hxxps://github[.]com/ArdhenisAflah/MalwareCSharp/blob/master/Aplikasi%20Nama[.]exe

Analysis

max time kernel
299s
max time network
297s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18-08-2024 14:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/ArdhenisAflah/MalwareCSharp/blob/master/Aplikasi%20Nama.exe

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	Aplikasi Nama.exe

Executes dropped EXE 7 IoCs

pid	Process
1852	Makarov.exe
1216	Aplikasi Nama.exe
4272	MemoriBooting.exe
2316	MemoriBooting.exe
2304	MemoriBooting.exe
2092	RegistryHack.exe
2000	RegistryHack.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
61	raw.githubusercontent.com
62	raw.githubusercontent.com
114	raw.githubusercontent.com

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	chrome.exe
File created	\??\c:\windows\system32\driverstore\filerepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 5 IoCs

pid	pid_target	Process	procid_target
2528	4272	WerFault.exe	136
1736	2316	WerFault.exe	143
3096	2304	WerFault.exe	146
2316	2092	WerFault.exe	155
2492	2000	WerFault.exe	158

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Makarov.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aplikasi Nama.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegistryHack.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegistryHack.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MemoriBooting.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MemoriBooting.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MemoriBooting.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133684637079827144"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings	chrome.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
692	vlc.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2276	chrome.exe
2276	chrome.exe
3908	chrome.exe
3908	chrome.exe
3908	chrome.exe
3908	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
692	vlc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeCreatePagefilePrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeCreatePagefilePrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeCreatePagefilePrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeCreatePagefilePrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeCreatePagefilePrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeCreatePagefilePrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeCreatePagefilePrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeCreatePagefilePrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeCreatePagefilePrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeCreatePagefilePrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeCreatePagefilePrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeCreatePagefilePrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeCreatePagefilePrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeCreatePagefilePrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeCreatePagefilePrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeCreatePagefilePrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeCreatePagefilePrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeCreatePagefilePrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeCreatePagefilePrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeCreatePagefilePrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeCreatePagefilePrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeCreatePagefilePrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeCreatePagefilePrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeCreatePagefilePrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeCreatePagefilePrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeCreatePagefilePrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeCreatePagefilePrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeCreatePagefilePrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeCreatePagefilePrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeCreatePagefilePrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeCreatePagefilePrivilege	2276	chrome.exe
Token: SeShutdownPrivilege	2276	chrome.exe
Token: SeCreatePagefilePrivilege	2276	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe

Suspicious use of SendNotifyMessage 28 IoCs

pid	Process
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
2276	chrome.exe
692	vlc.exe
692	vlc.exe
692	vlc.exe
692	vlc.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
692	vlc.exe
692	vlc.exe
692	vlc.exe
692	vlc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 4628	2276	chrome.exe	84
PID 2276 wrote to memory of 4628	2276	chrome.exe	84
PID 2276 wrote to memory of 3032	2276	chrome.exe	85
PID 2276 wrote to memory of 3032	2276	chrome.exe	85
PID 2276 wrote to memory of 3032	2276	chrome.exe	85
PID 2276 wrote to memory of 3032	2276	chrome.exe	85
PID 2276 wrote to memory of 3032	2276	chrome.exe	85
PID 2276 wrote to memory of 3032	2276	chrome.exe	85
PID 2276 wrote to memory of 3032	2276	chrome.exe	85
PID 2276 wrote to memory of 3032	2276	chrome.exe	85
PID 2276 wrote to memory of 3032	2276	chrome.exe	85
PID 2276 wrote to memory of 3032	2276	chrome.exe	85
PID 2276 wrote to memory of 3032	2276	chrome.exe	85
PID 2276 wrote to memory of 3032	2276	chrome.exe	85
PID 2276 wrote to memory of 3032	2276	chrome.exe	85
PID 2276 wrote to memory of 3032	2276	chrome.exe	85
PID 2276 wrote to memory of 3032	2276	chrome.exe	85
PID 2276 wrote to memory of 3032	2276	chrome.exe	85
PID 2276 wrote to memory of 3032	2276	chrome.exe	85
PID 2276 wrote to memory of 3032	2276	chrome.exe	85
PID 2276 wrote to memory of 3032	2276	chrome.exe	85
PID 2276 wrote to memory of 3032	2276	chrome.exe	85
PID 2276 wrote to memory of 3032	2276	chrome.exe	85
PID 2276 wrote to memory of 3032	2276	chrome.exe	85
PID 2276 wrote to memory of 3032	2276	chrome.exe	85
PID 2276 wrote to memory of 3032	2276	chrome.exe	85
PID 2276 wrote to memory of 3032	2276	chrome.exe	85
PID 2276 wrote to memory of 3032	2276	chrome.exe	85
PID 2276 wrote to memory of 3032	2276	chrome.exe	85
PID 2276 wrote to memory of 3032	2276	chrome.exe	85
PID 2276 wrote to memory of 3032	2276	chrome.exe	85
PID 2276 wrote to memory of 3032	2276	chrome.exe	85
PID 2276 wrote to memory of 1616	2276	chrome.exe	86
PID 2276 wrote to memory of 1616	2276	chrome.exe	86
PID 2276 wrote to memory of 4432	2276	chrome.exe	87
PID 2276 wrote to memory of 4432	2276	chrome.exe	87
PID 2276 wrote to memory of 4432	2276	chrome.exe	87
PID 2276 wrote to memory of 4432	2276	chrome.exe	87
PID 2276 wrote to memory of 4432	2276	chrome.exe	87
PID 2276 wrote to memory of 4432	2276	chrome.exe	87
PID 2276 wrote to memory of 4432	2276	chrome.exe	87
PID 2276 wrote to memory of 4432	2276	chrome.exe	87
PID 2276 wrote to memory of 4432	2276	chrome.exe	87
PID 2276 wrote to memory of 4432	2276	chrome.exe	87
PID 2276 wrote to memory of 4432	2276	chrome.exe	87
PID 2276 wrote to memory of 4432	2276	chrome.exe	87
PID 2276 wrote to memory of 4432	2276	chrome.exe	87
PID 2276 wrote to memory of 4432	2276	chrome.exe	87
PID 2276 wrote to memory of 4432	2276	chrome.exe	87
PID 2276 wrote to memory of 4432	2276	chrome.exe	87
PID 2276 wrote to memory of 4432	2276	chrome.exe	87
PID 2276 wrote to memory of 4432	2276	chrome.exe	87
PID 2276 wrote to memory of 4432	2276	chrome.exe	87
PID 2276 wrote to memory of 4432	2276	chrome.exe	87
PID 2276 wrote to memory of 4432	2276	chrome.exe	87
PID 2276 wrote to memory of 4432	2276	chrome.exe	87
PID 2276 wrote to memory of 4432	2276	chrome.exe	87
PID 2276 wrote to memory of 4432	2276	chrome.exe	87
PID 2276 wrote to memory of 4432	2276	chrome.exe	87
PID 2276 wrote to memory of 4432	2276	chrome.exe	87
PID 2276 wrote to memory of 4432	2276	chrome.exe	87
PID 2276 wrote to memory of 4432	2276	chrome.exe	87
PID 2276 wrote to memory of 4432	2276	chrome.exe	87
PID 2276 wrote to memory of 4432	2276	chrome.exe	87

