crimsonrat | hxxps://github[.]com/Da2dalus/The-MALWARE-Repo

Analysis

max time kernel
440s
max time network
448s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
02-11-2024 22:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Da2dalus/The-MALWARE-Repo

Score

10^/10

crimsonrat defense_evasion discovery macro macro_on_action rat spyware stealer

Malware Config

Extracted

Family

crimsonrat

185.136.161.124

Signatures

CrimsonRAT main payload 1 IoCs

resource	yara_rule
behavioral1/files/0x001b00000002abde-1005.dat	family_crimsonrat

CrimsonRat
Crimson RAT is a malware linked to a Pakistani-linked threat actor.
rat crimsonrat
Crimsonrat family
crimsonrat
Downloads MZ/PE file

Office macro that triggers on suspicious action 1 IoCs

Office document macro which triggers in special circumstances - often malicious.

macro macro_on_action

resource	yara_rule
behavioral1/files/0x001b00000002abe5-1084.dat	office_macro_on_action

Executes dropped EXE 18 IoCs

pid	Process
1356	xpajB.exe
4204	chrome.exe
4648	chrome.exe
3880	chrome.exe
4700	chrome.exe
4484	chrome.exe
1660	chrome.exe
1420	AgentTesla.exe
4032	AgentTesla.exe
4916	chrome.exe
4272	chrome.exe
4104	chrome.exe
1660	chrome.exe
436	CrimsonRAT.exe
1728	dlrarhsiva.exe
2012	chrome.exe
3880	WINWORD.EXE
1520	WINWORD.EXE

Loads dropped DLL 63 IoCs

pid	Process
4204	chrome.exe
4700	chrome.exe
4204	chrome.exe
4700	chrome.exe
3880	chrome.exe
4484	chrome.exe
4484	chrome.exe
4648	chrome.exe
3880	chrome.exe
4648	chrome.exe
1660	chrome.exe
1660	chrome.exe
3308	Process not Found
3308	Process not Found
4916	chrome.exe
4916	chrome.exe
4104	chrome.exe
4272	chrome.exe
4272	chrome.exe
4104	chrome.exe
1660	chrome.exe
1660	chrome.exe
436	CrimsonRAT.exe
2012	chrome.exe
2012	chrome.exe
3880	WINWORD.EXE
3880	WINWORD.EXE
3880	WINWORD.EXE
3880	WINWORD.EXE
3880	WINWORD.EXE
3880	WINWORD.EXE
3880	WINWORD.EXE
3880	WINWORD.EXE
3880	WINWORD.EXE
3880	WINWORD.EXE
3880	WINWORD.EXE
3880	WINWORD.EXE
3880	WINWORD.EXE
3880	WINWORD.EXE
3880	WINWORD.EXE
3880	WINWORD.EXE
3880	WINWORD.EXE
3880	WINWORD.EXE
3880	WINWORD.EXE
3880	WINWORD.EXE
3880	WINWORD.EXE
3880	WINWORD.EXE
3880	WINWORD.EXE
3880	WINWORD.EXE
1520	WINWORD.EXE
1520	WINWORD.EXE
1520	WINWORD.EXE
1520	WINWORD.EXE
1520	WINWORD.EXE
1520	WINWORD.EXE
1520	WINWORD.EXE
1520	WINWORD.EXE
1520	WINWORD.EXE
1520	WINWORD.EXE
1520	WINWORD.EXE
1520	WINWORD.EXE
3308	Process not Found
3308	Process not Found

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 20 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\m:	xpajB.exe
File opened (read-only)	\??\n:	xpajB.exe
File opened (read-only)	\??\o:	xpajB.exe
File opened (read-only)	\??\q:	xpajB.exe
File opened (read-only)	\??\t:	xpajB.exe
File opened (read-only)	\??\e:	xpajB.exe
File opened (read-only)	\??\i:	xpajB.exe
File opened (read-only)	\??\l:	xpajB.exe
File opened (read-only)	\??\g:	xpajB.exe
File opened (read-only)	\??\p:	xpajB.exe
File opened (read-only)	\??\w:	xpajB.exe
File opened (read-only)	\??\x:	xpajB.exe
File opened (read-only)	\??\h:	xpajB.exe
File opened (read-only)	\??\j:	xpajB.exe
File opened (read-only)	\??\s:	xpajB.exe
File opened (read-only)	\??\v:	xpajB.exe
File opened (read-only)	\??\y:	xpajB.exe
File opened (read-only)	\??\k:	xpajB.exe
File opened (read-only)	\??\r:	xpajB.exe
File opened (read-only)	\??\u:	xpajB.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
22	raw.githubusercontent.com
2	raw.githubusercontent.com

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	WINWORD.EXE

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files (x86)\Common Files\System\ado\msado15.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\kk-KZ\PAD.Console.Host.resources.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Infragistics2.Win.UltraChart.v11.1.Design.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe	xpajB.exe
File opened for modification	\??\c:\Program Files\VideoLAN\VLC\plugins\audio_filter\libsimple_channel_mixer_plugin.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Northwoods.Go.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.Printing.resources.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\msvcp140_atomic_wait.dll	xpajB.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-localization-l1-2-0.dll	xpajB.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PROOF\msth8FR.DLL	xpajB.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-multibyte-l1-1-0.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	xpajB.exe
File opened for modification	\??\c:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.DataSetExtensions.Resources.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\WindowsApps\Microsoft.Getstarted_10.2.41172.0_x64__8wekyb3d8bbwe\Microsoft.Graphics.Canvas.dll	xpajB.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\goopdateres_ml.dll	xpajB.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\XLINTL32.DLL	xpajB.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia100.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\WindowsApps\Microsoft.VCLibs.140.00.UWPDesktop_14.0.29231.0_x64__8wekyb3d8bbwe\mfc140fra.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Forms.Primitives.resources.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.CodeDom.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\WindowsFormsIntegration.resources.dll	xpajB.exe
File opened for modification	\??\c:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Web.Entity.Resources.dll	xpajB.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationTypes.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\msolui.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	xpajB.exe
File opened for modification	\??\c:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Web.Entity.Resources.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\stdole.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppvIsvSubsystems32.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\PresentationCore.resources.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Controls.Ribbon.dll	xpajB.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Entity.Design.dll	xpajB.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\msvcp140.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_hevc_plugin.dll	xpajB.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\concrt140.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-environment-l1-1-0.dll	xpajB.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-namedpipe-l1-1-0.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-datetime-l1-1-0.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\TerminalConnection.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\x64\msvp9dec_store.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\VideoLAN\VLC\plugins\video_filter\libvhs_plugin.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Parallel.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\VideoLAN\VLC\plugins\audio_filter\libparam_eq_plugin.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Services.resources.dll	xpajB.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\ado\msado15.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.NetworkInformation.dll	xpajB.exe
File opened for modification	\??\c:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Web.Entity.Design.Resources.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\WindowsFormsIntegration.resources.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_rgb_mmx_plugin.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\OUTLFLTR.DLL	xpajB.exe
File opened for modification	\??\c:\Program Files\VideoLAN\VLC\plugins\demux\libflacsys_plugin.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\Microsoft.VisualBasic.Forms.resources.dll	xpajB.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\msedgeupdateres_ja.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-process-l1-1-0.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\Microsoft.VisualBasic.Forms.resources.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ValueTuple.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Management.Instrumentation.Resources.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\ReachFramework.resources.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Microsoft.AnalysisServices.Excel.BackEnd.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\VideoLAN\VLC\plugins\audio_filter\libstereo_widen_plugin.dll	xpajB.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\msedgeupdateres_fa.dll	xpajB.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONBttnIELinkedNotes.dll	xpajB.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroPDFImpl64.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\Microsoft.PowerShell.PackageManagement.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_x64__8wekyb3d8bbwe\SnippingTool\SnippingTool.exe	xpajB.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 4 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\CrimsonRAT.exe:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\MadMan.exe:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\xpajB.exe:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\AgentTesla.exe:Zone.Identifier	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xpajB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AgentTesla.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AgentTesla.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133750612570370308"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	AgentTesla.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	AgentTesla.exe

