crimsonrat | 1347eab7618fa7c80e716cb6634f1a2f72a7c51a58afe59b3f57a2e35f957937

Analysis

max time kernel
1282s
max time network
1284s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
03-08-2024 09:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

belge1.png
Size

3.9MB
MD5

bf5ef288a9835e272c3f2a67f7dd76f2
SHA1

b8c2053e414148754b26cc358078aadb366c9a84
SHA256

1347eab7618fa7c80e716cb6634f1a2f72a7c51a58afe59b3f57a2e35f957937
SHA512

4355002506845f9cc68183cd6adf081bdf473dff275014b3586f8ff450a9ae4644f430b9358b55a8f82774494d9c6a0557e8fce857c99f26f1d17bee3a71d913
SSDEEP

98304:6yrA2oNFsjHj9Ym9vEhmEj043Sk4ytSJM366c52HHMQg:Fz8sjH99adr3CYHMQg

Score

10^/10

crimsonrat lumma njrat defense_evasion discovery evasion persistence privilege_escalation rat stealer trojan

Malware Config

Extracted

Family

lumma

https://extorteauhhwigw.shop/api

https://bouncedgowp.shop/api

https://bannngwko.shop/api

https://bargainnykwo.shop/api

https://affecthorsedpo.shop/api

https://radiationnopp.shop/api

https://answerrsdo.shop/api

https://publicitttyps.shop/api

https://benchillppwo.shop/api

Extracted

Family

crimsonrat

185.136.161.124

Extracted

Family

lumma

https://extorteauhhwigw.shop/api

Signatures

CrimsonRAT main payload 1 IoCs

resource	yara_rule
behavioral1/files/0x000400000002ae4c-8548.dat	family_crimsonrat

CrimsonRat
Crimson RAT is a malware linked to a Pakistani-linked threat actor.
rat crimsonrat
Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Downloads MZ/PE file

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4664	netsh.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b9584a316aeb9ca9b31edd4db18381f5.exe	NJRat.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b9584a316aeb9ca9b31edd4db18381f5.exe	NJRat.exe

Executes dropped EXE 8 IoCs

pid	Process
3004	winrar-x64-701.exe
496	winrar-x64-701.exe
1468	Launcher.exe
4996	Launcher.exe
5788	CrimsonRAT.exe
776	dlrarhsiva.exe
5272	CrimsonRAT.exe
3556	dlrarhsiva.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Windows\CurrentVersion\Run\b9584a316aeb9ca9b31edd4db18381f5 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Temp1_The-MALWARE-Repo-master.zip\\The-MALWARE-Repo-master\\RAT\\NJRat.exe\" .."	NJRat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\b9584a316aeb9ca9b31edd4db18381f5 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Temp1_The-MALWARE-Repo-master.zip\\The-MALWARE-Repo-master\\RAT\\NJRat.exe\" .."	NJRat.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
1177	raw.githubusercontent.com
1176	raw.githubusercontent.com

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1468 set thread context of 5608	1468	Launcher.exe	176
PID 4996 set thread context of 3732	4996	Launcher.exe	181

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\winrar-x64-701.exe:Zone.Identifier	firefox.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
2824	5608	WerFault.exe	176
5456	3732	WerFault.exe	181
5924	3732	WerFault.exe	181

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NJRat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher.exe

Checks processor information in registry 2 TTPs 16 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133671505565570308"	chrome.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings	OpenWith.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Password-1703.txt:Zone.Identifier	chrome.exe
File created	C:\Users\Admin\Downloads\winrar-x64-701.exe:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
5004	chrome.exe
5004	chrome.exe
3760	NJRat.exe
3760	NJRat.exe
3760	NJRat.exe
3760	NJRat.exe
3760	NJRat.exe
3760	NJRat.exe
3760	NJRat.exe
3760	NJRat.exe
3760	NJRat.exe
3760	NJRat.exe
3760	NJRat.exe
3760	NJRat.exe
3760	NJRat.exe
3760	NJRat.exe
3760	NJRat.exe
3760	NJRat.exe
3760	NJRat.exe
3760	NJRat.exe
3760	NJRat.exe
3760	NJRat.exe
3760	NJRat.exe
3760	NJRat.exe
3760	NJRat.exe
3760	NJRat.exe
3760	NJRat.exe
3760	NJRat.exe
3760	NJRat.exe
3760	NJRat.exe
3760	NJRat.exe
3760	NJRat.exe
3760	NJRat.exe
3760	NJRat.exe
3760	NJRat.exe
3760	NJRat.exe
3760	NJRat.exe
3760	NJRat.exe
3760	NJRat.exe
3760	NJRat.exe
3760	NJRat.exe
3760	NJRat.exe
3760	NJRat.exe
3760	NJRat.exe
3760	NJRat.exe
3760	NJRat.exe
3760	NJRat.exe
3760	NJRat.exe
3760	NJRat.exe
3760	NJRat.exe
3760	NJRat.exe
3760	NJRat.exe
3760	NJRat.exe
3760	NJRat.exe
3760	NJRat.exe
3760	NJRat.exe
3760	NJRat.exe
3760	NJRat.exe
3760	NJRat.exe
3760	NJRat.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1408	OpenWith.exe
4160	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 57 IoCs

pid	Process
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3800	firefox.exe
Token: SeDebugPrivilege	3800	firefox.exe
Token: SeDebugPrivilege	3800	firefox.exe
Token: SeDebugPrivilege	3800	firefox.exe
Token: SeDebugPrivilege	3800	firefox.exe
Token: SeDebugPrivilege	5364	firefox.exe
Token: SeDebugPrivilege	5364	firefox.exe
Token: SeShutdownPrivilege	4160	chrome.exe
Token: SeCreatePagefilePrivilege	4160	chrome.exe
Token: SeShutdownPrivilege	4160	chrome.exe
Token: SeCreatePagefilePrivilege	4160	chrome.exe
Token: SeShutdownPrivilege	4160	chrome.exe
Token: SeCreatePagefilePrivilege	4160	chrome.exe
Token: SeShutdownPrivilege	4160	chrome.exe
Token: SeCreatePagefilePrivilege	4160	chrome.exe
Token: SeShutdownPrivilege	4160	chrome.exe
Token: SeCreatePagefilePrivilege	4160	chrome.exe
Token: SeShutdownPrivilege	4160	chrome.exe
Token: SeCreatePagefilePrivilege	4160	chrome.exe
Token: SeShutdownPrivilege	4160	chrome.exe
Token: SeCreatePagefilePrivilege	4160	chrome.exe
Token: SeShutdownPrivilege	4160	chrome.exe
Token: SeCreatePagefilePrivilege	4160	chrome.exe
Token: SeShutdownPrivilege	4160	chrome.exe
Token: SeCreatePagefilePrivilege	4160	chrome.exe
Token: SeShutdownPrivilege	4160	chrome.exe
Token: SeCreatePagefilePrivilege	4160	chrome.exe
Token: SeShutdownPrivilege	4160	chrome.exe
Token: SeCreatePagefilePrivilege	4160	chrome.exe
Token: SeShutdownPrivilege	4160	chrome.exe
Token: SeCreatePagefilePrivilege	4160	chrome.exe
Token: SeShutdownPrivilege	4160	chrome.exe
Token: SeCreatePagefilePrivilege	4160	chrome.exe
Token: SeShutdownPrivilege	4160	chrome.exe
Token: SeCreatePagefilePrivilege	4160	chrome.exe
Token: SeShutdownPrivilege	4160	chrome.exe
Token: SeCreatePagefilePrivilege	4160	chrome.exe
Token: SeShutdownPrivilege	4160	chrome.exe
Token: SeCreatePagefilePrivilege	4160	chrome.exe
Token: SeShutdownPrivilege	4160	chrome.exe
Token: SeCreatePagefilePrivilege	4160	chrome.exe
Token: SeShutdownPrivilege	4160	chrome.exe
Token: SeCreatePagefilePrivilege	4160	chrome.exe
Token: SeShutdownPrivilege	4160	chrome.exe
Token: SeCreatePagefilePrivilege	4160	chrome.exe
Token: SeShutdownPrivilege	4160	chrome.exe
Token: SeCreatePagefilePrivilege	4160	chrome.exe
Token: SeShutdownPrivilege	4160	chrome.exe
Token: SeCreatePagefilePrivilege	4160	chrome.exe
Token: SeShutdownPrivilege	4160	chrome.exe
Token: SeCreatePagefilePrivilege	4160	chrome.exe
Token: SeShutdownPrivilege	4160	chrome.exe
Token: SeCreatePagefilePrivilege	4160	chrome.exe
Token: SeShutdownPrivilege	4160	chrome.exe
Token: SeCreatePagefilePrivilege	4160	chrome.exe
Token: SeShutdownPrivilege	4160	chrome.exe
Token: SeCreatePagefilePrivilege	4160	chrome.exe
Token: SeShutdownPrivilege	4160	chrome.exe
Token: SeCreatePagefilePrivilege	4160	chrome.exe
Token: SeShutdownPrivilege	4160	chrome.exe
Token: SeCreatePagefilePrivilege	4160	chrome.exe
Token: SeShutdownPrivilege	4160	chrome.exe
Token: SeCreatePagefilePrivilege	4160	chrome.exe
Token: SeShutdownPrivilege	4160	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3800	firefox.exe
3800	firefox.exe
3800	firefox.exe
3800	firefox.exe
5364	firefox.exe
5364	firefox.exe
5364	firefox.exe
5364	firefox.exe
5364	firefox.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
3488	7zG.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe