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/ArdhenisAflah/MalwareCSharp/blob/master/Aplikasi%20Nama.exe
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff8e8a0cc40,0x7ff8e8a0cc4c,0x7ff8e8a0cc58
  2⤵
  PID:4628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1832,i,6729607961146426284,3242321427755028841,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1828 /prefetch:2
  2⤵
  PID:3032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1796,i,6729607961146426284,3242321427755028841,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2072 /prefetch:3
  2⤵
  PID:1616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2272,i,6729607961146426284,3242321427755028841,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2472 /prefetch:8
  2⤵
  PID:4432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3108,i,6729607961146426284,3242321427755028841,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3128 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3116,i,6729607961146426284,3242321427755028841,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:1984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4644,i,6729607961146426284,3242321427755028841,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4788 /prefetch:8
  2⤵
  PID:1656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=4540,i,6729607961146426284,3242321427755028841,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4484 /prefetch:8
  2⤵
  PID:2160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=4576,i,6729607961146426284,3242321427755028841,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  PID:1608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5400,i,6729607961146426284,3242321427755028841,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  PID:2356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5380,i,6729607961146426284,3242321427755028841,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4600 /prefetch:8
  2⤵
  PID:4256
- C:\Users\Admin\Downloads\Makarov.exe
  "C:\Users\Admin\Downloads\Makarov.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5456,i,6729607961146426284,3242321427755028841,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4468 /prefetch:8
  2⤵
  PID:1924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=4672,i,6729607961146426284,3242321427755028841,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5496 /prefetch:8
  2⤵
  PID:4680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5496,i,6729607961146426284,3242321427755028841,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4912 /prefetch:8
  2⤵
  PID:452
- C:\Users\Admin\Downloads\Aplikasi Nama.exe
  "C:\Users\Admin\Downloads\Aplikasi Nama.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1216
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2376
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4332,i,6729607961146426284,3242321427755028841,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4628 /prefetch:8
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:3908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5180,i,6729607961146426284,3242321427755028841,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1120 /prefetch:8
  2⤵
  PID:4880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=4452,i,6729607961146426284,3242321427755028841,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5520 /prefetch:8
  2⤵
  PID:2156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5428,i,6729607961146426284,3242321427755028841,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4504 /prefetch:8
  2⤵
  PID:4992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5080,i,6729607961146426284,3242321427755028841,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  PID:3232
- C:\Users\Admin\Downloads\MemoriBooting.exe
  "C:\Users\Admin\Downloads\MemoriBooting.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4272
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4272 -s 920
    3⤵
    - Program crash
    PID:2528
- C:\Users\Admin\Downloads\MemoriBooting.exe
  "C:\Users\Admin\Downloads\MemoriBooting.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2316
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2316 -s 884
    3⤵
    - Program crash
    PID:1736
- C:\Users\Admin\Downloads\MemoriBooting.exe
  "C:\Users\Admin\Downloads\MemoriBooting.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2304
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2304 -s 884
    3⤵
    - Program crash
    PID:3096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=5392,i,6729607961146426284,3242321427755028841,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4468 /prefetch:1
  2⤵
  PID:2724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=5604,i,6729607961146426284,3242321427755028841,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:3092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5020,i,6729607961146426284,3242321427755028841,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:3416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5724,i,6729607961146426284,3242321427755028841,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3276 /prefetch:8
  2⤵
  PID:116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5740,i,6729607961146426284,3242321427755028841,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5752 /prefetch:8
  2⤵
  PID:4204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4484,i,6729607961146426284,3242321427755028841,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:1020
- C:\Users\Admin\Downloads\RegistryHack.exe
  "C:\Users\Admin\Downloads\RegistryHack.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2092
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2092 -s 912
    3⤵
    - Program crash
    PID:2316
- C:\Users\Admin\Downloads\RegistryHack.exe
  "C:\Users\Admin\Downloads\RegistryHack.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2000
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2000 -s 884
    3⤵
    - Program crash
    PID:2492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5856,i,6729607961146426284,3242321427755028841,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  PID:2408
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\bandicam 2021-04-09 19-44-20-158.mp4"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:692

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:4032

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4040

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x528 0x514
1⤵
PID:4864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4272 -ip 4272
1⤵
PID:1900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2316 -ip 2316
1⤵
PID:3472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2304 -ip 2304
1⤵
PID:2144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2092 -ip 2092
1⤵
PID:1624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 2000 -ip 2000
1⤵
PID:1704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
c0f2d8ebc70b7703131bb59e30a2c01e

SHA1
9761e43122dbcc77b598ab61b542ccf1b73a46e6

SHA256
43ad7ddbc5ab38099f9aef30e5e9bb2efd44f16fcc9ddc6ff112dc566d6faddf

SHA512
17858a3440745ae57fa36d9254f4c8a7cc1161cfd1eee4d9eaeccb050ead254cefe359e24f37c4089265a39eff0d264953e961d998aa2e1ff4e666deae992116

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
4b3831c4443dddf506304fcbd0f53ec2

SHA1
3d1aa588823be4ac1e1e7db1acf198a2dd02e4c9

SHA256
6ab702226d7b57e3efbaa58e94ca40bbb5e8459d35928ce87e2cdecccf4ff7f2

SHA512
cfc1ec3a8d6bb91c70ca578132f462f48e586b55bd4d77f9e039d37f8f70a9164ff5b782fc1ba587e425b361b500e5022323c158dd86fcfefb89e01987ff8eb0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
6c69ab771ff3a4b51cd9e553e18bdf7f

SHA1
b4215dc8309a9bff6636753c43f6b3abc6dffe32

SHA256
dee049feca9730bcd93711a14e4af0448b5d86b57102eac1221eaabea96f532e

SHA512
532a06ae740c1f1abf3670f4610aed842eefbbd1a5232d4e34b0786803ab7b5be99151aa53303a1caaf35024ccb388a23c4493a715a0c9055f5b73c0300516e9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
319658f473f79049ff7ac4a3c770159e