NTFS ADS 5 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\xpajB.exe:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\AgentTesla.exe:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\CrimsonRAT.exe:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\NetWire.doc:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\MadMan.exe:Zone.Identifier	chrome.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
3880	WINWORD.EXE
3880	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1952	chrome.exe
1952	chrome.exe
3660	chrome.exe
3660	chrome.exe
3660	chrome.exe
3660	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1356	xpajB.exe
4032	AgentTesla.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe
Token: SeShutdownPrivilege	1952	chrome.exe
Token: SeCreatePagefilePrivilege	1952	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe
1952	chrome.exe

Suspicious use of SetWindowsHookEx 19 IoCs

pid	Process
1952	chrome.exe
1420	AgentTesla.exe
4032	AgentTesla.exe
3880	WINWORD.EXE
3880	WINWORD.EXE
3880	WINWORD.EXE
3880	WINWORD.EXE
5004	OpenWith.exe
5004	OpenWith.exe
5004	OpenWith.exe
5004	OpenWith.exe
5004	OpenWith.exe
5004	OpenWith.exe
5004	OpenWith.exe
5004	OpenWith.exe
5004	OpenWith.exe
5004	OpenWith.exe
5004	OpenWith.exe
2696	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 3952	1952	chrome.exe	79
PID 1952 wrote to memory of 3952	1952	chrome.exe	79
PID 1952 wrote to memory of 3792	1952	chrome.exe	80
PID 1952 wrote to memory of 3792	1952	chrome.exe	80
PID 1952 wrote to memory of 3792	1952	chrome.exe	80
PID 1952 wrote to memory of 3792	1952	chrome.exe	80
PID 1952 wrote to memory of 3792	1952	chrome.exe	80
PID 1952 wrote to memory of 3792	1952	chrome.exe	80
PID 1952 wrote to memory of 3792	1952	chrome.exe	80
PID 1952 wrote to memory of 3792	1952	chrome.exe	80
PID 1952 wrote to memory of 3792	1952	chrome.exe	80
PID 1952 wrote to memory of 3792	1952	chrome.exe	80
PID 1952 wrote to memory of 3792	1952	chrome.exe	80
PID 1952 wrote to memory of 3792	1952	chrome.exe	80
PID 1952 wrote to memory of 3792	1952	chrome.exe	80
PID 1952 wrote to memory of 3792	1952	chrome.exe	80
PID 1952 wrote to memory of 3792	1952	chrome.exe	80
PID 1952 wrote to memory of 3792	1952	chrome.exe	80
PID 1952 wrote to memory of 3792	1952	chrome.exe	80
PID 1952 wrote to memory of 3792	1952	chrome.exe	80
PID 1952 wrote to memory of 3792	1952	chrome.exe	80
PID 1952 wrote to memory of 3792	1952	chrome.exe	80
PID 1952 wrote to memory of 3792	1952	chrome.exe	80
PID 1952 wrote to memory of 3792	1952	chrome.exe	80
PID 1952 wrote to memory of 3792	1952	chrome.exe	80
PID 1952 wrote to memory of 3792	1952	chrome.exe	80
PID 1952 wrote to memory of 3792	1952	chrome.exe	80
PID 1952 wrote to memory of 3792	1952	chrome.exe	80
PID 1952 wrote to memory of 3792	1952	chrome.exe	80
PID 1952 wrote to memory of 3792	1952	chrome.exe	80
PID 1952 wrote to memory of 3792	1952	chrome.exe	80
PID 1952 wrote to memory of 3792	1952	chrome.exe	80
PID 1952 wrote to memory of 4780	1952	chrome.exe	81
PID 1952 wrote to memory of 4780	1952	chrome.exe	81
PID 1952 wrote to memory of 4020	1952	chrome.exe	82
PID 1952 wrote to memory of 4020	1952	chrome.exe	82
PID 1952 wrote to memory of 4020	1952	chrome.exe	82
PID 1952 wrote to memory of 4020	1952	chrome.exe	82
PID 1952 wrote to memory of 4020	1952	chrome.exe	82
PID 1952 wrote to memory of 4020	1952	chrome.exe	82
PID 1952 wrote to memory of 4020	1952	chrome.exe	82
PID 1952 wrote to memory of 4020	1952	chrome.exe	82
PID 1952 wrote to memory of 4020	1952	chrome.exe	82
PID 1952 wrote to memory of 4020	1952	chrome.exe	82
PID 1952 wrote to memory of 4020	1952	chrome.exe	82
PID 1952 wrote to memory of 4020	1952	chrome.exe	82
PID 1952 wrote to memory of 4020	1952	chrome.exe	82
PID 1952 wrote to memory of 4020	1952	chrome.exe	82
PID 1952 wrote to memory of 4020	1952	chrome.exe	82
PID 1952 wrote to memory of 4020	1952	chrome.exe	82
PID 1952 wrote to memory of 4020	1952	chrome.exe	82
PID 1952 wrote to memory of 4020	1952	chrome.exe	82
PID 1952 wrote to memory of 4020	1952	chrome.exe	82
PID 1952 wrote to memory of 4020	1952	chrome.exe	82
PID 1952 wrote to memory of 4020	1952	chrome.exe	82
PID 1952 wrote to memory of 4020	1952	chrome.exe	82
PID 1952 wrote to memory of 4020	1952	chrome.exe	82
PID 1952 wrote to memory of 4020	1952	chrome.exe	82
PID 1952 wrote to memory of 4020	1952	chrome.exe	82
PID 1952 wrote to memory of 4020	1952	chrome.exe	82
PID 1952 wrote to memory of 4020	1952	chrome.exe	82
PID 1952 wrote to memory of 4020	1952	chrome.exe	82
PID 1952 wrote to memory of 4020	1952	chrome.exe	82
PID 1952 wrote to memory of 4020	1952	chrome.exe	82