Suspicious use of SendNotifyMessage 63 IoCs

pid	Process
3800	firefox.exe
3800	firefox.exe
3800	firefox.exe
5364	firefox.exe
5364	firefox.exe
5364	firefox.exe
5364	firefox.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe
4160	chrome.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3800	firefox.exe
3800	firefox.exe
3800	firefox.exe
3800	firefox.exe
3800	firefox.exe
3800	firefox.exe
3800	firefox.exe
3800	firefox.exe
3800	firefox.exe
3800	firefox.exe
3800	firefox.exe
3800	firefox.exe
3800	firefox.exe
3004	winrar-x64-701.exe
3004	winrar-x64-701.exe
3004	winrar-x64-701.exe
5364	firefox.exe
5364	firefox.exe
5364	firefox.exe
5364	firefox.exe
496	winrar-x64-701.exe
496	winrar-x64-701.exe
496	winrar-x64-701.exe
1408	OpenWith.exe
1408	OpenWith.exe
1408	OpenWith.exe
1408	OpenWith.exe
1408	OpenWith.exe
1408	OpenWith.exe
1408	OpenWith.exe
1408	OpenWith.exe
1408	OpenWith.exe
1408	OpenWith.exe
1408	OpenWith.exe
1408	OpenWith.exe
1408	OpenWith.exe
1408	OpenWith.exe
1408	OpenWith.exe
1408	OpenWith.exe
1408	OpenWith.exe
1408	OpenWith.exe
1408	OpenWith.exe
1408	OpenWith.exe
1408	OpenWith.exe
1408	OpenWith.exe
1408	OpenWith.exe
1408	OpenWith.exe
1408	OpenWith.exe
1408	OpenWith.exe
1408	OpenWith.exe
1408	OpenWith.exe
1408	OpenWith.exe
1408	OpenWith.exe
1408	OpenWith.exe
1408	OpenWith.exe
1408	OpenWith.exe
1408	OpenWith.exe
1408	OpenWith.exe
1408	OpenWith.exe
1408	OpenWith.exe
1408	OpenWith.exe
1408	OpenWith.exe
1408	OpenWith.exe
1408	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 3800	2216	firefox.exe	76
PID 2216 wrote to memory of 3800	2216	firefox.exe	76
PID 2216 wrote to memory of 3800	2216	firefox.exe	76
PID 2216 wrote to memory of 3800	2216	firefox.exe	76
PID 2216 wrote to memory of 3800	2216	firefox.exe	76
PID 2216 wrote to memory of 3800	2216	firefox.exe	76
PID 2216 wrote to memory of 3800	2216	firefox.exe	76
PID 2216 wrote to memory of 3800	2216	firefox.exe	76
PID 2216 wrote to memory of 3800	2216	firefox.exe	76
PID 2216 wrote to memory of 3800	2216	firefox.exe	76
PID 2216 wrote to memory of 3800	2216	firefox.exe	76
PID 3800 wrote to memory of 3808	3800	firefox.exe	77
PID 3800 wrote to memory of 3808	3800	firefox.exe	77
PID 3800 wrote to memory of 908	3800	firefox.exe	78
PID 3800 wrote to memory of 908	3800	firefox.exe	78
PID 3800 wrote to memory of 908	3800	firefox.exe	78
PID 3800 wrote to memory of 908	3800	firefox.exe	78
PID 3800 wrote to memory of 908	3800	firefox.exe	78
PID 3800 wrote to memory of 908	3800	firefox.exe	78
PID 3800 wrote to memory of 908	3800	firefox.exe	78
PID 3800 wrote to memory of 908	3800	firefox.exe	78
PID 3800 wrote to memory of 908	3800	firefox.exe	78
PID 3800 wrote to memory of 908	3800	firefox.exe	78
PID 3800 wrote to memory of 908	3800	firefox.exe	78
PID 3800 wrote to memory of 908	3800	firefox.exe	78
PID 3800 wrote to memory of 908	3800	firefox.exe	78
PID 3800 wrote to memory of 908	3800	firefox.exe	78
PID 3800 wrote to memory of 908	3800	firefox.exe	78
PID 3800 wrote to memory of 908	3800	firefox.exe	78
PID 3800 wrote to memory of 908	3800	firefox.exe	78
PID 3800 wrote to memory of 908	3800	firefox.exe	78
PID 3800 wrote to memory of 908	3800	firefox.exe	78
PID 3800 wrote to memory of 908	3800	firefox.exe	78
PID 3800 wrote to memory of 908	3800	firefox.exe	78
PID 3800 wrote to memory of 908	3800	firefox.exe	78
PID 3800 wrote to memory of 908	3800	firefox.exe	78
PID 3800 wrote to memory of 908	3800	firefox.exe	78
PID 3800 wrote to memory of 908	3800	firefox.exe	78
PID 3800 wrote to memory of 908	3800	firefox.exe	78
PID 3800 wrote to memory of 908	3800	firefox.exe	78
PID 3800 wrote to memory of 908	3800	firefox.exe	78
PID 3800 wrote to memory of 908	3800	firefox.exe	78
PID 3800 wrote to memory of 908	3800	firefox.exe	78
PID 3800 wrote to memory of 908	3800	firefox.exe	78
PID 3800 wrote to memory of 908	3800	firefox.exe	78
PID 3800 wrote to memory of 908	3800	firefox.exe	78
PID 3800 wrote to memory of 908	3800	firefox.exe	78
PID 3800 wrote to memory of 908	3800	firefox.exe	78
PID 3800 wrote to memory of 908	3800	firefox.exe	78
PID 3800 wrote to memory of 908	3800	firefox.exe	78
PID 3800 wrote to memory of 908	3800	firefox.exe	78
PID 3800 wrote to memory of 908	3800	firefox.exe	78
PID 3800 wrote to memory of 908	3800	firefox.exe	78
PID 3800 wrote to memory of 908	3800	firefox.exe	78
PID 3800 wrote to memory of 908	3800	firefox.exe	78
PID 3800 wrote to memory of 908	3800	firefox.exe	78
PID 3800 wrote to memory of 908	3800	firefox.exe	78
PID 3800 wrote to memory of 908	3800	firefox.exe	78
PID 3800 wrote to memory of 908	3800	firefox.exe	78
PID 3800 wrote to memory of 908	3800	firefox.exe	78
PID 3800 wrote to memory of 908	3800	firefox.exe	78
PID 3800 wrote to memory of 4204	3800	firefox.exe	79
PID 3800 wrote to memory of 4204	3800	firefox.exe	79
PID 3800 wrote to memory of 4204	3800	firefox.exe	79

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\belge1.png
1⤵
PID:3328

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3800
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3800.0.368055842\42479954" -parentBuildID 20221007134813 -prefsHandle 1684 -prefMapHandle 1680 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {185f30e2-6ac1-4a4b-bf31-a9071df7e57f} 3800 "\\.\pipe\gecko-crash-server-pipe.3800" 1764 150ec4ce158 gpu
    3⤵
    PID:3808
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3800.1.1480604961\466766458" -parentBuildID 20221007134813 -prefsHandle 2108 -prefMapHandle 2104 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a50d3948-31a4-40b9-a16c-6a902db3e7c1} 3800 "\\.\pipe\gecko-crash-server-pipe.3800" 2120 150da172558 socket
    3⤵
    - Checks processor information in registry
    PID:908
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3800.2.1009809340\54768787" -childID 1 -isForBrowser -prefsHandle 2924 -prefMapHandle 3024 -prefsLen 20931 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {580a26f3-09ef-4fdd-86d8-c41f21d952e6} 3800 "\\.\pipe\gecko-crash-server-pipe.3800" 2920 150ec45de58 tab
    3⤵
    PID:4204
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3800.3.393383593\811180421" -childID 2 -isForBrowser -prefsHandle 3476 -prefMapHandle 3472 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e5c0b1fc-2f90-444d-b720-a3655e4d1b28} 3800 "\\.\pipe\gecko-crash-server-pipe.3800" 3488 150da162b58 tab
    3⤵
    PID:3700
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3800.4.1065111158\90953330" -childID 3 -isForBrowser -prefsHandle 4372 -prefMapHandle 4368 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7caee4bc-3f8b-46e4-8388-ade88b3bb028} 3800 "\\.\pipe\gecko-crash-server-pipe.3800" 4224 150f24b0e58 tab
    3⤵
    PID:4488
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3800.5.87305018\1628977110" -childID 4 -isForBrowser -prefsHandle 4896 -prefMapHandle 4892 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a3e8bbc1-8a4e-4c6e-91ce-91e501b02798} 3800 "\\.\pipe\gecko-crash-server-pipe.3800" 4904 150da163258 tab
    3⤵
    PID:3836
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3800.6.1952674501\452339778" -childID 5 -isForBrowser -prefsHandle 5040 -prefMapHandle 5044 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b0b2515f-dde6-4981-a200-03bd944e1ea4} 3800 "\\.\pipe\gecko-crash-server-pipe.3800" 5032 150f24b1758 tab
    3⤵
    PID:4976
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3800.7.1774016599\264998254" -childID 6 -isForBrowser -prefsHandle 5200 -prefMapHandle 5204 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {926e5e41-eb48-483a-b24c-4af96094dbcc} 3800 "\\.\pipe\gecko-crash-server-pipe.3800" 5192 150f2b34b58 tab
    3⤵
    PID:816
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3800.8.1279287843\962887568" -childID 7 -isForBrowser -prefsHandle 5640 -prefMapHandle 5636 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ed287e80-e564-493e-91b2-63eb3d807087} 3800 "\\.\pipe\gecko-crash-server-pipe.3800" 5652 150f485ab58 tab
    3⤵
    PID:424
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3800.9.1699897160\1212559395" -childID 8 -isForBrowser -prefsHandle 5460 -prefMapHandle 5236 -prefsLen 26689 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {568a7fb3-0abc-4bff-afba-f27d59cb51b2} 3800 "\\.\pipe\gecko-crash-server-pipe.3800" 4916 150f46af758 tab
    3⤵
    PID:4192
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3800.10.295458084\1705143966" -childID 9 -isForBrowser -prefsHandle 6352 -prefMapHandle 6328 -prefsLen 26817 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f0c138df-4574-4e1b-a899-c76f8e372d57} 3800 "\\.\pipe\gecko-crash-server-pipe.3800" 6340 150f2a2d858 tab
    3⤵
    PID:2368
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3800.11.1913613130\653712711" -childID 10 -isForBrowser -prefsHandle 6520 -prefMapHandle 5980 -prefsLen 26817 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8cd97999-97d6-4431-bbc7-0d07d5c226e4} 3800 "\\.\pipe\gecko-crash-server-pipe.3800" 6516 150f485c958 tab
    3⤵
    PID:1916
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3800.12.2038865546\1914388854" -parentBuildID 20221007134813 -prefsHandle 6584 -prefMapHandle 6588 -prefsLen 26817 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ffbd55be-9dc5-42dc-a61f-f2a67487f889} 3800 "\\.\pipe\gecko-crash-server-pipe.3800" 6644 150f4cbff58 rdd
    3⤵
    PID:3500
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3800.13.221253821\1959143028" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 6804 -prefMapHandle 6800 -prefsLen 26817 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fe88940a-210f-4369-bd2d-93adc39c7770} 3800 "\\.\pipe\gecko-crash-server-pipe.3800" 5688 150f4b4a858 utility
    3⤵
    PID:592
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3800.14.2141915183\1722434078" -childID 11 -isForBrowser -prefsHandle 5792 -prefMapHandle 6884 -prefsLen 26817 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {088a3e9d-0cea-4884-8299-7ed67b164bd5} 3800 "\\.\pipe\gecko-crash-server-pipe.3800" 6804 150f6971d58 tab
    3⤵
    PID:2120
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3800.15.205219054\1616453306" -childID 12 -isForBrowser -prefsHandle 1548 -prefMapHandle 5612 -prefsLen 26817 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {215d023b-ebb4-4e1f-8304-c3e9a4d56bb6} 3800 "\\.\pipe\gecko-crash-server-pipe.3800" 6432 150f63c2c58 tab
    3⤵
    PID:4592
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3800.16.605962079\2124995283" -childID 13 -isForBrowser -prefsHandle 6344 -prefMapHandle 6348 -prefsLen 26817 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e8f02fe5-75e4-4afb-9381-54815f09866d} 3800 "\\.\pipe\gecko-crash-server-pipe.3800" 6540 150f63c2f58 tab
    3⤵
    PID:2868
- - C:\Users\Admin\Downloads\winrar-x64-701.exe
    "C:\Users\Admin\Downloads\winrar-x64-701.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3004
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3800.17.1687365009\686657112" -childID 14 -isForBrowser -prefsHandle 7472 -prefMapHandle 7476 -prefsLen 26873 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0d8a9487-dc48-4310-bdf9-b8ec17013c09} 3800 "\\.\pipe\gecko-crash-server-pipe.3800" 5924 150f6d4d758 tab
    3⤵
    PID:4928
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3800.18.484185366\1398377326" -childID 15 -isForBrowser -prefsHandle 11312 -prefMapHandle 11316 -prefsLen 26873 -prefMapSize 233444 -jsInitHandle 1328 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f8736740-db15-429e-a926-a9c8318b9de2} 3800 "\\.\pipe\gecko-crash-server-pipe.3800" 10900 150edef6e58 tab
    3⤵
    PID:2212