SHA1
4694be7f821f3912f3657d93877e426b72dbd110

SHA256
4a7fd57fcabbdeb981de041bc4b86b4942cf694a72ecf50804be4e4e9a4aff25

SHA512
9ed5586999261ddb1ac21de3e5f9fac58042b031000a4b426e8b4333fb1b88968ed1b5a1d393dbdcc50d9ef89d1a85a7a6f6f3102ce6be487aa588ebe7bdd050

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
c6119656136b5e7bf64e4df81d87b4dc

SHA1
005b7e8a73de86ea5f7d801dd420f11256066ba6

SHA256
4c56db9378b42bece1d099acced98f6d6f1d322facf02910ac17ca82ff67e450

SHA512
c4ba09dc6bd78a8325b2e6c76d1399f830d7033a90c315dd9111c92f4909aba364b32a8eb7bdd65cd748558ba4a273abe7fcb2ede1bfab9f23ff86ef11bd1337

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
afcb02f0ed0b14f727ffda40ae7b4c27

SHA1
5d5204c357a51122d5c91477834d44858f2efc20

SHA256
aaab31415535f068ccb026f043325cea2f3ce4b53d434a1414e898c4933036f4

SHA512
89d7d21be48da1ba6b86961981e820eabfc3a1522f873b6df3de582caeb0e4ee6d22f5f732a4cbe3d2701f6fe5e382da2c349b9e405dbb57fb214942d89f3f6c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
3556370c525c2abf1e28c0e6af191b39

SHA1
4b43324bf90089e6217f72804d410d9b6f61966e

SHA256
d8918c98a1e9343f109ed94b4dbf0689fcef5de9ddd6ec921be5c7564ee953b4

SHA512
9a21265cc6c5d61e16c5b05c3c72826a6a1848082801b1c90e21460861a90fe4d52d61e9b56617eed5ff6117b923110bc9cfa4912443ad37029a3a66295ef46a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
f11b9fa2e96e82f23b4b923ff93587cb

SHA1
39ebe886ea989c3fac89c7e66c5ccaa8a1e9f462

SHA256
befba5e14c200385b0e3ad280bc858318319318110ce142946a70e443dadfb73

SHA512
e80cad38a4967b0abf13c81f1ebc52ba4fbdd5f5d3716ef69d2d8e26caef9567b42fa2189ea29cdcf3d8ef3c4f3df2f8227ea36f743bf95d57d5f4c143306a44

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
1ce6ade730138819273d191a313982ef

SHA1
f92febf8f4e21e3b3b8a72a73cc1077b90119a24

SHA256
f84bd96bd962cddfd559f7ea28ba221da01d29a1de822e3f8462471bb4fc93c7

SHA512
155b5db23838190f2668c43cc697525815eacd967fc3e5b173a6d57a2eba11410617d283645db7db84e7b582d2c4321a4497fe92ca6c88df39ca90664f0d8832

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
19b956691ece81c3ea4e976bb6e35bf6

SHA1
f8e843256a3a83a817ec4ab7f1bd8c4f98832fe4

SHA256
28b8adbc124c56fe6d4b5f33053982c32f6ac32d7de333c4f964005ed4d1c2f7

SHA512
f2aa507286e162755c5a7566962970100c6f7fbd6004602154f70b9b1332a16bdb77e3509e5098ebb68577fd28bc56019d05d7f85516bd1c40d89369f3981fd6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
d931f9d64d12ff89eb6cc712b6a53026

SHA1
575aa462edc3e06c4edfd78a4e4c05ec87eb39f7

SHA256
9afd0945936a7b06829ddd838bd532ab40aac51686c84ef04516db43a702ccab

SHA512
da699e9022c0fa040122a08d27f620e4c0c96ac517e58e6a706badfb5e41f218561deb7f3693bae320c71e913077f2054709fef4943b68364a9528e77a2d3c61

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
32776f91831a43c18d627f7930ddc34e

SHA1
7ab1114afcd6e4de3bc68c7c9008d9ecfc37a994

SHA256
74731f62b782dad2a0a75c112d21f7643217cb973386371a5da4aeb47a425297

SHA512
ffea4818517b0bbf694a23e6a524cd7a309d559a87f43a62bb8e97be44e5894fd67fcafb208a9b891cde4d3e685c0950d93eb7cb76805a88f671394b8aa32ddc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
bca9fef8d477bfc38d3713ab91876faf