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/Da2dalus/The-MALWARE-Repo
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc2741cc40,0x7ffc2741cc4c,0x7ffc2741cc58
  2⤵
  PID:3952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1800,i,6567659197273617362,18129294177542479159,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1796 /prefetch:2
  2⤵
  PID:3792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2072,i,6567659197273617362,18129294177542479159,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2096 /prefetch:3
  2⤵
  PID:4780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2168,i,6567659197273617362,18129294177542479159,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2476 /prefetch:8
  2⤵
  PID:4020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3080,i,6567659197273617362,18129294177542479159,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3096 /prefetch:1
  2⤵
  PID:2036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3084,i,6567659197273617362,18129294177542479159,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3132 /prefetch:1
  2⤵
  PID:1528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4524,i,6567659197273617362,18129294177542479159,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4496 /prefetch:8
  2⤵
  PID:4196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=4708,i,6567659197273617362,18129294177542479159,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5048 /prefetch:8
  2⤵
  PID:1844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5132,i,6567659197273617362,18129294177542479159,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  PID:2300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5388,i,6567659197273617362,18129294177542479159,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5396 /prefetch:8
  2⤵
  PID:4008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5268,i,6567659197273617362,18129294177542479159,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5016 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:1684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5096,i,6567659197273617362,18129294177542479159,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5252 /prefetch:8
  2⤵
  PID:1924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=4512,i,6567659197273617362,18129294177542479159,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5564 /prefetch:8
  2⤵
  PID:4720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5068,i,6567659197273617362,18129294177542479159,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5768 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:2520
- C:\Users\Admin\Downloads\xpajB.exe
  "C:\Users\Admin\Downloads\xpajB.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5456,i,6567659197273617362,18129294177542479159,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=736,i,6567659197273617362,18129294177542479159,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:3236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=5948,i,6567659197273617362,18129294177542479159,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:1632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5952,i,6567659197273617362,18129294177542479159,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5084 /prefetch:8
  2⤵
  PID:4416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5984,i,6567659197273617362,18129294177542479159,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5592 /prefetch:8
  2⤵
  PID:1684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=5512,i,6567659197273617362,18129294177542479159,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:4996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=6040,i,6567659197273617362,18129294177542479159,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5980,i,6567659197273617362,18129294177542479159,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5548 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=6056,i,6567659197273617362,18129294177542479159,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5036 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=3164,i,6567659197273617362,18129294177542479159,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4996 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=3076,i,6567659197273617362,18129294177542479159,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6236 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=6384,i,6567659197273617362,18129294177542479159,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5288 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:1660
- C:\Users\Admin\Downloads\AgentTesla.exe
  "C:\Users\Admin\Downloads\AgentTesla.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --field-trial-handle=6140,i,6567659197273617362,18129294177542479159,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5876,i,6567659197273617362,18129294177542479159,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5108,i,6567659197273617362,18129294177542479159,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5532 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3104,i,6567659197273617362,18129294177542479159,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6636 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:1660
- C:\Users\Admin\Downloads\CrimsonRAT.exe
  "C:\Users\Admin\Downloads\CrimsonRAT.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:436
- - C:\ProgramData\Hdlharas\dlrarhsiva.exe
    "C:\ProgramData\Hdlharas\dlrarhsiva.exe"
    3⤵
    - Executes dropped EXE
    PID:1728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3188,i,6567659197273617362,18129294177542479159,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3200 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - NTFS ADS
  PID:2012
- C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Downloads\NetWire.doc" /o ""
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:3880
- C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Downloads\NetWire.doc" /o ""
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1520

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:2360

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3492

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3688

C:\Users\Admin\Downloads\AgentTesla.exe
"C:\Users\Admin\Downloads\AgentTesla.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4032

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5004

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip.dll

Filesize
99KB

MD5
956d826f03d88c0b5482002bb7a83412

SHA1
560658185c225d1bd274b6a18372fd7de5f336af

SHA256
f9b4944d3a5536a6f8b4d5db17d903988a3518b22fbee6e3f6019aaf44189b3d

SHA512
6503064802101bca6e25b259a2bfe38e2d8b786bf2cf588ab1fb026b755f04a20857ee27e290cf50b2667425c528313b1c02e09b7b50edbcd75a3335439c3647

Download Submit
C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_elf.dll

Filesize
1.2MB

MD5
46c2610b3f04acfac21673440b48bf2f

SHA1
c9c21a31bb85ccae9bd708c8ccbe4a27f3fb3cb6

SHA256
4ed88f3846fb9f4ae69c281aeb84be9f35bf6467752a9728f0d0df745ef59bf8

SHA512
37321516b29ed2ffe825ad1f6ed2726bc3268ad83d6aee4130a3651bea5398d43d2b2f79bb24c4308de3097262d07f2e22889977be7d1243677e2acba9ef8414

Download Submit
C:\Program Files\Google\Chrome\Application\chrome.exe

Filesize
2.6MB

MD5
f2e161162def9b01d0da016d5f1d8c72

SHA1
7240449024e742ba6ba39de5885e9bd290d8ed31

SHA256
f7c1b79bbd7fd294b948871fa7d6130caadf101471cb4d69185cd0e7103a1b10

SHA512
3bbd85522d70f5aaa02eab07a23da47ab6f36e06deab8a5a9ea63557c96fb41bf3d16c62cabcdddcb458a442754228f69532db376df5260d004547484e067758

Download Submit
C:\ProgramData\Hdlharas\dlrarhsiva.exe

Filesize
9.1MB

MD5
64261d5f3b07671f15b7f10f2f78da3f

SHA1
d4f978177394024bb4d0e5b6b972a5f72f830181

SHA256
87f51b4632c5fbc351a59a234dfefef506d807f2c173aac23162b85d0d73c2ad

SHA512
3a9ff39e6bc7585b0b03f7327652e4c3b766563e8b183c25b6497e30956945add5684f1579862117e44c6bac2802601fc7c4d2a0daa1824f16c4da1fd6c9c91a

Download Submit
C:\ProgramData\Hdlharas\mdkhm.zip

Filesize
56KB

MD5
b635f6f767e485c7e17833411d567712

SHA1
5a9cbdca7794aae308c44edfa7a1ff5b155e4aa8

SHA256
6838286fb88e9e4e68882601a13fa770f1b510a0a86389b6a29070a129bf2e5e

SHA512
551ba05bd44e66685f359802b35a8c9775792a12844906b4b53e1a000d56624c6db323754331c9f399072790991c1b256d9114a50fb78111652a1c973d2880af

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Filesize
64KB

MD5
b5ad5caaaee00cb8cf445427975ae66c

SHA1
dcde6527290a326e048f9c3a85280d3fa71e1e22

SHA256
b6409b9d55ce242ff022f7a2d86ae8eff873daabf3a0506031712b8baa6197b8

SHA512
92f7fbbcbbea769b1af6dd7e75577be3eb8bb4a4a6f8a9288d6da4014e1ea309ee649a7b089be09ba27866e175ab6f6a912413256d7e13eaf60f6f30e492ce7f