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\5adfe0f2181d4b77a4a1a2bf2f69aca1 /t 3272 /p 3004
1⤵
PID:6048

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:5328
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:5364
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5364.0.378080741\697073651" -parentBuildID 20221007134813 -prefsHandle 1604 -prefMapHandle 1596 -prefsLen 21145 -prefMapSize 233583 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9bc373f6-f1fa-4635-99a6-74146f379da3} 5364 "\\.\pipe\gecko-crash-server-pipe.5364" 1684 184260faa58 gpu
    3⤵
    PID:5244
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5364.1.1253818286\341164458" -parentBuildID 20221007134813 -prefsHandle 1992 -prefMapHandle 1988 -prefsLen 21190 -prefMapSize 233583 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9210c53f-73de-42ae-91e8-d1fdab8c8e11} 5364 "\\.\pipe\gecko-crash-server-pipe.5364" 2004 18425d32058 socket
    3⤵
    - Checks processor information in registry
    PID:5528
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5364.2.71158276\127607777" -childID 1 -isForBrowser -prefsHandle 2648 -prefMapHandle 2600 -prefsLen 21651 -prefMapSize 233583 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fdbd88e1-a04b-491a-9bb7-2590d3aeb60c} 5364 "\\.\pipe\gecko-crash-server-pipe.5364" 2736 18426159258 tab
    3⤵
    PID:5088
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5364.3.1180940493\1982016358" -childID 2 -isForBrowser -prefsHandle 3404 -prefMapHandle 3400 -prefsLen 26829 -prefMapSize 233583 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c76be092-96b5-400b-b6ad-69cef247c230} 5364 "\\.\pipe\gecko-crash-server-pipe.5364" 3416 1841b161f58 tab
    3⤵
    PID:2296
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5364.4.14516905\672950494" -childID 3 -isForBrowser -prefsHandle 3568 -prefMapHandle 3564 -prefsLen 26829 -prefMapSize 233583 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c4322332-ad49-4b20-99c9-c921a4767070} 5364 "\\.\pipe\gecko-crash-server-pipe.5364" 3580 1842ac99258 tab
    3⤵
    PID:1924
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5364.5.323349491\19164177" -childID 4 -isForBrowser -prefsHandle 4488 -prefMapHandle 4472 -prefsLen 26829 -prefMapSize 233583 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {76718b36-72f6-4756-a597-93a5e143c226} 5364 "\\.\pipe\gecko-crash-server-pipe.5364" 4496 1842a906258 tab
    3⤵
    PID:816
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5364.6.1006083065\543863683" -childID 5 -isForBrowser -prefsHandle 4632 -prefMapHandle 4636 -prefsLen 26829 -prefMapSize 233583 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {facdca6f-1923-4c43-9b02-a6cf710f606d} 5364 "\\.\pipe\gecko-crash-server-pipe.5364" 4624 1842c14c558 tab
    3⤵
    PID:3368
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5364.7.421133739\1232613382" -childID 6 -isForBrowser -prefsHandle 4820 -prefMapHandle 4824 -prefsLen 26829 -prefMapSize 233583 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {86ee4c64-fda9-4ddb-af92-1bf20115cd01} 5364 "\\.\pipe\gecko-crash-server-pipe.5364" 4812 1842c14c858 tab
    3⤵
    PID:32

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5848

C:\Users\Admin\Downloads\winrar-x64-701.exe
"C:\Users\Admin\Downloads\winrar-x64-701.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:496

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\92cab8884e7b4339b5f44597aac3ab2c /t 1384 /p 496
1⤵
PID:3832

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xd0,0xd4,0xd8,0xac,0xdc,0x7ffc7fee9758,0x7ffc7fee9768,0x7ffc7fee9778
  2⤵
  PID:4136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1620 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:2
  2⤵
  PID:1932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1928 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:8
  2⤵
  PID:6040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2064 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:8
  2⤵
  PID:5964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2940 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:1
  2⤵
  PID:2324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2952 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:1
  2⤵
  PID:5152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4440 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:1
  2⤵
  PID:3988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4460 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:8
  2⤵
  PID:868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4960 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:8
  2⤵
  PID:5676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4920 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:8
  2⤵
  PID:4700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5016 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:1
  2⤵
  PID:1848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2960 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:8
  2⤵
  PID:4180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3432 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:8
  2⤵
  PID:1564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=2468 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:1
  2⤵
  PID:5752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5072 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:8
  2⤵
  PID:1748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --instant-process --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=3084 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:1
  2⤵
  PID:2504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=3448 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:1
  2⤵
  PID:5240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=3040 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:1
  2⤵
  PID:5376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=5108 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:1
  2⤵
  PID:5164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3024 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:8
  2⤵
  PID:1460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:8
  2⤵
  PID:4068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3652 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=1740 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:1
  2⤵
  PID:2668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5408 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:8
  2⤵
  PID:2344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --instant-process --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=3184 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:1
  2⤵
  PID:5860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=5280 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:1
  2⤵
  PID:6120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=5404 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:1
  2⤵
  PID:1916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --mojo-platform-channel-handle=4508 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:1
  2⤵
  PID:5848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --mojo-platform-channel-handle=1008 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:1
  2⤵
  PID:3636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --mojo-platform-channel-handle=5576 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:1
  2⤵
  PID:380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --mojo-platform-channel-handle=5628 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:1
  2⤵
  PID:2932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --mojo-platform-channel-handle=4912 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:1
  2⤵
  PID:592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5436 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:8
  2⤵
  PID:4240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --mojo-platform-channel-handle=5036 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:1
  2⤵
  PID:5580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --mojo-platform-channel-handle=6216 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:1
  2⤵
  PID:5488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --mojo-platform-channel-handle=6388 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:1
  2⤵
  PID:1104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6108 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:8
  2⤵
  PID:3680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --mojo-platform-channel-handle=6520 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:1
  2⤵
  PID:1192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --mojo-platform-channel-handle=5252 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:1
  2⤵
  PID:4300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2676 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:8
  2⤵
  PID:5984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2664 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:8
  2⤵
  PID:1560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6012 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:8
  2⤵
  - NTFS ADS
  PID:5504
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Password-1703.txt
  2⤵
  PID:340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --instant-process --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --mojo-platform-channel-handle=4432 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:1
  2⤵
  PID:2092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --mojo-platform-channel-handle=5944 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:1
  2⤵
  PID:5188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --mojo-platform-channel-handle=3796 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --mojo-platform-channel-handle=1592 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:1
  2⤵
  PID:5416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5600 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:8
  2⤵
  PID:6004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6220 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:8
  2⤵
  PID:2504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --mojo-platform-channel-handle=6188 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:1
  2⤵
  PID:4316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --mojo-platform-channel-handle=4700 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:1
  2⤵
  PID:5168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --mojo-platform-channel-handle=4472 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:1
  2⤵
  PID:3572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --mojo-platform-channel-handle=4896 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:1
  2⤵
  PID:4684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --mojo-platform-channel-handle=6760 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --mojo-platform-channel-handle=6828 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:1
  2⤵
  PID:4056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --mojo-platform-channel-handle=5124 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:1
  2⤵
  PID:2644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --mojo-platform-channel-handle=6084 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:1
  2⤵
  PID:5832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --mojo-platform-channel-handle=4368 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:1
  2⤵
  PID:60
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --mojo-platform-channel-handle=7024 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:1
  2⤵
  PID:1728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --mojo-platform-channel-handle=3244 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:1
  2⤵
  PID:5556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --mojo-platform-channel-handle=4360 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:1
  2⤵
  PID:2932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --mojo-platform-channel-handle=5724 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:1
  2⤵
  PID:2820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --mojo-platform-channel-handle=6296 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:1
  2⤵
  PID:424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --mojo-platform-channel-handle=7036 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:1
  2⤵
  PID:32
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --mojo-platform-channel-handle=7608 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:1
  2⤵
  PID:5776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --mojo-platform-channel-handle=7788 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:1
  2⤵
  PID:1948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --mojo-platform-channel-handle=7264 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:1
  2⤵
  PID:3432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --mojo-platform-channel-handle=6796 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --mojo-platform-channel-handle=6716 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:1
  2⤵
  PID:2320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --mojo-platform-channel-handle=7584 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:1
  2⤵
  PID:1724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --mojo-platform-channel-handle=7588 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:1
  2⤵
  PID:5976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --mojo-platform-channel-handle=6184 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:1
  2⤵
  PID:5596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --mojo-platform-channel-handle=4608 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:1
  2⤵
  PID:2092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:8
  2⤵
  PID:2428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6584 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:8
  2⤵
  PID:3228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --instant-process --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --mojo-platform-channel-handle=6960 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:1
  2⤵
  PID:4940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --mojo-platform-channel-handle=2936 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:1
  2⤵
  PID:5148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --mojo-platform-channel-handle=5560 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:1
  2⤵
  PID:4744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --instant-process --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --mojo-platform-channel-handle=6688 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:1
  2⤵
  PID:5736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --mojo-platform-channel-handle=6376 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:1
  2⤵
  PID:5624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --mojo-platform-channel-handle=5352 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:1
  2⤵
  PID:5304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6388 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:8
  2⤵
  PID:3024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=908 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:8
  2⤵
  PID:5956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6052 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:8
  2⤵
  PID:4472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7564 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:8
  2⤵
  PID:508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6880 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:8
  2⤵
  PID:5136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7300 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:8
  2⤵
  PID:1588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6788 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:8
  2⤵
  PID:5868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7468 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:8
  2⤵
  PID:4052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4808 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:8
  2⤵
  PID:2240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6880 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:8
  2⤵
  PID:3604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7088 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:8
  2⤵
  PID:392
- C:\Users\Admin\Downloads\CrimsonRAT.exe
  "C:\Users\Admin\Downloads\CrimsonRAT.exe"
  2⤵
  - Executes dropped EXE
  PID:5788
- - C:\ProgramData\Hdlharas\dlrarhsiva.exe
    "C:\ProgramData\Hdlharas\dlrarhsiva.exe"
    3⤵
    - Executes dropped EXE
    PID:776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6956 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:8
  2⤵
  PID:3872
- C:\Users\Admin\Downloads\CrimsonRAT.exe
  "C:\Users\Admin\Downloads\CrimsonRAT.exe"
  2⤵
  - Executes dropped EXE
  PID:5272
- - C:\ProgramData\Hdlharas\dlrarhsiva.exe
    "C:\ProgramData\Hdlharas\dlrarhsiva.exe"
    3⤵
    - Executes dropped EXE
    PID:3556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5400 --field-trial-handle=1800,i,11546898702034199142,10867346488892529102,131072 /prefetch:8
  2⤵
  PID:2588