SHA1
81a8715cbd1bda14f6bb5b956067036499913aee

SHA256
f8b5cbf54f4d68dfa8a08857722dc93b21f724bded72890317aabaa6d8e767c5

SHA512
09d97215206e403d8c61b42a66f9ee0c0c8d2babbb940e65b932ef73ec78a7f44be7d92c6170fa37ca6aab8ede1a68752e1492943cd754e63b71ebb3dabc229e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
3f33d8d10563d6b97710a13819887b46

SHA1
3487cd05f9eff7b5f3aa74fcc8cd27fdfbcd9f97

SHA256
37baf1f6b0e3cdd00f533a670c0377e9f76983cab532997bd2ac31b2d6584b4d

SHA512
1e29dee55512bd65f1c9da1f46e8ff88802749f5ed2708e2ed2665a9a942e5c068be62d23335775d591f74e348ad6de42983b7d7b2a60110219022480d57c046

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
0133d566c0e95f8fb51ced0b804c63dc

SHA1
7592f4d48c6a076903cb1c5e062f52da7f80c5fa

SHA256
8a0b91aa0f6b397de1a675e946b8754f209a1b2732f420c1a43754b35f0e3b34

SHA512
11f502c1a3507390093da66939fb55a710e06a44c5b7464bce44107b2bef1616d0abd0bee56474eac9b9f4b2c127dc30a00905c7e3f20ed380c865c3cc777608

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
5680326c58296af0a491d906f6bc77ac

SHA1
aa9e9e4f72c2b96e794e017ff6f9507eb085d82d

SHA256
2693fa52c4e6f29cb3698ca1e1109d164a529b720a09d698f99823b554883d62

SHA512
00118f3c3eec08b9646842e258ff2b55f048303ac70c791addfab58cced31082e47ce5fcc9d38dbce9af84b8d2f607c4dcc972841f1a07c4aba3e22f55206b0a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
c56e9a0964fab74eaa8ea63e538a8628

SHA1
810aa3eb529e4eff842ebdc1110b6ccf90ffe4cf

SHA256
927fdbc6d3122cc0bb276469d00dcf93d90b4fee72ef12e19bebeb4696125671

SHA512
61463a6a3988bfb7311d4ea67e990eee92d1fc6133fb1eb83799ee7614b04c0cfe00251d9a7458d9a8090e7724440a8012ece70b1cb44c8a7233de7910abbea7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
bf2d8c3806adab070efcabe9e4085097

SHA1
a5f3b334864471f263da4ded47c0fef5d50c7cca

SHA256
716877af5caaf9864292f0d6b2dbc6b5d3a03169f811582d667c6a57ac6aad45

SHA512
1c78d045805659da7b9abf56c5b98a706c2a9aff31a23fe103f54dd7ff1f1f5320cedd8ae9aa428c24557813a4db14112b55d72b5bfb2a9cb7243f42a0844738

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
be45a9df7eeb9c438417b05c2f43a900

SHA1
ff62575d076e44b108f47ec2c855af3fb920e212

SHA256
24356db62c6b040984b872a0c8a7bf194e17cd932008945f875b924dcb15a8a3

SHA512
8d3169b7d7ee6782e10af0dc9ac2d063233d1052674cd1e7258aa67327fbe347c5f7941466d6b41d74a2c591d85d83cd1102fdac63f09107b49aa12f7c49effc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
72c87bbc6cfb50d64406216129e6e069

SHA1
cf6b806561fda3b49bd77370a8dad90044281f68

SHA256
3f28235efecd6c5fb5d6b516df505c14c1d57858ce7c79d6a2445684d4827ef9

SHA512
2c85afd4c469c76057a3434731936521724a02f7174005ea030861ea6fddb1b05ed1d9012a9b54dadd9d130156dc669c5c43ce375282c84ae50ab59b5f92d303

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
8d0869ca8993085962b0ad7d8b92a944

SHA1
eb0ff574e023fcfb9962afe365a465bca178dd18

SHA256
ad88197bfefefa877ea65e77efbb66a776eeae73fcadc6f148e940f9ab221e34

SHA512
d774429ce920ec730b0333dc4f99af831c75e58017b1868655c8fdcaea673e756e8a6bdea64057afb4a7516b1d9b913962a58e624e563c07a0aa802aefd140c0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
62b3cddf8c68722b7ddc9d9f7400afb0