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Filesize
4B

MD5
f49655f856acb8884cc0ace29216f511

SHA1
cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

SHA256
7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

SHA512
599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Filesize
1008B

MD5
d222b77a61527f2c177b0869e7babc24

SHA1
3f23acb984307a4aeba41ebbb70439c97ad1f268

SHA256
80dc3ffa698e4ff2e916f97983b5eae79470203e91cb684c5ccd4ff1a465d747

SHA512
d17d836ea77aeaff4cd01f9c7523345167a4a6bc62528aac74acde12679f48079d75d159e9cea2e614da50e83c2dcd92c374c899ea6c4fe8e5513d9bf06c01ff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
34c7fe595c19d988f5ba901a005cbf3f

SHA1
532b8e5a579ad0c854bb8201cc416134acebdee8

SHA256
9acc1c0908c1c8773c71ff1c7bdeb947db228ec8cb3b7592d23b757e39b237cf

SHA512
53a85df5d878d781a670856d71d1a178c662d423b325ba09b9b0bbe36fbe8903fd8f0a5c07eae0bb0e01f5a2e3f602b0d8da86439f66f02cce1fdd6470ed548a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006

Filesize
20KB

MD5
07c1b97de5c54707533eab8d854e8f6d

SHA1
c7c17005580c6ffa276c9fee6015406364169f0c

SHA256
c290fd85b8d55d003ce348e1ad178d37d1744293f42981d093ffc44c2e0cb517

SHA512
3b470051fa2d6745b7b7df855e2acb169e85ae6dbad91a002530d8194b27ffd06f5916b00ae20c7863ba88588eb70ebb2c31e2a34b86bd0206177df301feded2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000009

Filesize
37KB

MD5
c130e937317e64edd4335e53b17d55a2

SHA1
51bfff9dee11ab5a8c43198c0d6178799ed9433b

SHA256
46025a134ebdd6c6464ff422818e60938fc41af735f7951f4febe29f57612a49

SHA512
68e5fa69101a7347028ad30d7c004dafabcbd8f8009df90d0471b19a36741075d72da56a2b1693c2067902630584bda5536f0702302db5d69f407424d4a964de

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000a

Filesize
37KB

MD5
c67ee59476ed03e32d0aeb3abd3b1d95

SHA1
8b66a81cd4c7100c925e2b70d29b3fdbd50f8d9b

SHA256
2d35ec95c10e30f0bddbfb37173697d6f23cd343398c85a9442c8d946d0660e3

SHA512
421d50524bd743d746071aaad698616e727271fdf21ee28517763a429dcb6839a7ad77f7575b13c6294dc64d255df9b0a64eb09c9d3b2349fef49b883899d931

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000012

Filesize
19KB

MD5
9dd51381eaadf36afdba7b1f41d90ef6

SHA1
ea9230192be07b2ad8e461dc80c40825bdc15f86

SHA256
bff9573716707c999e035eb65bbdb29a40d3a09b9d891527ddaf7bba7878cb7c

SHA512
a25f7ae307b378411b218d62095c0cea856e8dad984fb552286f0c113bf44639e4ff7d4ace52c79e3ecae5b053394a85d4677b12038dc7d22ae83aade9e9f990

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000014

Filesize
18KB

MD5
4c0f15551756feb9279a9bf4412eb91d

SHA1
8f600a283437700d94d2ac0f5cd844eef8f99a59

SHA256
a8ea6ec3e758f2282974186b6a43cee788b0605a1a667c779fdbfad644019770

SHA512
ade32de6fe69e0865566a07124178ca8b23d74f55dd51792d1f82e2e4abdea66ecf1aa84c95173ab0edaf4b88465d0179aea62004c2b05fcfee497f406be4614

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000015

Filesize
62KB

MD5
ada422bd40edee3bbe9b406f0d294ae4

SHA1
24b2ec64b9614016915964c80eeb4165c2cb34ac

SHA256
d405bb5d067e241b7180ef010926abb1618d0aefca12616515c3bca475626d48

SHA512
25359e4ec33ce010cbaf925c400c03031f20a08c9f79ed42406e89425389ee313d4e81e8c132ea44b60232288779212718326f111e8d698850fb86029d40f916

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
a41a2166425b57cc5354690ad3466f6a

SHA1
f6c7ba0ccd8e647e146d38476d66826ffa20d56f

SHA256
f6e373f98941938f8afe480c962cb53b06578b383538613397df2f52c774e461

SHA512
a93ed980e8846f6c2bba784ccb9dd34959b1bdeeac19e38154b1cb4fe83dbcd07a61c5c6d880660f4b6ee13ebb68e19ee004c76d5696bda67f31bf53af9f13a2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
99d41bd5d544e384aa253b7e109dcd3f

SHA1
a9e2de83eb3baf6d3eb36d63347e1bcad338de7c

SHA256
6a726d3489a0d0e5b759a0c3940c72b50ad211f1ee579234a7baac8066aac036

SHA512
52ebfe07a8a456cd739dee6a9206eefc28d3cb30516b291d7ca8374e5ce6be913d4d64e735e245dd87b6f9dfd02f44672bb42671c95f199161b8b6f7b2c22605

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
90ccdf32100f65e6cc146950da560831

SHA1
6c341748c0f4c847c2eb1b3a8c7b0548eeffcbfc

SHA256
26c131b5b1e2fb42f2a421ed0c8e7135d0eaefcaa03ee61931dd112f934833db

SHA512
01bcda2b5452970514e71415712cdbcaf2243f5ddbcda08396ebba2d184b08f2b43342dc099d7a1bfe63b802e54d8a81c731d49be83b1f76d31b9925ab22269f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1

Filesize
264KB

MD5
0f683a21a9e950d10e9e6115667a0c81

SHA1
a68e9d2bb5deb3ee7c80d88367a548e8208586f3

SHA256
7a04a3ff1c0f3ac644ef81b433f1e4a2549e0a8561b4ddad5942c65d95a087f8

SHA512
6a34dad31247f0d4b6ddb98897d5fcc9005afeb2da5871287f05cf309dfd4a7bb834d619b5d6abaa36eb53cc452fad549717803ef72926fcfbd933df66ab458b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\456ca0f1-e1f3-4bde-bd22-80c93c4f1a0b.tmp

Filesize
3KB

MD5
b74608518a2b6f1c0575a8a47ad8b7d1

SHA1
29b072c15bd80dc35ac74f47e104b4f400ba9682

SHA256
b552d9b3751fce81be2adadc6c6640c2e5e734d8ccc337acbf1092d251405cdd

SHA512
c0705ae8dccc10fabd5c0a896cd92dfa377cee4ccb569e7017c3cbba034a332c181da0e27c1e1f3b24ed158ceaaea7a3a83fa4d762d403fad941dcd70ded0613

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
5KB

MD5
d37d4c1ff8d5abe9be93f80a30ed6fd8

SHA1
4337d79815a7a3eacdc7ab5c4bc47d2231708804

SHA256
0dc6f8da937deb16dd4009c6a33cdd1783eff9ad0683991fc9591e511a0c7d06

SHA512
480534c1f886d9c81fee3ddf913fa9aa2f8cf4c3ac6a73756f27a097a16423781ebce071c9f8c7852fc879d9bf7209bbc19ab522c04b3baee7fa40429fd20ddc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
5KB