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1916

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3b4
1⤵
PID:4332

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1408

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\Aurora Roblox\" -spe -an -ai#7zMap27504:84:7zEvent22160
1⤵
- Suspicious use of FindShellTrayWindow
PID:3488

C:\Users\Admin\Desktop\Aurora Roblox\Launcher.exe
"C:\Users\Admin\Desktop\Aurora Roblox\Launcher.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1468
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5608
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5608 -s 1100
    3⤵
    - Program crash
    PID:2824

C:\Users\Admin\Desktop\Aurora Roblox\Launcher.exe
"C:\Users\Admin\Desktop\Aurora Roblox\Launcher.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4996
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3732
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3732 -s 1124
    3⤵
    - Program crash
    PID:5456
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3732 -s 1172
    3⤵
    - Program crash
    PID:5924

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Aurora Roblox\manual\Manual.txt
1⤵
PID:5284

C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\RAT\NJRat.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\RAT\NJRat.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3760
- C:\Windows\SysWOW64\netsh.exe
  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\RAT\NJRat.exe" "NJRat.exe" ENABLE
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Hdlharas\dlrarhsiva.exe

Filesize
9.1MB

MD5
64261d5f3b07671f15b7f10f2f78da3f

SHA1
d4f978177394024bb4d0e5b6b972a5f72f830181

SHA256
87f51b4632c5fbc351a59a234dfefef506d807f2c173aac23162b85d0d73c2ad

SHA512
3a9ff39e6bc7585b0b03f7327652e4c3b766563e8b183c25b6497e30956945add5684f1579862117e44c6bac2802601fc7c4d2a0daa1824f16c4da1fd6c9c91a

Download Submit
C:\ProgramData\Hdlharas\mdkhm.zip

Filesize
56KB

MD5
b635f6f767e485c7e17833411d567712

SHA1
5a9cbdca7794aae308c44edfa7a1ff5b155e4aa8

SHA256
6838286fb88e9e4e68882601a13fa770f1b510a0a86389b6a29070a129bf2e5e

SHA512
551ba05bd44e66685f359802b35a8c9775792a12844906b4b53e1a000d56624c6db323754331c9f399072790991c1b256d9114a50fb78111652a1c973d2880af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
acdad9483d3f27ed7e86c7f0116d8ad9

SHA1
dd2cfd176ad33d12ba7e6d260e1069b1dd4490c4

SHA256
bff5b4fff4b34ed3ea2754985b5ba1a8d6921517b0fa370f71f37ee0845552ba

SHA512
6e3ab4b6cfa73a7ad3c36fa621b1d2817b26e8e3613b78a40df6691d65e1486e6c2281efa0f8d3f30d2c6647b7ba3430a8be77df770f1cc575e8db76be6836a2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001

Filesize
209KB

MD5
3e552d017d45f8fd93b94cfc86f842f2

SHA1
dbeebe83854328e2575ff67259e3fb6704b17a47

SHA256
27d9c4613df7a3c04da0b79c13217aa69992b441acb7e44bf2a7578ca87d97d6

SHA512
e616436f2f15615429c7c5c37de3990c3e86c5e1da7d75a0f524fc458b75d44a5be1a3648a628d63e1cf8aa062e08b538f2f2bc9c6a0b42157beb24f82c571d9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000002

Filesize
24KB

MD5
c594a826934b9505d591d0f7a7df80b7

SHA1
c04b8637e686f71f3fc46a29a86346ba9b04ae18

SHA256
e664eef3d68ac6336a28be033165d4780e8a5ab28f0d90df1b148ef86babb610

SHA512
04a1dfdb8ee2f5fefa101d5e3ff36e87659fd774e96aa8c5941d3353ccc268a125822cf01533c74839e5f1c54725da9cc437d3d69b88e5bf3f99caccd4d75961

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000b

Filesize
225KB

MD5
1ada5262a97ab144ed5cce600bc29421

SHA1
0ae27223694d72107f2ed0c4775d26503e17fede

SHA256
f876b56e243722e137406dee2c3f1dc93d3cffc4b0c7a20b884d19e51c8713c8

SHA512
552472990da3498d6b2291a7c9242bbc0f4f21f84c6a0401ce948f9d438c154a5c6974a11657e4e7d70f647f2a451e4605417c4b009ef62e8a1b18cdd5503604

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000c

Filesize
127KB

MD5
e0317f610e7c8a162ae6be07782a08e0

SHA1
1a58b74034d443c32c1f03c63a0b13218a819ac4

SHA256
c8f959f4f2dfe51e52b70a76bfa4fb78b6b8e6b52c9eedd363472c4eab748f7c

SHA512
578b203ae9f52ae6742dc80a9482b932260dfa8a263471afd00000c296581dc378d1c2ae65ba40cf4c424aa74a680c187f437b9cb574577c30128376d862574f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000d

Filesize
64KB

MD5
2923c306256864061a11e426841fc44a

SHA1
d9bb657845d502acd69a15a66f9e667ce9b68351

SHA256
5bc3f12e012e1a39ac69afba923768b758089461ccea0b8391f682d91c0ed2fa

SHA512
f2614f699ac296ee1f81e32955c97d2c13177714dbd424e7f5f7de0d8869dd799d13c64929386ac9c942325456d26c4876a09341d17d7c9af4f80695d259cfea

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000e

Filesize
136KB

MD5
b915644ba39de248279bc486adc59938

SHA1
952dc61a47a3a191397991a5ab50debcb27646b6

SHA256
aba3e577e45ca02199a663149ca1d1311c63be56441c12a5eeb5e151dd3f59db

SHA512
c566e568c05396a159f5b675b3633d0c75f4e075dfcc62ba21d8da30c6fa9dda7e0d75a1d6ffac04bfb1cdce28e769dfb09e73679878dfd890bf54a8308582b7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000f

Filesize
88KB

MD5
77e89b1c954303a8aa65ae10e18c1b51

SHA1
e2b15a0d930dcc11f0b38c95b1e68d1ca8334d73

SHA256
069a7cc0309c5d6fc99259d5d5a8e41926996bbae11dc8631a7303a0c2d8c953

SHA512
5780d3532af970f3942eecf731a43f04b0d2bdb9c0f1a262dbd1c3980bcc82fe6d2126236ad33c48ea5434d376de2214d84a9a2ccec46a0671886fe0aa5e5597

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000011

Filesize
37KB

MD5
bdc8665f6c3eea3b3f20ad8fd827f7ab

SHA1
6c3cac84a971ba4af603e264f6fe1bc32ecef08c

SHA256
f700700574088d7f99bba253242cbde0299c5b264e3af9ced4285cd36f6833e1

SHA512
e6c853e98a436d2b31f550b73511dfd654978ae3d515cc467e16dba3fc278abf7308baea03fbbf9beef88379aacef8444922f671c1f564ca439454fd6b93c785