SHA1
8aa4ee04e241a6e1f57bff96e551404cde07f329

SHA256
a149eb5c1953675b870c2e898f05e4e870b04a041106eafe92ad258c9870f836

SHA512
044e93a7e9f076844840c544c7d63df6ae24b84c5138f2e9e82b7f206ca9e3b48bc3f06a19a1ddc14bde4c214b0fcc79e659c98976b64203751149807b04fdfd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
cb41ea3b7e9a289d30d58660460d8a46

SHA1
97abdb48fc38473aa75fb4099adc694267632693

SHA256
e3dd2669fffadc0a49ccb227291da8dfc5f2ef8389a822a4f27d72ca6d37a9d4

SHA512
d64bd941bf25e0678201155e929aa051133a9d84ecc61b677e42aab74ab50ace91eb627eec375d8ddd9498d3026bb167e50ba9276e8c50cf52a2202e8e1bf88c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
614eee405950894ae1a3a694f698aec3

SHA1
a406f9b4126a9da6630fd154e1e9b59f67c3ab9c

SHA256
6ebd4cfd3bd5ed7aed8abd46532930fdfce34cd6756cbdfe3b4a3d969706a4d1

SHA512
1d3ec2f0a7e23b0d8f0fde7c51b06db76acd459bcdac2fafd97421a49b76c13013c7984ae1c429711476d139cc591d8f8dfbb333b1cae999fb08c5697749920a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
19186ca1e23946a30e5b1879b61ca084

SHA1
e48c65ecf56d0fa0f872efe95c051a75c1ff1c4f

SHA256
c2d3a93868c8c0eea011f02b06ce1dcd52730477128a42e39e377b63b2cdfce0

SHA512
04e7fc35195e5ac6a77d3f5fb18191a013b5d21cd62fa883bea8d90e21ef0d801c704bf10a986de8301d7cc61e439e929cdca1a2d969abc45be17fd12583b743

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
210d482a4208697e8c918c51123b0a42

SHA1
6b559cbfe432620c346d88762f202d8e1763387b

SHA256
7324c1f38c4cdb0570dd50e3df613bc456a901504be4cc3b0e6e33e78b34d921

SHA512
879caab74517be8adf706a71994b5031e3b2b6a03c3f8bc3f78168a372953ebc8ff9f9f19d050a8787bedec62154d984ed49e0d2bef1b9bb92c2ac3185853331

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
f3e29e6a9c34649eb23fa4936d64fa49

SHA1
25555dc9144cbfd62917240b88c62cc5af4e583c

SHA256
98923066a053577442f9706bce18b115513193c0a30e95b812c590597c4c6943

SHA512
dea3fcfbd47c03e55cd9513e40d78c46b57d266fa63a3ca6130abe20bb021b469bc49332339a5899b5a402c19a0eeba38cbc8a220119811f45e2632548154723

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
05782953c07e4e50c65e52882b980808

SHA1
8e66a8c7c2ca96fc2643030d003db9580582739d

SHA256
fd28b7474b43465d7638042e2cf7e1079b2ba09cb630c7f5ecfb13fd4e98acc2

SHA512
662130902d4d15116d4ccdbd6acf5198ed94e5475da3779561886f265f9cff9aeab981e8765bf7f54ef0d4cb0f1a31ef44050ed3f8e3ea7d96b34a624c3c73e6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
30fddfb149d81a815fac4e4ec0c7ee17

SHA1
63f329d57ea1884af01101a90b21e3667216a5b6

SHA256
01d1a7c98695c57bd8dae5995b81d8317564d6c26edda66aa50bfb8917852490

SHA512
45f7bd9311ffec1e2866227aabef8feb8d9452f12d6b6802b37386a0119d7817c834a4cd2a70192fc10f5652ada88886d023914e9c380745c81755f8271378e7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
c84ea0179aacc742390788feddc0e9d3

SHA1
0c880b28bd298a0775a4d3c5404ba169087153ed

SHA256
b784263edd65e0cdc21580517ed8ed6d2928562660b17a8eef7f0e1f14d79186

SHA512
09a687832ed8e45fda9a795361dfd4ba87ca96b920e9b350179d1185181312a8d988f0343a76c5061b30c6e2c5bc7d7db5ec052a4c7bfafe9fe2495ab26023b7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
0666e7679262b4bbb7d14b74db0278e0

SHA1
21aaf877581635cff93aa3b3dd470e5b94f174af

SHA256
9575977512065cc6cc0b792e9bc219629edf7665af4bcef17358b68d5e9bd04b

SHA512
3a7948da3ba9c03b85c8b340e0c75e54fc2121b921567510efb34320fc5792522e28b17fc673764899c2f522d87b7e834ade87312886c954dbe26d08f3a2bc2a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
46533567367567516266452cfd8b7630