MD5
6ed54944b5eecdcf3abc6607add04060

SHA1
ddc0eb2d18ddac4ce175fc23098ca35bce08573a

SHA256
03a071b7298f813810e4ed6387c6a6fce81b7800652fa1f464b7d02a224c486d

SHA512
e569a6ee6859787947846479bdd3b62684717b34950c60581d039f758496932fe6d42e4306bc00dd9cfcfb5f17a25a21a712b6068313e573ee728474aded7624

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
be543f47666a486dd3104fe70658557f

SHA1
967d45ef00c00b23990d0b121739c6232fecfc13

SHA256
608e9e55cc86b5bfcb70e65af0a6451c3ae2fa8a9d73e3696eb1be2beb56f024

SHA512
bab423e6ab2396efe21977471986d6a60f7fb3ba50ae02e0bb6ccbd69ae84a8096c18aec7576fa205e1a019d42956d7b384e83721fa8c3ca57a4461e83903766

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
80dd1049a551872ab15330f53d4da4fd

SHA1
c4172a961354983a2cea5e45bda16c75618d9f25

SHA256
1cb187e5dc9fae68d9ad7744a76a6908594475636b29bc8ea08ad5d53d4b1f13

SHA512
d441abcf6a5c26a312a5abf6a3145981d6ccc896fd8aae31b09d3ceb1154d0c0881f7a15181e31893dc2d044b114e190e68fb5683654fbff0d88e18ab4acc90d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
cc813af7e5016774134dd5c2847547ec

SHA1
4d649485817ffeaf48e171de31d7d9e6d3bc9d61

SHA256
9798f7cf6c58c1bf9a2c62abced5dca4f5fe29408798a3cfbb84af4e8c157f4a

SHA512
d9b761953c07f0ace1be243c94922a55be21b51d2427e39fe0c7e46c5c21c26012ca9edaea813a6b58166355c1765377b253541b0810924e88b55b9977fa1dfd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
05d5a8f208cce89751c05ccbc218f7d6

SHA1
656c3717c12b0d874370ae8c686e036dd1b99d36

SHA256
c76dd64394185981adaff0ad2c65a33f86099445d2c7aa1a5ae93f43b1c39042

SHA512
819a9d09d93ca6af02cf3246272ed916cf74840fcb87c651d6dcd0b55bfcacef7b6eb611487d3574c1facd352d0e68915f254ea7a8bda581f2bde3fdcce77057

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
fbfc4d470db5a53823bb652d36d31850

SHA1
e5ea6db96f114925abd7331bd983d36c113829c4

SHA256
e56af0f876fdce8a180085a81a1afb2d20ca11cb0851d7a5f9605703bf0211dc

SHA512
7beebc01b63a81de66ed85f30e3285ce0d8ff87efd605b4bdfbd3b51c455bcc09631ae9bb44aa2e548dc41a7f88eb6e082cddd4f77e1822e7f5b495ba7146eef

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
2e198684c4932727cd299d88fc90fdb4

SHA1
52e738193b843f9351e15b620007bd4256a9756d

SHA256
ba42d75626238f0e94406cbdc79014b924518161ebe4509ebc09bde06faf8b99

SHA512
622fd23e10304ea1e1dfad4c082ccf4605d3d89cb7a5baa826a40af01fa03ce5bd4397490e2693dcbc06b68cef2186f1a4a1f2ae7d7d29c6fc101ba5e70fc409

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
cce7c2e0386779b84c4cd4fff2c87bc8

SHA1
ae180be3860c400624bb5af262c16a79b1856d06

SHA256
8f5b54c1ca1e55635cd440ea291cb1800c2f8151553ac6a5d6de941f42d52feb

SHA512
4af125e8470e09911b0216e497473b10eaaca609bced53cb06332a8ecb239e19f9e4e56632ffbd7d802df7f1024aca1739afe4e5d12e74031c30a0123ad69aaa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
ffd697f01317450c1bd784f90d7534fd

SHA1
508c75e4a5b7b752c497607d5087742681b4c3e4

SHA256
4a119de2df6f9bdad270ae808890d94f24cf02cb10382bad5615f7f40d3a8a32

SHA512
e77ad82a0090388b6f0be31b9070743ee56f5a2981870462e6a36eda46c3dd06e071556930fd65b6ad4f93677dd03bc5bea6d40e57ac2019145a16de10c633c8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
4489f2bf783a7ec6bc98a009df9704a4

SHA1
ab0cd68523e71730f5768fcd9b974bf58401a420

SHA256
b1cf92e7a8b15f73b22eb160ba87fd373bd77ad242df3ebd83105a5c090ef8b7

SHA512
53d0c3b2438b5dfa663ba28ef7ae3e8b9fec294faf1ebadcc1b7f16e1900aa1501bb22e4358e2198b81429c0caba8c7f54b363b4bb5219042def6f862730a597

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
9c4e0c2a7b039be4490d593f2a0d111d

SHA1
e046231ab84ea3a8e9b3757bd2af273ddc8da5ee

SHA256
40135aad09bc45a03bad90cdeae7821d177a94ee4bc3672fb029f36e709c8be3

SHA512
fce3ec82a55320bf5927411e8855607e4c9bb2f69de14cf9c70cec6a20a4e7df935f50ed0d3cce18b7fa448603a1b7f0a5e82fc569a81f5ccede74e3a8938798

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
67878006b72c74d34352b74b96809c32

SHA1
62c600fe5cabbd5061c5edf3726c12b394e80afc

SHA256
41cc7548e038ae3e5962c4f226f512e9a3d2a7c3f4ad7474657559e1be13aabd

SHA512
17a6ecf95c8ff580c83da174741dc5bcf25cf0814e724b3e9b9f6e0cdf60f91368f2d879d9a3049997a50ad979237c8fc35df43a2a3943d58321e0e9cb67d089

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
f76cbfcdabe2aafc97646dce65069fdf

SHA1
306649c16ca8a949611942be8a5614f20527b688

SHA256
a3689ed6259f224ada0d540674b87a1c3ef73d0d7d44da8ab0f354968d32f9ec

SHA512
56006d1356907d2d6685e3a5f8d1423d48d3d4b6ad9c62dcf3ad1503b070058e309a1f5fda53d50f3ac2b5ab8fac2a229382bfc07c7540490ed7ed301c1e3c1a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\aa0cf22b-31ba-4e89-944c-db5729a73963.tmp

Filesize
5KB

MD5
eaedc70d934b822d3819d14bd8f50c96

SHA1
ec2128cb2daa59c234821e9609a0afe42edbf883

SHA256
3cf4983ae30d92f12b0a47afece76c322a1aa95b36507e28be912b4f7bd6add2

SHA512
f978ee660e17557323fd5921bfbe808129600c99d74d4b66159b82086b5fb83cc4711e06543b80f867850b9306bac8374106a56689a0ddf6204c3b7d40b1d46e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
96c1a0ba3d1eb9a0796ed397c1b4191d