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000014

Filesize
64KB

MD5
d6b36c7d4b06f140f860ddc91a4c659c

SHA1
ccf16571637b8d3e4c9423688c5bd06167bfb9e9

SHA256
34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

SHA512
2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000015

Filesize
67KB

MD5
1d9097f6fd8365c7ed19f621246587eb

SHA1
937676f80fd908adc63adb3deb7d0bf4b64ad30e

SHA256
a9dc0d556e1592de2aeef8eed47d099481cfb7f37ea3bf1736df764704f39ddf

SHA512
251bf8a2baf71cde89873b26ee77fe89586daf2a2a913bd8383b1b4eca391fdd28aea6396de3fdff029c6d188bf9bb5f169954e5445da2933664e70acd79f4e3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000016

Filesize
41KB

MD5
ed3c7f5755bf251bd20441f4dc65f5bf

SHA1
3919a57831d103837e0cc158182ac10b903942c5

SHA256
55cbb893756192704a23a400bf8f874e29c0feee435f8831af9cbe975d0ef85d

SHA512
c79460ded439678b6ebf2def675cbc5f15068b9ea4b19263439c3cca4fa1083dc278149cde85f551cd2ffc2c77fd1dc193200c683fc1c3cdac254e533df84f06

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000017

Filesize
65KB

MD5
56d57bc655526551f217536f19195495

SHA1
28b430886d1220855a805d78dc5d6414aeee6995

SHA256
f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

SHA512
7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000019

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001a

Filesize
1.2MB

MD5
027a77a637cb439865b2008d68867e99

SHA1
ba448ff5be0d69dbe0889237693371f4f0a2425e

SHA256
6f0e8c5ae26abbae3efc6ca213cacaaebd19bf2c7ed88495289a8f40428803dd

SHA512
66f8fbdd68de925148228fe1368d78aa8efa5695a2b4f70ab21a0a4eb2e6e9f0f54ed57708bd9200c2bbe431b9d09e5ca08c3f29a4347aeb65b090790652b5c4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001b

Filesize
88KB

MD5
b38fbbd0b5c8e8b4452b33d6f85df7dc

SHA1
386ba241790252df01a6a028b3238de2f995a559

SHA256
b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd

SHA512
546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001c

Filesize
43KB

MD5
209af4da7e0c3b2a6471a968ba1fc992

SHA1
2240c2da3eba4f30b0c3ef2205ce7848ecff9e3f

SHA256
ecc145203f1c562cae7b733a807e9333c51d75726905a3af898154f3cefc9403

SHA512
09201e377e80a3d03616ff394d836c85712f39b65a3138924d62a1f3ede3eac192f1345761c012b0045393c501d48b5a774aeda7ab5d687e1d7971440dc1fc35

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001d

Filesize
73KB

MD5
cf604c923aae437f0acb62820b25d0fd

SHA1
84db753fe8494a397246ccd18b3bb47a6830bc98

SHA256
e2b4325bb9a706cbfba8f39cca5bde9dae935cbb1d6c8a562c62e740f2208ab4

SHA512
754219b05f2d81d11f0b54e5c7dd687bd82aa59a357a3074bca60fefd3a88102577db8ae60a11eb25cc9538af1da39d25fa6f38997bdc8184924d0c5920e89c8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001f

Filesize
27KB

MD5
903acff81aec95fb624ad47960f14af1

SHA1
de8d7f3ae08621987d76e176118e1da6a7c2475f

SHA256
05d439f7aa4807ebfe90919429e6c6d352ea3816ce6a9592f4df42c2b22871d8

SHA512
c25bcf91200f1ddd174f17f2f95e3292cc8702884c3c0d79803a55effbddf66f43b7c243644c12e788cc1367d2f335ca67e07ec0053b066820719301693db767

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000021

Filesize
37KB

MD5
6e13703b4b9b3fee9c9679caa6444f08

SHA1
eebd698908234ddf27a333105f645667e2eb7bf4

SHA256
e9c1c07f5fb1e96dc3bad0cbdaeb5503e38382e8e9c838120bb2652940d6baa6

SHA512
873bc00f546d9811befa014c4dd9ccaea032caa559c72674429ace2c1abfd292e2556de69e2db1bcf0641625bdefcf28955905a1d5b65c620fece0df82827179

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000022

Filesize
21KB

MD5
017975d305729c957b42440bb7cec4be

SHA1
4ecd64ae942d7994b18210b09e72b9a12c6ad7e3

SHA256
6c9f3f5cc1dfabd4377baced6215ed916ebeca530d76f5afebc7b18f3a6a8668

SHA512
216fb759fd6b7c18e738bf2eda55d316713d54a61fe7c925ef7d1dd82381d214a37bee7f3fdc9ca65c74585decf1a23441eddd6278decc9f4a178ae5252473ee

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000023

Filesize
37KB

MD5
14c460a1feda08e672355847ea03d569

SHA1
f1e46ac6abd71ebbcdd798455483c560a1980091

SHA256
d1161f067875a5f686c1732a442f340142c6a03244f4dd0bc0f967596f6cbe3f

SHA512
cfd6e743986ae5074e73264ee1f311fc00a987bdabeeafbf55f5dd6ef0794ccc393507be9dc7e38181f2f10897c300edc297976acd3fb72da2bf560ec260af91

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002b

Filesize
22KB

MD5
9ec8ba204f6c45d71c998a0ce1dd714e

SHA1
e6790bc2fc03148c9d9cc1b3a91f4c5df3d8295c

SHA256
a4daad6848500cbb261729ecded45a13e2f102d666cff8a0e2bf5991ea5e5c9a

SHA512
d30fe0c1f7589354e7b228a5ca4e522e198c6e7ed30186c54025e991c7dc9a324e1cfd243ed2009aed863c01c3b341ec88bd74aca019e13ad52f8dc2ff3c6ba8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002e

Filesize
44KB

MD5
fea7e79673ab519b96588916e3f093a3

SHA1
a612e85cf1462d054546da1c4e15928d456153a7

SHA256
c833eec30b31a259378ae60b3a5308cd48a72fde973e4203648c93a1d1163360

SHA512
89d743bfd433d782f84b029750da8e02ae5d7f943b00b304db3bf156714dce8fc1a6a517128cf24cf0a4e5035866af235259c1bf20c3fe6005230e285a2acd67

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002f

Filesize
117KB

MD5
f5101c46b5f7fffea8baa46b434ffb60

SHA1
f8bacb1b58f3b39b113abd2f587c16c11a8f7382

SHA256
1ab53643d5f518d399500ab1be646fc9ee961eda051399b199dec0e2be192e22

SHA512
23f4d1634b50a9667aa375e276e81b2ab506f855dbb2ceb82f623a5aba037a480e31011937ad08e8036fccf6110fdf1b6a48eeea440872f325a528fdffa1b1ef

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000030

Filesize
93KB

MD5
88130bdbbc8e5bb9af4340e8833f9724

SHA1
528032dc3d6f9e6eacb76404101a5a166552e076

SHA256
1fa7a84d76bc64d56ca5028f41eab7c384439ab149370e3cdf4cfd8a147b5a81

SHA512
ee5809c04d21e29d291d805d4be6664d418a0e4f2e5c316f288a3cc3668b305798fd2070233811f7de2fc869f9279a0c6f95bb4ca1e665b4b822a023145e2d5e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000031

Filesize
383KB

MD5
78156c0d00aa00c40912bef22a7fb2c6

SHA1
9826e171dbe859f2036a75b4be1ad47075111048

SHA256
116b0fc4f0ac6e109ae00030feae3363f17ea87ab0ff6169c936e1e92e231e2d

SHA512
47c5df6ad972697e4d7db80baf94920da32f9263fb8627e1cc29834047dc617c80ca52c07535885f8e6c9c5305f95da27120fcb8ab10ca04a060d2368fef923f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000033

Filesize
16KB

MD5
8687e9b01cb6bcc97fb1f6722cf523f4

SHA1
353caeb23a92ff9fe47e7afb8dbde3c8e91b30b8

SHA256
6abf5e739a42709f18134431357d2e13a0c4197d6110d606145480d64ea39922

SHA512
111aef1f506ea612f544ab7c043989ae42872c11cbd75ce68f0494f5a7c586a7256492ce4cacf9c113ed32d76064b64b0648c21280dfd4e60e40acfb82155007

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000034

Filesize
17KB

MD5
b61272774bbae8cf83f43f561be508ad

SHA1
8c7659cf8119447838b17cd02d92c6cfd100d79d

SHA256
0e73b220c72e4719f5a029f9d711c2a5506387d6e422b4d7679cf87b4269074b

SHA512
62a2d14e2bc6bdd946bd5b65a31ab87f850a5b397bc4d82e7233eef4f3a762e3661cd394d34df564159ab04aa73b6ffc475ebb10325fa702a3daafc001fa73fd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000036

Filesize
25KB

MD5
9effe45fa3ec424096f76da8c7052388

SHA1
0672651039a60ed7909ff12c19626908ea9f5b9b

SHA256
79d99979dfbf442a01fe433ea8ba5099ad52fb6554762e65811eb1c943875e76

SHA512
d3c53b65c5974f574484bdec356d79662675f5442ec1cc35b19ae702c5b3aef20b3b255df067540d8ff27c12fa6f646e8d6115e657139fe9e2d1205d8b8ce204

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000037

Filesize
26KB

MD5
30e57909ac318a0b493e30d12710516e

SHA1
f04d404feac9b09ad0387b3f0bf5a7be01b80d4b

SHA256
deb09a9333e63cd55758777c3fc2d7e1d6bd94f97950b12e02593867f6b4210b

SHA512
bdd663362827c5fe13ae165c5fa166438dfa98fbe18e6e6589903e80f3e9dfcc46e2a39ca6918c3181ca2af253373e2f6dda44c10c1352e5f10443e2dc1d18c6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000038

Filesize
18KB

MD5
2f884e80ae10e547d932e3290b16ad7d

SHA1
f2178a9daf0f60e576c01418d29df755b8e4830e

SHA256
ff8e4c333508035df51acf8fa52d9d525012300a35c1c869bc3a82ac90847de9

SHA512
979455e6bfc7f295cb65d71ea3cff2c6cb4d20b1b6e90b25415c895e990bb32ce657ca9fcca551cfa5827a15503cbc13860f2dfaa7b3e165720938049ffec9b2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000039