SHA1
06274aa023c60ca2620443ffe489a77a04a97d96

SHA256
f9b793213b60bbbda0b2b9013cfe967db1f7b5c984205832b0e0dbb8a7050cf2

SHA512
e2e10a4facf90f8ffeb111aa3725f166951da2364ebc48cfeab70a1b0f59dc4523d49cdb200efc3de6af75114363e1a596a8ab2b51eac1f27039c2794773cc2c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
9fa07d6e145eeb6c40c27fcf9bae6574

SHA1
9dc9fba4a02e3745e87530ba716db1f53186bf1d

SHA256
80fba46915df0c43545f8095f31dfe26ed0b61833bedfeb96dbbc1b8ff9b3e3d

SHA512
e1cab6660bf4c9d007ebc8d5513cabc1effccb528e209cbe97f6adae6816787f0c361e4ab74b18391012dfa3437144bcf8d130a95d2a222fa0cfbf7cab8bd94d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
f133d30f817a3f0c1a209c488bdb9084

SHA1
f72f0af8a78df0857df980141a16994dbd887ab3

SHA256
7538b1b58c2c9ae25acd6beca3c3a671eda9aec5020d418be2bba04431cfd7a3

SHA512
c9a33d47d5297ca83a11296b612f793569de3120f4d2b8695a9d47913136df381299bcb009dc613e0503f5addb61558627947497e07a0da71b1120e2f0c49519

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
f458a03b23e73ca2619ade81bc398f51

SHA1
f062db079ddc7db93e27110c0c86af3de3c27932

SHA256
14350fefb77330ea75bc7209c2f51129bf29ca2e79b44fd29387082054226875

SHA512
ee9699c65f26f1ea3f2b4b3df43e8ae7029e53bd0ebe3fe625cd992fadb2f157d1c14fde16a1fd09a12cb4324d0b3de7455e5ffff20d911ffc800222b6fd527f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
edc2adaca4f4b64938aabb93f789e587

SHA1
58b1f382544a9b4ea025b4783a8a17af02ed7529

SHA256
ab0a00ae5da63368fbafe2802d02c4c0530dd54f12857d64e6da8fa51050bbe2

SHA512
8cad4ab3ea6e4d2ac6818b15e39c45ecd5504156511255344134937f83fbd61e7a37bb8fd155804ed385ceb86979dd9860f32496062cdfdd238a8a54afa4c433

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
09f639128b3fde980ffb2435d31c96de

SHA1
116644284b7a8865cca1a97063f509b0257936b1

SHA256
ea8ade06c3f4d6a979bda389f21926ed3b9042b23c2cc9cfbf95f4fe56c434ee

SHA512
49f22aee990a755690d804903c67b0a1b95b8a95bc869d74645399c989c6273b482351a61d7860dad112637bbf44260aa18d2865ae76e8d139061a32ea1df912

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
99KB

MD5
2d9a307869c39c7c230f96c881cb13dd

SHA1
73d5d48e28b445dc217dd82d72fe9763876ee7b1

SHA256
b1808cab6679137e1ef8318aa5875490e053d580907f3b4024414176507d667b

SHA512
305c080c6fbc1a1e49b702cff9fadd48c9a7ceffa612d4f9c4eb717b2bd04d7efddb015573ac1bc6d1c1504e3fcd2737e0ff19a1521e9d806b79513b220a7eca

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
99KB

MD5
825eaaa1775242b184ee8e921aecb0d9

SHA1
5b47c7671ae2b9b9de3674af49db630259fe0882

SHA256
07392c0f426a1f454c018ff3232496b418797eccb5f34c2e104d121126cec2fd

SHA512
05ccfe39f61aedf3da68f0b61c06fd5ca44c3f3494001b1c2ed1b9eebb9545194653f389d8c4b439629969d6a31ea87ac0799de7d1fb5fa2a70b83c538a758e4

Download Submit
C:\Users\Admin\Downloads\Aplikasi Nama.exe

Filesize
11KB

MD5
f1a9092e7bd585778ce5396acc95f97b

SHA1
4567e37a21315d3f061666348e1b8e88f2c18d94

SHA256
486119b75d2848152c368a3bf3df8294a5ebc16bdb628f0c591831e7b2273650

SHA512
eca3a7a6a49080b21c9dd2f5e6b480b6b731fd6c0d3b7ccb573021ab79ece6c95cda0e5da29ddfd6cd38207c7b1676882718b0d02f12f6d6ed2d573eb20b0560