SHA1
2f0ebc3e9efff89d0d39e21a77a7d99ad9c9e95d

SHA256
4dc856aea3ea5fb4fd2259288ae7b0638bf150238e5b4396a00c3e684403b9ce

SHA512
c1e220b92d4c947d9686bbd962b0f3dc40d695bde7c56be6c2dd44041a8bbaa9ec349c4226eb6fbb09813511b2a75768c3cb6cee3febc2c1f20e6c39326ded0e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
a011cc70a868cbdf4c6de177602e85d5

SHA1
b528a2da6d70c5eb8f0cf470e6c4813737e9b8d0

SHA256
9a1b984f6e8dbb24e059d95210e9e641f7bcd512ad9237a70f2059b25b117b73

SHA512
52b4f9705aa0eadaa5ddd8e1946301efb6fd22469102b658e30e46da32130940087b682171fd68628847386aedcf3d4a57ce1df788d3cd26937c201007c8102e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
ff48098f45e142fc2175ca1d8ded0391

SHA1
0db1ee0843de48069c8fd1b8e00865cfdb8a4903

SHA256
2493b872b5d1044c273bdf8078ab1b23668f2ee42dca7494fde9d971d7ab8c9b

SHA512
5a455570d8b1c0a1bb249d008d47c2f50a694cae4f34ed967bc5927a2dd2eac1899ddfb9f0828f3f313c95db05775338a337fe531d57d0ecd953161179bcd7ba

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
406d8a0d205c8e3abc0cc121769a45c0

SHA1
31b7f3be9fcacef6ff6f1cc4171fac8603a643bc

SHA256
af005d4faacd48feec0e29631cbbc220e16e769152439b5ea90422e0375e52b6

SHA512
7732ff48ffa34da44717dd9c5603929ba6347cf7fe23ddbf2adaaa82a19b9a751b07ca601770763525164b1c6ebf6b437ca12ebb6d8c542d680acf3bb91c997f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
432565069e5cb81976d7ddb382fabe83

SHA1
6d03f4fb6149a76c6c874c061a1ddf206124c1f3

SHA256
b8b4ca6651141ff9fa1e5740afb274786c143be2add25f85f51b2874eb30a10c

SHA512
994f379f65869b5da4a0b330746b713bdeec4f26f81163787853058e32237dc700330046aa3b1173ad74721134d46700ec528fe3dfcf4d2ecbe2c6e06aa505bd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
db26ff8bec37283b40a2d74454eef327

SHA1
15d9e04d1ec749b9cd76bf2c66ad197fbc46469b

SHA256
532e076d4e5e2b148a7ba3ae95d02cdf62020afcebc25ee2f2cefef794b10356

SHA512
1ccfcafb8700158d77120c6255654c0c0ffea242a98abdd26d0c46e603ec016bbeb6936b01a483423232fe133ea9d899cdd6b5e54b2764d2f8d9d6ab4bb599c4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
187c3bbf2245ba138e866a444b3b5b3a

SHA1
b282ac9045d6209366a1cfc980c987e988bf3436

SHA256
3c119502f0eeb703a5af9f0606e90db05397922067ca512f3ae23ed290fcc326

SHA512
86ba0e94a721231c69888bef522b00ccc939354fff9d91069c042debfce78bac0624c7ad813c9b2c97f2a9f209a3bb24bd06642b182888dff9c0b8287886a3a1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
c3838ed7282744a71b2ae5ed9e33994b

SHA1
58cdcac4360abe919353c747992c472d86a85163

SHA256
27bc75e2ce55e1e333cc1981576f5915b2a0281d88d944af4cede6aedee869ff

SHA512
2bc96387bd719c38be73225e97dcee5dd46e3243dd737b3b2ba2182fa79d7332108bdf35201520173d8fc4ac5f2934714fd6251254200b0e089ea41008aa8e01

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
5a224c643717c3502176008606c040f5

SHA1
554fa090b514e286e8a28c29e3cd837499199769

SHA256
32dcf8576156349ccf907f73865281c5ca77ce8ef231a5a6ca2d8b7fce9732df

SHA512
9ecb154066388292adabf5ab04e16aa6852bc558ee76f9ce49a50ce0b0995bf6dbf7ce43e6f6925a52beac7d3f783d3428713aeaf1e30cd74ae233ab3429127f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
c277337f5c495ed4b737c7a4754cb755

SHA1
79c6d48779a110a620bdb4436313d396d3b8955b

SHA256
f53abdd43bfa2f48a8ad5c5d12845e77b08f0b2ce0342f7c42c4f59a0c65e4eb

SHA512
e7afc64f32247843f8aaf0ef2b14417e1f2db4b97306648c35c70b2d4bfaf37d1854810d054f2513bcac734180dc3585513bf9ca381d232b3c90577a32042596

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
10c5fc19e6ce1d09f8501bf0bdb3f5fa

SHA1
a6900ccd06e19d0ceef5e63aaaedc74ed2621399

SHA256
6dc4b52de5865f52c18b66f3f50871822654ecaf3fafad11c3ecea5422dc96fe

SHA512
5b3773c813ad40942b758a8c89a4602d6479bb8a7e3be3c40303b1fc1623ec6d1bd94eab586b6a61e774b1dcbd34d92e5767d432550eee354f0c2f11d87ffe95

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
51c8882eb8f907167136f2e689947224

SHA1
7da79bf10ccc49a1a36ee449dbbc27558f154cb8

SHA256
730afea0878d0986a0fddc496afa0bc3f9787379bf379e5847cc728fcac844ae

SHA512
ee18df58dac6a4817359cbcba22bce63f8c13d1b093db6db5dea56601a320075a8253fe7fd6e0ed332629ed2db8a216889bcd62a54da6e053ca5d00df8b1aafd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
5f026a4a8124354122410434cc19eabb

SHA1
a7c7258084eaeccdc40af03847e01638933c6de2

SHA256
6b4cf356ca745c030a14fcdbfd27a79ccb4bc32e99a35db0a1135df2cde0a7a7

SHA512
a8cd135d7832861d496b242fe8d839d305fe72deafb063f005126323eee1d0b0d42abfac6cc9484db851fc3a0a9d6d6303fb52127fe15d6d882b62cb9121291c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
ab7ccff84f1f3bbf55cdef00ae6e74c8

SHA1
95639895d65c11b63ba051dfdf97289c13676283

SHA256
9ecb81c7a041a308b825d645bcf0f9486df9d6da70d41fae342de6e12b83ece7

SHA512
4cd872a72d15d3a83e8e230fdb7efe716965a993809a702962eeeffd588fa839fc0edac79b95d7f1615770aa754d370f01bc2d59f7ec6e08f100190f2e13d3b7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
f8e3a4145bf38be034710d1e87135fdc

SHA1
5546efab2de4931e4d5bd4a64386aa4c327f15ea

SHA256
d2d85db0d8262cef19304ff0cc255c6021b9077bab7dbda9f15c522262e4e5b3

SHA512
508d53630d72050a8f134b71926630b68e77bcc037a638af06b8235f19025e68a9e43272e19518d5b143d0d33cbbf177969741d17a5aac6649bf79f0cc95af19