Filesize
19KB

MD5
c837d050d16e65f7496466ecf3ecb969

SHA1
6427a86592e98498c9be94cb3f3f7ae469be6e52

SHA256
416d4f29f8ea9b28ba144250f45389960e67849272e3539a620f47527280c7ec

SHA512
c40b7ff9f420dc018fc887b0b80527b4c2a7a8d1f1693017c00c48c4d5215026cb5e9b65085151cb35e93dc07f005d03f5f458283da29a1d5ea9dc791280c0fc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00003a

Filesize
34KB

MD5
bcc66ae7ad33651ab09ffc5a35f910c9

SHA1
45dccc0e2a6c0c3367d809e4fe5f02208d1dc6b1

SHA256
65a9c296de193e98f2b270a53d709f8ad14bcb0f4508f401fa59f247c84a7615

SHA512
aa4a25b42e6eac89685b92124a10ccd662ac37adcd2900f6223282c6861493b211695464fb82df221928976270147b44e9ab12433f82108bef7d1f6727b5c25b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00003b

Filesize
43KB

MD5
14c0ed7ac1b19533bdc4275e1692b14d

SHA1
5f03f237901463ee7901de144ed4835441723d06

SHA256
b150aadef97427ad4f7710b08d5b5b0102eff645edcd8a97d302b8a926b140f2

SHA512
9fae0def3c97949f9305e79529bdc1e1593113ff5293efcf6727d67b3e74c6e4bf9cc76657501358f60f76fc1a197c9f1cfd41ee567487573d192f626f00f731

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00003c

Filesize
19KB

MD5
34e4b72c40e4786c494f7baee6f586c2

SHA1
390d0aad0e3b2954d8322e08307bd60af8ab9f2d

SHA256
76b360962b6fdda5a1e2ae41719eeb28669baca2b601e43a7a10f704238a24ad

SHA512
32932984511b8591fc16fbbeab219602f729e49f276e267221fc942f22d7d5f9928ba9044d73efed58c8625eb2ff9d6c48c160be9d61dec254e072da5b2bfd30

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00003d

Filesize
50KB

MD5
94baaf640dfde2ef520c0a55543cb346

SHA1
b05bf27684a4eec404263ace43f6c5b5fb2a07e9

SHA256
f4152f9aaf3c82595d3fe085f42afb79240e28dfff11dd2995264d554b039a94

SHA512
eeecc9480df0c1db15d7270f9e572ad2885f44caae6d3dea6ee8aa9b99a6f0c61d5b1f50673ff372f7b08d98e170cb8f3c0386bd06f6906cdf2cbd017811f0af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000043

Filesize
25KB

MD5
09b4090c3807ed8886f1fa82583b5ac4

SHA1
ebd912dcdfb7f396febd307d5b88a9f5daed463b

SHA256
5483161847156e2333b11a49d3b2b4aad4bd101655f074f0875d3a86ce2bb358

SHA512
83cef58eddaa5b8f5ac62286e1cbd74d4cbb5a25eb3c92accddef8ba2b77922cbc3e22b140353052f6d8d6a3118d168ac9514de1dbb57d2f0882892a57418911

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000052

Filesize
30KB

MD5
ad3dbab3e2249b49bd9c9770b14faaa3

SHA1
b33cd04c8c9f55a124125a8de181212233dba48e

SHA256
b5bb2899d5cc0390cf3ceb93d41bb0995fffcb22e58f745df8857b01ab0fcc24

SHA512
b6a635333cc13269d3be506f95d35afb01b6292f7108edbb5482af233ddff98626f14563b46732fa08bea15eb384dad742e20cabe0903d36f805f9a2f9d478b4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00005e

Filesize
63KB

MD5
5d0e354e98734f75eee79829eb7b9039

SHA1
86ffc126d8b7473568a4bb04d49021959a892b3a

SHA256
1cf8ae1c13406a2b4fc81dae6e30f6ea6a8a72566222d2ffe9e85b7e3676b97e

SHA512
4475f576a2cdaac1ebdec9e0a94f3098e2bc84b9a2a1da004c67e73597dd61acfbb88c94d0d39a655732c77565b7cc06880c78a97307cb3aac5abf16dd14ec79

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00005f

Filesize
69KB

MD5
d91bac1b60b58c54f87f1d1b7b16d445

SHA1
9ed78d3cf7553e3180bcbcd2ea9779e1e1a141e1

SHA256
4dd5f57067798bd3132643930620ccde1e4140289d52fcbc4fcf7b252876fe8f

SHA512
eb474a57cce34e17d00972b927846f087c55a76f5fc1fdbea0e43111f9d9a5af848862984431402a6a043e5a1a96815be84e114fc03c0372a03285fcf0c2623c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000060

Filesize
43KB

MD5
5ba77a4d6647a96613ac2b5f989d9d41

SHA1
0307028d3862ab2affee2e1429a0b259c7661beb

SHA256
68f74a3aadda9b79a48214612b47a9504d6da9fb820cb5bf5c95b4379c3d626f

SHA512
5b763115e9bc115897096d36a2e40d2f440962afe919793cb01a5444f7d9352ae0c3cea9e6fd1547de7f722d646ab1d8c74d0f6ce5576f2785a169cfffeecf93

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000061

Filesize
47KB

MD5
1b41de287931f25dcfdb32b449b62dce

SHA1
e457bbc7784ceacbb11cfa3ff65571de5c0ff227

SHA256
c1fe59b2b1995ef9709e1dcc147a96774f04c95374ca1c4df0c41e1cfbaeb8e0

SHA512
4d1de63bd0e1d61375a72252f41be91a61d766b3b204a0e72bf6530195a3f26d89c8aecd75e175281287b3b3b56a71f964ced207a0037641ba8c893d2ef75c78

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000063

Filesize
747KB

MD5
b81ace3b4244eb24aa6f719dcb7fba9f

SHA1
32d47f92d659ca2d8cb6676f1e49e8eb60ce5607

SHA256
d0b39a681e75b724c42d10cc205349f04adc2dbea71c41e2825bb7cbf62ca539

SHA512
f5f997d82c37195e7f5256133f8d00b3532cb91b7be850d702ba2f40f76a7b7e36671b73ab1ed9fc0f5fe97055a15008ffbbc61c34ebb0d84f0e44e632b0f366

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000067

Filesize
22KB

MD5
778ca3ed38e51e5d4967cd21efbdd007

SHA1
06e62821512a5b73931e237e35501f7722f0dbf4

SHA256
b7e1bfadb8d9c061f17a7234df012df7842ab1aa8fb6f9579fa3f0a3b4a75bc0

SHA512
5f6f02099ca8079305fb7e7f43ae4344d522271fe30379c0854d6a81b7d8adf408a50a4b799b5f52e6ed162ba6ce7fe97e24a2b9719df780e75683d3aa103d09

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000068

Filesize
229KB

MD5
57c541221efeb823a27c684f30a80469

SHA1
e957951d9c55c4d94f40f6bd9cd392b4f8c11688

SHA256
eb469eb2741dcddefd9bf7e33fa3027a4d1a25f8ecbc267eee7f40667f526ce0

SHA512
e4fb117cb65026cbd7a5567d018f3dedaca06dc47321b2d91ce7359fc0e0e9704de9b59a4a2caac491ff1680ed88fe4431960af5b01c0f395fbb1900101ccc5f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000069

Filesize
1.5MB

MD5
94904081dace40fa25a27ae973600381

SHA1
362dfda7b87e69ef5c6639a5b902babd5d6e4827

SHA256
6e83c832ac581072e02579cc330f6c34d8708264aac8247923bc87f404003e55

SHA512
b0f3c2e92722a8080aa073896a4e544ae22808dfc7e1c27bdb8359c29dfd1099bc3a733721029ef98a088614b586a8b276d0cd34bde8a968668bb512567d0be4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00006a

Filesize
92KB

MD5
8813ad599316ac04c0f610839a98feb1

SHA1
a6b2b9e9cd4f93cd4cf6714172dbfa1fc3cf76d9

SHA256
b86b95e2dcf381c34b0a14744776ed258b99f32b9839c7bbee93c3e6eb3a2dd2

SHA512
8dd5e4f84b34ff5874d5790267d373a3bcc7fbf2199ca19f3268e12441ea31393d8dc27d8824e2bbdec38f6197030134903adcd0260beac0f9440e2944c70ad2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00006b

Filesize
18KB

MD5
8eff0b8045fd1959e117f85654ae7770

SHA1
227fee13ceb7c410b5c0bb8000258b6643cb6255

SHA256
89978e658e840b927dddb5cb3a835c7d8526ece79933bd9f3096b301fe1a8571

SHA512
2e4fb65caab06f02e341e9ba4fb217d682338881daba3518a0df8df724e0496e1af613db8e2f65b42b9e82703ba58916b5f5abb68c807c78a88577030a6c2058

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00006c

Filesize
18KB

MD5
c83e4437a53d7f849f9d32df3d6b68f3

SHA1
fabea5ad92ed3e2431659b02e7624df30d0c6bbc

SHA256
d9bada3a44bb2ffa66dec5cc781cafc9ef17ed876cd9b0c5f7ef18228b63cebb

SHA512
c2ca1630f7229dd2dec37e0722f769dd94fd115eefa8eeba40f9bb09e4fdab7cc7d15f3deea23f50911feae22bae96341a5baca20b59c7982caf7a91a51e152f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00006d

Filesize
18KB

MD5
115c2d84727b41da5e9b4394887a8c40

SHA1
44f495a7f32620e51acca2e78f7e0615cb305781

SHA256
ae0e442895406e9922237108496c2cd60f4947649a826463e2da9860b5c25dd6

SHA512
00402945111722b041f317b082b7103bcc470c2112d86847eac44674053fc0642c5df72015dcb57c65c4ffabb7b03ece7e5f889190f09a45cef1f3e35f830f45