Download Submit
C:\Users\Admin\Downloads\Makarov.exe

Filesize
10KB

MD5
d80a36305882d6b980c9b1ee7f8bad8a

SHA1
170004a56e1d850487c6fd821eecc46fd7598886

SHA256
631cbf9115448d76b643e8aaa855b6012e7eefb653eb9086e07a0f0fa46fcdf7

SHA512
04873469cb2fd5b7589d433fa89962928b979435bb005bc4e4568a2ddb7a2ab04ce6396bd797fd48be133fb3a2ea698b9bfac9d7bb219b62a3e1c212f13b1764

Download Submit
C:\Users\Admin\Downloads\MemoriBooting.exe

Filesize
31KB

MD5
ef2dfeeee84cab95106c6f44377951df

SHA1
52fef4624e6904a2e130a302b627be9d5ed02de7

SHA256
f56a63ebf4e132c1c1f9ecb42a2aad0379aa86fbef84155cf3ead3b04ee247e6

SHA512
9932d3e262ba326f291683f8f260ceb5a23b13810b2838fb409f3000d69d220f69ead857ff5c009a585cea208ba6afb1cb711ba72959977583c959e61cbec35e

Download Submit
C:\Users\Admin\Downloads\bandicam 2021-04-09 19-44-20-158.mp4.crdownload

Filesize
11.0MB

MD5
200a6601b8e6910ed1aba016144788bf

SHA1
31286884e01157a84ea03acb5e3ae8a3498f58fd

SHA256
f9b011dfefa7fe24245841f69534ce4dfd31aa04de88b7ff38395e8294672054

SHA512
cccab5364473cd3c18ee2a61ed40bf02c8a8f90023e167b3cbc7adb300198ed93182f9cdff892e08c91eb432cec28efe0c63850f066c6f34f03d99e303c676a2

Download Submit
memory/1216-336-0x0000000000EE0000-0x0000000000EEA000-memory.dmp

Filesize
40KB

Download
memory/1216-338-0x0000000005850000-0x0000000005BA4000-memory.dmp

Filesize
3.3MB

Download
memory/1216-337-0x0000000074F10000-0x00000000756C0000-memory.dmp

Filesize
7.7MB

Download
memory/1216-365-0x0000000074F10000-0x00000000756C0000-memory.dmp

Filesize
7.7MB

Download
memory/1216-341-0x0000000074F10000-0x00000000756C0000-memory.dmp

Filesize
7.7MB

Download
memory/1216-340-0x0000000008650000-0x0000000008672000-memory.dmp

Filesize
136KB

Download
memory/1216-339-0x0000000006270000-0x000000000631A000-memory.dmp

Filesize
680KB

Download
memory/1852-276-0x0000000074F10000-0x00000000756C0000-memory.dmp

Filesize
7.7MB

Download
memory/1852-255-0x0000000074F10000-0x00000000756C0000-memory.dmp

Filesize
7.7MB

Download
memory/1852-254-0x0000000074F10000-0x00000000756C0000-memory.dmp

Filesize
7.7MB

Download
memory/1852-253-0x0000000074F1E000-0x0000000074F1F000-memory.dmp

Filesize
4KB

Download
memory/1852-234-0x0000000074F10000-0x00000000756C0000-memory.dmp

Filesize
7.7MB

Download
memory/1852-233-0x0000000004CD0000-0x0000000004CDA000-memory.dmp

Filesize
40KB

Download
memory/1852-232-0x0000000074F10000-0x00000000756C0000-memory.dmp

Filesize
7.7MB

Download
memory/1852-231-0x0000000004B00000-0x0000000004B92000-memory.dmp

Filesize
584KB

Download
memory/1852-230-0x0000000004FB0000-0x0000000005554000-memory.dmp

Filesize
5.6MB

Download
memory/1852-229-0x0000000000110000-0x0000000000118000-memory.dmp

Filesize
32KB

Download
memory/1852-228-0x0000000074F1E000-0x0000000074F1F000-memory.dmp

Filesize
4KB

Download
memory/2316-415-0x00000000057C0000-0x0000000005B14000-memory.dmp

Filesize
3.3MB

Download
memory/4272-413-0x0000000000590000-0x000000000059E000-memory.dmp

Filesize
56KB

Download