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
576c548c9a2a5aa0cbaaa045771f153e

SHA1
4983aaf5b06cc68d4644a69e083bb6af00e2c215

SHA256
2db942fd6e93e1a239b754ca987bc2deda58240120f8cb95aa473fe8e4738ce9

SHA512
c433e6747b6b370b8bb002cd6ef76bb16ed87ab0c87576af5b6871362eba1bbfb676fbd6b6b1c9a247c566f3a82a4c10937a13b17088a30efef24dd814b0f80b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
4665dd1ae33de8d7cd4a9c3fce24f539

SHA1
c9616b10a8b847cddbf849a469862398310a1c5d

SHA256
e791cf23e1f2b64306f69194607c5e633f559fd7d85c56b063a39afc4ac05c51

SHA512
e46901dcd46a5a463f9456a310dc227e66eb49337adcf97b81f3de2c15dc2ebe6a18310cefa805afcc8f1cba31922f9f88bc5b0ab63b725ed87bc2d525ed2cda

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
b938df0f841e920b2490cfbb544c9529

SHA1
fb60aad581cc827cf98e22a7d21001f0ef369299

SHA256
92838cc8b43b5d9aa8eba621e20c75baf763187a58275c5d803dccb2d5b8f12a

SHA512
313d8a01e44d811ed2fb766783e044b522015dacd2aa24008e39bcfa1282788936576202a80b4cf50a933d7919ea173f216ebb7681a1439ff26617898cfb9ca9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
dd00ef1535d89aa9bdad83f2953dda63

SHA1
09443bc61d24fed2fe1d8341597c73f0bea2ef97

SHA256
f458f3255777e981ef57f26f5a2d7617223edc4464c7f351b2f6fd1b3b6eee38

SHA512
f42be8e9ee4c91805b646f78578ff1e4cf1b0f203ad177a7b810488c8056d4e5482d7b721c89e030bff9b2b86de95ae4ea51d2bbaee79e1e175cd37c5e073c9a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
49ddc521591b651641d881db5b7d90d2

SHA1
d865a0e4903fb58307c2dfc512d73c37496f7e26

SHA256
4d69da9abc1c24b1e3c93fc8e869019c50b677b64fdcb9e4d9f27e6c466b754e

SHA512
9c86685a6b7b4f22dae510b5a074345ff040f7090474320e70c078407984ebb11b97e11b696c4daa14c31cb29d84c211bcafa4fb87532bbe8a41bc869d625da3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
6386f3276a8b2bb3dc1c14e4b9b77d86

SHA1
2115b4f6489237b05959b804b2cc752b6b550317

SHA256
57affa3762d77418987c37493711807e15141a2c7362c6e954edd0cfbeb38a91

SHA512
4d0ee08c9ed614f45188a625ff373f180de561f2bc2fa7fe4dcc57f17b1f0774e7e51ea784d7ba6cd5ac269edf82dc35a839d74b10b56e707e63760fc88ccd13

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
ac36556bd30639e33f2972e524704018

SHA1
f09dbd1a1d7ce66c2c6600b67188c9031c737de8

SHA256
f0ee1ae20e9bdb1ab68c8891750505dead0420a17e7a63d3544f8d0266b5beda

SHA512
ab5445763abe60be19532fb0486deea677d4d53759359264aabb75e45b5658c30c2a0b21f688ea4d642a02b385a5cb2e6529769ec69175bdf42201e9b1b531b2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
e1704a15e020596b63919bfb2799f570

SHA1
94fa318b7322ab57d3fa3cc47c4a82d938ef2064

SHA256
40d56e8c761e80078bc3a6466126e6cd41acecb1a0f54797d7c5dcce68fa5e9c

SHA512
4fb6516d0532769b9c847376f96c0e9e2678005a86c61bf33890e44305457a24eeebf54cbf0a248fb573ea1c990a0d81fc22ae146fcdba2c431d7272ec66ac31

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
b1424691215ba8e0ee8b945412b6d6df

SHA1
9dccef661367abbb4016d91eb02e7909604e8e39

SHA256
88d64ec7d50b07717ac07e5b42ccaf57708b7570e429fae6bebf045cc6db65e5

SHA512
5ba1604ab79e1c094265fe0f95d77ab8d19a66cb2eb411042ead736c263a75d06f446edf47a91c6c28ed3dba08bf2430bcdf196a936494d42448a19340b4aad9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
3c0246ed7c80bb8641aa76ec5654e0ad

SHA1
11e100f304d9c7b9d8b8e29ae5b4b1e4a000332e

SHA256
93b81abeb91139cf5397b1c9d2f7a8831e58879ebf3a790f571410084d19158b

SHA512
562e72c9780a884e46c7ef6e0e58d4aabfa73cdc95d13087fc6353726205157c648de60235ec1c42106cfb5deaf92a758641c31c79e35d0edb1a5e43611b4058

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
0932c2eb1c064b3d86ba0a1de984a3e4

SHA1
a659b7a6903cf587bf1a53ab98448ef38ba74fe8

SHA256
8f33c71fad1da86581b12b656a21c9eab3c755fa75fc6a937668916dbf0fcb4f

SHA512
48e9cdab8272126c9a06d369a65d59f29907aee9d60d01ca8dfad7ae21aaeda427e9b1de32f424652cb9a92cb736cead700b4bdaf3657e6035f9f69cd5cf9be3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\e46114f4-9c4a-46f9-ba45-c021bce9ea06.tmp

Filesize
9KB

MD5
098da94da1bc6d47b9a559aa5a43cd56

SHA1
21d46ab20d8894c17880f65390f216871c47877d

SHA256
b12f8cac8e0c5e78960d7c85f42469a09a37b63715322c100f80413ca6e922ef

SHA512
048201853a314d146da5b8fcd7d81779d28d90f3c6c8aaf7da478771a449ee13937bf8ae93f11cd3f2545222a0ea23f3fd6eb75295841d59f44f3dfc6b832fd9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
116KB

MD5
35b53e2fba0edbd16bb8647eb1ae2123

SHA1
5018333304d49ad929d0cf7b127798864254d89b

SHA256
5c40229ab9bd6e9d1c62b621481592c6945520cc1377c8579edc5128dc4eb69b

SHA512
81fa70a48628388d1af869445042bf31f475ef74bd0a8adbeab5b5050b28716c13c9a4427e63ef2a41e565f69fc971f329efdd955bf8ebf2057bbad889a9a080

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
116KB

MD5
6d87aa8f6bcb2c3c32b5d1ece706b4a9

SHA1
0d4bd8a14506a1f79abf60e0c9b7d54387295e4e

SHA256
d6f3963ad1a0b8b49714479746389a389f0172b9746aed9e78dd533d2da0f813

SHA512
b5e16e35c79a83375937bb40ccbc74dad01ded9b10ced36571b2fab3f3b3c5f32eb474feea053a87cbcb4d379bdc0f1a50fde07811ead3f99168a68590656345

