize
8KB

MD5
912064ff07cbed38166b3bc8ae6183a5

SHA1
1184ee45efcf03ec7314aa8ecfca15b5b46fb89d

SHA256
a8f7411cb306e79adb82eca920812da794781a65b980a2eade31edf3b1bda675

SHA512
3e9c9e2eacba7fbe44445a4312fb4418b783213a1d97725a5fb21ed6bd49a7dc3a5576455fde086ee3233e3138ba93823dfc12f878b3207b4bf7d42d6e898a40

Download Submit
C:\Users\Admin\Desktop\Crisis Response\Crisis Response_Data\GI\level3\4a\4aff57efb34fd142373a8dfbe6500ad1.rgb

Filesize
6KB

MD5
41b7e6e50fe88e28b06759a7ea8d34ae

SHA1
ba399f02f388a2743fbbee9527fb8247a67b1543

SHA256
c88a82eac7fbe1c18214d22c0d3e7e8283ad98f9bd3efa037e4c1ea7564e3b6d

SHA512
d0cf1144c7f179d4945507fc6cb0083e2795a75715d50eac75ca800ae83e0943aa6555a0e33d8fe8dd31e688c4a0fa5255b2d56a30853022262b18185e8e1503

Download Submit
C:\Users\Admin\Desktop\Crisis Response\Crisis Response_Data\GI\level3\4a\4aff57efb34fd142373a8dfbe6500ad1.rsc.sse

Filesize
119KB

MD5
f6f0a0e677a348eb5233cad9a2102315

SHA1
35408e19955f09a2d97076461d6de9c53f8f3228

SHA256
63ee9eccc8723312c3a919f4c69ed702d21191cd25e8a055237ac703c2f331b4

SHA512
7282885680a42f2587ff26f3e6904e8e22e3a0c28ec72a86e9b1b4b320267693b262d592cc4ff0437015c38e9bc34f495fd294d8626cc91fa94f5431d5b1f31c

Download Submit
C:\Users\Admin\Desktop\Crisis Response\Crisis Response_Data\GI\level3\4a\4aff57efb34fd142373a8dfbe6500ad1.vis

Filesize
6KB

MD5
a27eb94abbbb715854251e99b0319d08

SHA1
37599600d8858263d99a0f2d715cb62bb4e3fde4

SHA256
47cafab26a3bf8f0a4c3cf9db7dab9937d1fae4e48e6144793e1920d4522ff62

SHA512
06aa5669b99a417a419ccab1d7855b6456f66e7eae64ca9d3b5c708f5b4b115b69a59a0b4495a6071da4633b76f1fccdff16f93034c7c83d5e22d1883e3f7b14

Download Submit
C:\Users\Admin\Desktop\Crisis Response\Crisis Response_Data\GI\level3\52\524d0b0f7e031f9eb3052e047f323712.caw

Filesize
5KB

MD5
a7fecf8ae22e4b5ded9a5a7475fb12d1

SHA1
b335fc1fa01690d0fe1f03aba296fc802182d3b9

SHA256
b16ab6e64ae34a0d1b2649a1e91799e7d08a14108a48d034b7994e5e201593d2

SHA512
0f506f0f3821d02cae9f912f08a89eef98fdf040ee9aa3d05684073d45f6f5a2ba53363ca4199583de168d801f7fb6ae52445131ed1c0e4bef0799fab2a66bd3

Download Submit
C:\Users\Admin\Desktop\Crisis Response\Crisis Response_Data\GI\level3\52\524d0b0f7e031f9eb3052e047f323712.ecm

Filesize
10KB

MD5
c0d82b1cdcb306ed89bd59fffb22bc50

SHA1
869cf2dbed0a0ccffc435b2dba0220391ac2f990

SHA256
bcec73a6f08435cca705c3dc444004b03aa190bc46574efae6a37561804d4162

SHA512
9ab50e8e2318d32ead043a87e85cc24000d9347f4c074733f096872049a1ec3f65d75291a77e3285f7a4fe2b12e890dc6d910b0cde737dc3cf6fe9d2ff48c99e

Download Submit
C:\Users\Admin\Desktop\Crisis Response\Crisis Response_Data\GI\level3\52\524d0b0f7e031f9eb3052e047f323712.iws.sse