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00006e

Filesize
31KB

MD5
2d0cbcd956062756b83ea9217d94f686

SHA1
aedc241a33897a78f90830ee9293a7c0fd274e0e

SHA256
4670bfac0aeaec7193ce6e3f3de25773077a438da5f7098844bf91f8184c65b2

SHA512
92edce017aaf90e51811d8d3522cc278110e35fed457ea982a3d3e560a42970d6692a1a8963d11f3ba90253a1a0e222d8818b984e3ff31f46d0cdd6e0d013124

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00006f

Filesize
20KB

MD5
644f2b0ee81b56ac7303031ab3ca10e4

SHA1
7ca67423f0ded5ff534f0a0d42df416b44d36805

SHA256
dda33f363084c0f939d6daf5e648ede370fe5be24bd408a6ea0e6bfa1042e6cc

SHA512
461b910c1c3d43d5e62ca18d8a2ec7c9a3db196d649c08ca56d92a8a5e39a991fa5dc53ee20572ecb93b3315b0ba2e2a0ba9f5644c61b2d2c81ef74c05abc39d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000072

Filesize
32KB

MD5
610293cf4ea82a578cd1887889626ad0

SHA1
8f505a4584e51bac66f9b6a623a1675e5cc10cd9

SHA256
66753c185ee3c839fa84adad3e2809f4419fa87be1a4910d05997ff33a783324

SHA512
80103e0a65015af0f79c7c37f63fa9ad7bd0290cb7d1f2324ce17811b3a125af27f02958fa4d55590f4f8d29e444245066127dcdf201c9f522e00b79f82e2e33

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000073

Filesize
32KB

MD5
9d01eb0a17ab073b23578fa43d8cb8ff

SHA1
9494cff21da72d4c633827d4316b5b3295e837f0

SHA256
c262b68986387896023519db8825e3ed1e080d5307b72474bac05ec98185c530

SHA512
6c78a5cc939506d590dd63dd2a630e92ce68de84e4055e093bbd3a2f233243da12e315f5ca2d221948e39d5fbc951b1e958da851d31b41b9a86d29a133e3b3b0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000077

Filesize
34KB

MD5
367d6749aabc56bcfd8fe6f68e8ec07f

SHA1
94603bfd837a6cc48b0b413d97e6c21294139f01

SHA256
aba7125a597cbea4846b275de47b9e35fb42202d217c321ad861b09d3b831b5b

SHA512
737b43474c49d945fcc767a082ae79734333de55374c35825993539376577af76175a966e633b8224b4ede6a42738f3298e5c42d7a307f37897857c7c65842c7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00007a

Filesize
53KB

MD5
d135c6833e95bea967be35a97ba08c53

SHA1
1e0cfc0897a4a81cee66573c978f976edfa62f4e

SHA256
503ee91ffe5ccf03095587f1e46855752f5308e450aab6b8a3961f337e0fa923

SHA512
1716908c50405b64989e000016286d7ce64f2cf521df82a4ba9b338e41f0401710c5bdbc69686a98082cd291c01893f8f560b3f18e17fc996ddd6d50e74a86e8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00007e

Filesize
96KB

MD5
c136cf09e38a88be8d77c95009a30aa0

SHA1
bd9ba8ab0f06d8ac240d185d77b10ebd0f96293f

SHA256
1d6861da8ca850e440eb67ca7acb6b4a9b530f5cf292c6b902164e12c74e9cf5

SHA512
9f5790bed66eb64ceef657e9e47dad4277b964e259a8d83333a1cfaa088e3fda528182bb8f4b80fabf18a062d017b5fb82ebbee3fb0b7411ce7d703992f43e3d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000080

Filesize
19KB

MD5
5c00528ed171768547d436a39f21badf

SHA1
8e90a6203627667fdaeacf10d9d3a2d0b248e67e

SHA256
57f6644538805197e6c54669bee2f4d330d4270b59e2dd49ebcbe3d399cc17eb

SHA512
b085e750a1b794e47dd241f968f348538be1c5bc7eac0780f7a247aa7bafb9768648b08cd3f9f2743a4efd983c2af39784d8977076f4c73da716b071632b323d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000083

Filesize
120KB

MD5
3c25bc86104a40a18d4df4bd42cc58dc

SHA1
ee675c9326ee4f580cf2e7a4b77b00c50f811c12

SHA256
7c19ae3e6c01dab2b693fd887d8fefba3c34f1089c36b439b1f91651a424e5a6

SHA512
f5e215bd55553922469f79920762bab031015cc5ee6acb85c4298d44edf1517e6e122affdf79e92d2a7231d770caa456e548337f5f3b9eeb6d2c31103a4f7c34

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000087

Filesize
132KB

MD5
d24efea0156ca053cc2491ac58850dbc

SHA1
755fca5fabba9a97f025a612bfb43849d7b10e13

SHA256
92cd95263e34da80c46ecaf0768e5561ced552727fff3a822c954297115955ba

SHA512
f36b0d956c352140630fc7bffe2ff6a4cbf21e18489c9194242f2727a219c65a4c1bd4c92cec6fa9ca9408edc79d2fb3b9dc4e38d5b3119d7b4082c4abf5497d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00008b

Filesize
45KB

MD5
c2cbb38ef5d99970f0f57a980c56c52d

SHA1
96cff3fd944c87a9abfd54fa36c43a6d48dac9cc

SHA256
85369a1cf6e7ff57fe2587323c440ed24488b5ed26d82ba0cd52c86c42eec4a7

SHA512
50371320c29f0a682b9ae3703ef16c08f5c036e84d5056e658f5d9be7607e852adf72c13bf2d0b63fc492f5c26d330bdeb2ba38bfd8b0d4567f0cc6b0c0f7bd9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000093

Filesize
70KB

MD5
caa1776137345f63e36a8ec89651ab50

SHA1
92f25169a759bcce3fe550b02d9c3c6c21087e7b

SHA256
011413ff724f3a10abbbea2963ea69261297bc9a224d5070739e62a27e1c0ba7

SHA512
6c7e55ad6e2477a5a8a6603869f7ae21f81d43e091f5716871ba1a09c2a82792b5e595975d70af2da1b4a06693ddcfd40bd6ff9be821e32ba14835d92c5b391b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000094

Filesize
82KB

MD5
b8a7fb5450dab094a2a2655823990076

SHA1
c250579487a7d3d2a4d0dcfe47441123472e5482

SHA256
983b1e2f49e616d504560937a13d99fe51da4325e6385e86ef66eab8e61186ce

SHA512
57a89ce0e4d5123c11988efcb36459230cd66e273262d0865d76fae209efafefc672184ebb8538cb19392c82505061ff2c32c1aaae42086529668c6e76792598

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000095

Filesize
21KB

MD5
660c3b546f2a131de50b69b91f26c636

SHA1
70f80e7f10e1dd9180efe191ce92d28296ec9035

SHA256
fd91362b7111a0dcc85ef6bd9bc776881c7428f8631d5a32725711dce678bff9

SHA512
6be1e881fbb4a112440883aecb232c1afc28d0f247276ef3285b17b925ea0a5d3bac8eac6db906fc6ac64a4192dd740f5743ba62ba36d8204ff3e8669b123db2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000096

Filesize
20KB

MD5
87e8230a9ca3f0c5ccfa56f70276e2f2

SHA1
eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7

SHA256
e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9

SHA512
37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000097

Filesize
107KB

MD5
bf186e0fa9f4b0881b2060874089f283

SHA1
7827594773665fdb1a732a0ca878b4c704b12e76

SHA256
2628db062186f2dd305be2fb060cb6a3c76267a9df30c09c463cb032d26a9f7e

SHA512
aca83bbf8adc448581aa4c134243459554f7207c763bb2a34288c5fe1b80205eb76ccfefb63b3516553f043d30faa7047f1cb5dec7aca491bd1e159ce4e35431

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00009a

Filesize
71KB

MD5
15484f9dec6cddff6e339499d6f2f3c0

SHA1
566925a31e2b61b209bcf6792b26f59f4f15611e

SHA256
e4b63c956dea058e574789831096f55c4fde924553a1195c0a70f79edb3dc967

SHA512
198db97408f8991f590cd15994ee26da9b12b9bf24aff12c2520d34f3845c720b008ba417ef9c8de245ede089fe4c1a39c0363534f06c687b222f87babd9c1f0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00009c

Filesize
41KB

MD5
d8044afed695257e3ef7615b40011039

SHA1
d8bde35f37bdf1cb09788839b1f9203c46ad2ad9

SHA256
54511da566ebe8db5befeb5c627a6f00f22f62c378682bdf00613904b41afde2

SHA512
07c4be3be063d4e41695b4754e03d6587eeb2bb87d2a42bb3880c40b8ff74ce48351d14c0e6a5c860828f700c082d410c17ce60aebe01ae0d96ae2c048966d0e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00009d

Filesize
17KB

MD5
bb41102a864ba7e9443352f635300637

SHA1
a56a480fb3ade56d3f6a2e24039b1c89c8c04447

SHA256
4f7fa243ef77579c86b09af1ac25297bb6c650f6df7375ee1e0e147cde197446

SHA512
27d455bd8c74a1174790953ec4122ce72740b11bbff1aaf426620b08f49e99ac77dd8d965b7f47368e597a5fe590a9b432740e46681f134470f1b5d9d84aea8e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000fd

Filesize
20KB

MD5
6931123c52bee278b00ee54ae99f0ead

SHA1
6907e9544cd8b24f602d0a623cfe32fe9426f81f

SHA256
c54a6c3031bf3472077c716fa942bd683119dc483b7e0181e8a608fa0b309935

SHA512
40221fe98816aa369c45f87dc62e6d91fcdb559d9756cb6a05819f1cde629e23a51803e71371f4e4f27112a09489d58ed45b2b901a5f2f00c69c082b3576057f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000ff

Filesize
62KB

MD5
f9f305e10bd8ea1432b9fd1d355ecc90

SHA1
934ce6d59f903d145519d1066bb574c82a25edf9

SHA256
01d35e181e0a373c0fae013280a79616dbb1fc2d2f892b3215c941c098e0c9c6

SHA512
9efb67bfc44f6c31137e0387bac74880f9b93d3645837805ac6ffed7e7fad5be7c3812cd11c9172b767ff4cc258fa140663c33892ba8f28ac2ef7686b3bee0aa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000101