Filesize
4KB

MD5
f96e4eb2fadba21b4fed41b22621e453

SHA1
2d7b1be4586398b2ddd9f248c104a9fdcbff4f4f

SHA256
f61af890f7c6bfaffd6878a020149d9e03fb84365765698c616877e51052c086

SHA512
1507a58bf57cde85d1d2160a3fc6236b7fa809c48c505a732410385c7ed418b93e2da18a24066dd0ce34b612ac1d498850421e47eb9795419d8198c002859e39

Download Submit
C:\Users\Admin\Desktop\Crisis Response\Crisis Response_Data\GI\level3\52\524d0b0f7e031f9eb3052e047f323712.rgb

Filesize
10KB

MD5
ff9372e67e172262ff235d0c6535f9f4

SHA1
54d3cbad025d82aa42c87d5dee0811b3a9be5c83

SHA256
0fd5d01a764dc5e00a9e8a6657e96948cef9ffa87e976bc07d6476d63596c8dd

SHA512
ee836c427ce04f9d85fb1f12e953f36a4821479bfa61abb6875fb300bc534cc13860b65d4d5c3039902f5f51cb16790f81711db7975eed3d0ed86b4722faa6cf

Download Submit
C:\Users\Admin\Desktop\Crisis Response\Crisis Response_Data\app.info

Filesize
24B

MD5
2d2a00d04ae6f7dcd461534344e9d63d

SHA1
41344ff4fdb6c7a710851ff507f5a8930006d170

SHA256
fa58c756c05ae8ce4251ce80f611b7a419d99f2f35b2bb43a61629ece0edcb0d

SHA512
069bbb4c56f63537ed1826473c7265e76b08f4efa22ae6707702dae8eaba58dfb860644c77535dbc5fbd7fcda634159bd4d8b65faeeb72d65c75e8c03886c443

Download Submit
C:\Users\Admin\Desktop\Crisis Response\Crisis Response_Data\boot.config

Filesize
44B

MD5
ca95672fe07a435d2c46c126f87fbb48

SHA1
ab68f422419348e4e649ccc954939c05789be36a

SHA256
1d8998bce4a9eddae2c8674bd3fce2bcc1a9e335f583d4e3df88562ba87ddf39

SHA512
4a409aa94ce98c4cec6cae84421c14fe548a72f5adc96819a7f0d98e6f60d9521e75eab4479860a3e623062958296cd87533f133090fa6b8711e3bbac876d5b8

Download Submit
C:\Users\Admin\Desktop\Crisis Response\UnityPlayer.dll

Filesize
16.3MB

MD5
7a5736d2bc7aa6e1c67ba783c65a69c2

SHA1
90496c309292bbb632ba03f711f6acc28d7a3efa

SHA256
a5569a55da50b5d7df72eab8b3ee29a7c921eb1c78cb25bd4db74276dbccb684

SHA512
f0ca57912bb0da4092468ddb87e1e289914f19af0728396ddc3b42b676c6d596bf38c9241f8260f59baa8be7054d9b35d96d62d3976e6ab378150f493165d92e

Download Submit
C:\Users\Admin\Desktop\Crisis Response\credits.txt

Filesize
349B

MD5
2bd197111a432bf02774226bd5f4aaec

SHA1
6e974301c69ca9f7b5953102e2f54d4227b5e784

SHA256
1f10ce317005b598e82585affcd00927ff9cdb4c423450ae83226940160effe8

SHA512
ac03cb6e73b8e2cdba96740dc9e31746faec676d73131ced048c82ef29e5b16385b915b3734246d512f39df08b44ca43f9b4960cdc5b7200f13ff062c00b1222

Download Submit
C:\Users\Admin\Desktop\Crisis Response\uninstall.exe

Filesize
412KB

MD5
e39b5156ff4d40e67bb726e629c82888

SHA1
9b1733df501fa063b1a91a27e1ad01b6fbc930f2

SHA256
60edb8b375762346e0dc7e4b460d0c2b5a9e813b65be76ea4bd249253edc622a

SHA512
4933dd5ba57f52916b4a3ea0b5fa5af5ee68b9b88d7f22bb587b22cf0a7bc004b86bfe28ff101fd1da09c2c6adc4136d763ab7bc99005f8b0131e1517f1df7b5

Download Submit