Filesize
54KB

MD5
01ad880ee50b786f74a5e4fae9ba3d71

SHA1
111387dbe885b7f3af44cdbbeea17eeb04bbf803

SHA256
9368f2d586a1d2727921605892048bf5201ef8caa044f2e939ef431aa881d83e

SHA512
d8dc47e5d55e6598988281539205936c56b716eb02b4e643fc917a68ba4407ece36a9d4115d5d0e32ac630d44eadb94ad2607330de082629fea82a9bd35fb83c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000102

Filesize
28KB

MD5
13d4f13cd34f37afc507ac239d82ddbd

SHA1
6d500935a441d438ed052e90de0443bccc8c6d17

SHA256
76464e77d22532976bbe5d1829e97854d5c37ed5a46ff300ad9680876ec81d01

SHA512
152e6449d09a7b544cf6f986c9695ae07c330f4b13068cca028ab56ffdad6ff2467f371ea4385ad71da023f3beb83fe0ba1d6d413f1ddde14372efe82ae36b6d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000105

Filesize
40KB

MD5
230ab95d87a717be265134072eb17c25

SHA1
71a3d3dd6f952057ba0c6025d39c9792ff606828

SHA256
3fdfeaa675697f08f1c7c0fd6b77512f4bf9465e670637e8e332e65ebb9db068

SHA512
9b0636421ad14161f211e846521149ab0a7c866e77db309dba79718487835204cee3821c9f4678e48e134614be6a02421c155a34b7c9bc424012137705960b11

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000141

Filesize
24KB

MD5
6b4db2d347f7a32c287a4a00a5bbde6f

SHA1
710b43da61ce46d767fd5670c6b23bdeea222c82

SHA256
2f3793a0ca4e2ccf9d23833b4c9a9323f7cbe2c7f7a745a49f8583c4ca43b6d6

SHA512
4b6e1a4ae1eade790c93a052f267db283649c81ec21a508d0c69bd07f6d62b4a21f532387b20655e6bc96224fad977d0400c5ecc2b0d481a88769c6db89d60a5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000142

Filesize
30KB

MD5
51364b462b26107abc344111b62d0592

SHA1
6775b968408a056e5cd2c05e32482c86bfbdb184

SHA256
832bf8f86c8ca8022a7a5202dcfca25bcd30f509938e55f5f4fdc33b50b86b89

SHA512
a6b1c89eb3005b22081dd8c156a647a6956babb8c4fbff8078b431e7103e05f30119b91395653bb301c91c88e2d5ecc11da7ca5c70b5cce38b86095876f6de8a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000147

Filesize
28KB

MD5
ffd5d4f84d125e590d75042d17366b53

SHA1
1889caaa192b5d7993696b773c79a0dde67cb0db

SHA256
b4a5d77c8b2c369a7a77600375f6233a9f29f10a9c16dd5c295c692cd9bd038b

SHA512
5c71619dd7a6a10daba25754b05055049996b6a5eb860808e19f2a9e87e466c0d87e41bb170d8c9403b6a3f143c2e5c3ffecbb9610d03727a9c3e75396128a93

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000165

Filesize
17KB

MD5
56c0e0482f197751d8c3b6553a1e57da

SHA1
6287aa05c531fe76cb52ae96edacf14978eeed45

SHA256
4f1c808f0e0be07b136b3d4388148d2957a4e52e2f0448d230aa343f688a1285

SHA512
27938cb112655ab3005a36a06ed03cc129477ea759f2d0bf671599404f5b0db173685ea27fde61753d57bb3690f94fac95068282bf2f63a2e08a5e88483f6de5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000168

Filesize
17KB

MD5
32ae51aeb2385f887c5ba9e83aefb148

SHA1
042c45f16cf8ca4548f63558b116d04aceee1451

SHA256
b53a87cf7c5335f63d96cb95aad6698febd05c5a1999de31aa3e5078df50d91c

SHA512
cfc22795a9972774eefbd2b23f15c572dd9abe4053eeae722b03a5aa0ad79fad9792c892a3cbece9ad66543f87665926df3dcefcda1e2f7e43efa61a84ad839b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00016c

Filesize
18KB

MD5
4c26bbd5da88d9945abe89bd4df70d58

SHA1
360479dd23da9a01d31da645e1025e2a7b5177e3

SHA256
d970c51b35f26beece617d98abc33d5cc246a63e03199f3d84dcad15b0487254

SHA512
ff309aedad5bf7b42c4580c6121d8515da36503430cbc8ac785b965d340dadbde553a620d9d74fc82791e3c422faa9ddf06334165caa4707c9277e915dd184c1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000172

Filesize
18KB

MD5
be02db77a86897f4e04baf6ff347ac20

SHA1
91108638d1451b25287f3b690249b44f344b7142

SHA256
f1b1055ef1a45e1f5965f4add039776bd33c2e38477a647d22f07b0b1da150ee

SHA512
bc0724de6dfd0dda1a60e1766173fefd3ae71968d0459d20b83bc23bbe738559cf8eb864f6f9686a780718fc320f4b98f1cae54e6c3a3924c69d9e5ca7e4ef80

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\04e1bbfc486eec56_0

Filesize
1KB

MD5
f499bf6730e75cc26fae08851c29202f

SHA1
8eec57f836f2f88394339e7bc05dbbdb7aa128d8

SHA256
446ff3975b2c88303604fde565a20604d7dfbeb6e182aaaed824f0abfe586281

SHA512
3b599cb833a5ff2bd2767a6b2e04ed34ed6935e86638de9824e6d3d427fad3473dc48d90f4fb4c636d6f7d65bc8b870c77bf7cae7fee3c11f641a59f2c77c35b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\08e76d23cecc7749_0

Filesize
1KB

MD5
ba1df403b8ee9e4d4553bb07f176bc12

SHA1
fe4975682542b3e5c0bd14eba82b4b092f784a17

SHA256
3095b83372e5c3a21df68f23e25cb2ca43fab206b0a2ed531d7f030d3e2531a4

SHA512
ef2d0f7620766cf8fc7cc1445c9c5da7b1da56f75f21090d396f671864bcd139a5a6be08c1e9834576a686d15d547ae1d572f13b3a0a7cfeff2697613c261e79

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\0a3d6e445aa76e89_0

Filesize
258B

MD5
3081d14bb36aa72d1c76176d635846f3

SHA1
ec82d257eed948f9f4779f6c332ecf1657a966af

SHA256
848a530fe0ec1c621e25caace8e1aad2db3e1267c1dda807a2323ee9727e218f

SHA512
df74f37b349a423e73299fd6c6e185a23565d7f86f55bb18780224ef2152e4ba001fdddf8a3e9e9db776d058aed762d47a571e658f2604105da6f578b1573c3a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\0b02d357ef50b3cf_0

Filesize
5KB

MD5
1f7abb6caf71db96fa263ae0c5f492c9

SHA1
04e826b73fb88c22db708a652350d2b031cf8901

SHA256
6d701bf0e49b0740d9b350c4a877b5ce29cbe3fd57cc14252500a16f0f38a0d9

SHA512
4b92cd627cabbc7f9268bdaaa5e49e88f11211d30bf7fb8ff986867e76dd8067eca26d2e11ffd3351daa4dbaa529264b7b4cb308cd797dabc88d758e4c78da9a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\0d175fa4d03d864b_0

Filesize
1KB

MD5
5296b4cdb652d2c4cd0e3e747c4ad9bc

SHA1
5a3d09868eb7002bf73cc81b1fe1ee9935b58910

SHA256
cf5488f06af65f683970e25df2001d7b0174021d38ff0d5ee96ce536f205a267

SHA512
36b87cbd13387b3234faa42000018ada803f671ecbab8a223a78f7c6293beddada40d60f495cdb49e95f64e3d1ff256101c69c78505f88f521cd39038dee0895

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\112dec630c6e88e4_0

Filesize
23KB

MD5
2f5b79cde79939d2b853314f9c5110ea

SHA1
55135c2a404fc57f0b91e5aa41d1029e026bc26e

SHA256
d98ae703349bac90c7b4bc20e7aff6ea01a66131b2d113fa4f75955d3b292464

SHA512
cdfd5b6b3e0a952c646bb93a7bdce01c902784ac0d62330767633e9ba8b02dfa1f065d0ef9b347f0122d923af53aa85e75a866bacfba5417e07db849ad75ff3f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\11fa2f16788f9b9e_0

Filesize
6KB

MD5
1b63c0e581d55e065febc20fe83fd5b8

SHA1
773fbc2dd61ab30831ec7c2b5441672426f9f926

SHA256
79a79137ded8f25a908ac019f88f22dc9f51070c4f472b82c6fa1241d5869c97

SHA512
7ddc877a87da0aff4d3fbd5260fe9e79d02d3ea9193fe59aa44d94fc789d620c78b33d1c4673a02d7db3c28c33adccc40d93ffdd77977ec56fc583c77a54d279

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\14d984b5061df5e8_0

Filesize
7KB

MD5
0ce92c908f392ec77843b7ce02d0a730

SHA1
23f337aab86c17af93964011246855b51c5ddc7d

SHA256
af62306fe08cb5d125e480a809fa2ad30227dd6501ad8300d0f251be097d8b40

SHA512
a4e3459f9ada5e870f520e44d187271b66837b208b769f62256f9e5b359c57df703932126e76fb62159f9c698159da1bb0b787c97bd1e227933244b19379b512

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\16fffc8d4f23d1f8_0

Filesize
26KB

MD5
b0d4e822d2a9ea1c9feeadaa224bb8d6

SHA1
610c72771892f02a1514c5382bb21012e185623e

SHA256
16991aa7b809c9c260cdec91dafd8ac320d7017f8c71e314219be98d24b8d1bf

SHA512
45bcb9a634c0e44e0612b2b6448c338b016c636e1367faa18824a51069ab021a87034e1197d7c74e6e1af1df353f18e6880e88318b7f68515206272742983195

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\20d4082e200039ce_0