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
116KB

MD5
7fb28c03714827e3e1ec097ab08349c9

SHA1
5be08b7bdc5cb49e27c3c690c19e9866932274d5

SHA256
c5b4181fc265403d398665907822de7379ba92bb073e3bf2bc39252fb2606512

SHA512
4002c247781605cf93cce5f5e5d1e387dca4d3960491bd605dbd026288ea51ce0c633f1ac259e7da9a54b8ebaee845be9407ec3ba0ba44dddb7d1e522f886388

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
116KB

MD5
25242a195fe51e0f3b452674d9c7c8d7

SHA1
78e65579add17692df2c38a1c233b11059797a71

SHA256
bd9aa72afa843c1e75c24024cd2bff077f27432f3b4ca9cbddf7d54647bda2ea

SHA512
3fdb3726a78f204c01cc011c47b42905f1cdfa253d530343ca2c7689230d990989ee0f443bf0c5b352cef930cec0bea21d6f3c17bca01d7b4262fc64a75db56a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
116KB

MD5
c462864968b349ab0581f55016646ce4

SHA1
d9d3880146d271e6e146e65aa0c71483ca9258ce

SHA256
19db2abdb3914d67aefe06413467f971d0d1fa32c255b74c88d1ff5d5c6b04f5

SHA512
7ffecc3032df0bad41817e2ce8a82416771cbb3d02da0c421f8e65038663df8981a884d51542345d352dba6461df8b34f133ed3f33e687ec5660c487c2097b85

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
116KB

MD5
e01a71643f1f152c33c68837ce7decc8

SHA1
dce4ef1b1f3e3d4d7905c4c22b1c3344d73b214f

SHA256
15414d1edd1e58ca3c52fc23982f9fb6c0c20058e0815086335932c2ec190885

SHA512
b104af24dc8f0ccc79a99cfeb61798b9e5211f76c7fe15e48f4a629e0b7e0b4f6408e83dcbea83adf41d5a656c333e4819949f8444a50b93d4841fafb429bef3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
373B

MD5
dd074ebb9a15f4c66b6b949972aca2a0

SHA1
6890c3059a98c8a4d38643d0f78eca299809ec7e

SHA256
bf60a894677a1c04032db64e7b946792f8d0e7693c82103dee48500457ff690c

SHA512
5bab1ed2f63f05c7a021335108f48f2e972d959017bba1a4a3e719b9560f6d386755c46f54619bb80d6644071b268eb1c4cafc2649da8e0b1fb8a7eed74e5ee1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
2KB

MD5
dbe743bd99aced0d129b86cfaf431937

SHA1
57b867a722f7447b63cb8b6cff38557076d0842b

SHA256
bda5e6e20c622a2e607225c2cabd36787ad7b2c8e49530f478cabfe89f5a5633

SHA512
0669c3a39bdd96277451c3d6fb86341608feff6c5ba5014e25a347ce225f5f4d0e3d62f2118b3664fc3a44313e1b712cade1d783b1cd5905dd8154cfa2da18cd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
3KB

MD5
49b2f6cf1f85348e1483213efbf9cb0e

SHA1
57ccecd43cad2e66b63810dbe73e657caa0d42ab

SHA256
6933059f5d125bf386195004f1955102caa34fea007add274edd32a19333594c

SHA512
2aa8a122c9d817ad9ac1d9817f327e211426003d03484246c184d54ada5b1dac922716b1f8aaeea6115027da72c06d2e1f545edd0c90920710d217ec3cf623c0

Download Submit
C:\Users\Admin\Downloads\CrimsonRAT.exe

Filesize
84KB

MD5
b6e148ee1a2a3b460dd2a0adbf1dd39c

SHA1
ec0efbe8fd2fa5300164e9e4eded0d40da549c60

SHA256
dc31e710277eac1b125de6f4626765a2684d992147691a33964e368e5f269cba

SHA512
4b8c62ddfc7cd3e5ce1f8b5a1ba4a611ab1bfccf81d80cf2cfc831cffa1d7a4b6da0494616a53b419168bc3a324b57382d4a6186af083de6fc93d144c4503741

Download Submit
C:\Users\Admin\Downloads\MadMan.exe

Filesize
2KB

MD5
a56d479405b23976f162f3a4a74e48aa

SHA1
f4f433b3f56315e1d469148bdfd835469526262f

SHA256
17d81134a5957fb758b9d69a90b033477a991c8b0f107d9864dc790ca37e6a23

SHA512
f5594cde50ca5235f7759c9350d4054d7a61b5e61a197dffc04eb8cdef368572e99d212dd406ad296484b5f0f880bdc5ec9e155781101d15083c1564738a900a

Download Submit
C:\Users\Admin\Downloads\MadMan.exe:Zone.Identifier

Filesize
55B

MD5
0f98a5550abe0fb880568b1480c96a1c

SHA1
d2ce9f7057b201d31f79f3aee2225d89f36be07d

SHA256
2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1

SHA512
dbc1150d831950684ab37407defac0177b7583da0fe13ee8f8eeb65e8b05d23b357722246888189b4681b97507a4262ece96a1c458c4427a9a41d8ea8d11a2f6

Download Submit
C:\Users\Admin\Downloads\NetWire.doc.crdownload

Filesize
7.3MB

MD5
6b23cce75ff84aaa6216e90b6ce6a5f3

SHA1
e6cc0ef23044de9b1f96b67699c55232aea67f7d

SHA256
9105005851fbf7a7d757109cf697237c0766e6948c7d88089ac6cf25fe1e9b15

SHA512
4d0705644ade8e8a215cc3190717850d88f4d532ac875e504cb59b7e5c6dd3ffae69ea946e2208e2286e2f7168709850b7b6e3b6d0572de40cfe442d96bba125

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 602721.crdownload

Filesize
2.8MB

MD5
cce284cab135d9c0a2a64a7caec09107

SHA1
e4b8f4b6cab18b9748f83e9fffd275ef5276199e

SHA256
18aab0e981eee9e4ef8e15d4b003b14b3a1b0bfb7233fade8ee4b6a22a5abbb9

SHA512
c45d021295871447ce60250ff9cbeba2b2a16a23371530da077d6235cfe5005f10fa228071542df3621462d913ad2f58236dc0c0cb390779eef86a10bba8429f

Download Submit
C:\Users\Admin\Downloads\xpajB.exe

Filesize
520KB

MD5
bd76fc01deed43cd6e368a1f860d44ed

SHA1
a2e241e9af346714e93c0600f160d05c95839768

SHA256
e04c85cd4bffa1f5465ff62c9baf0b29b7b2faddf7362789013fbac8c90268bf

SHA512
d0ebe108f5baf156ecd9e1bf41e23a76b043fcaac78ff5761fdca2740b71241bd827e861ada957891fbc426b3d7baa87d10724765c45e25f25aa7bd6d31ab4ec

Download Submit
C:\Users\Admin\Downloads\xpajB.exe:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Windows\BreakTart

Filesize
47B

MD5
081c6d16a42da543e053d56b41e011a4

SHA1
7c3b4b079e17988aef2deb73150dda9f8b393fdc

SHA256
7a4a7fc464c0e33f4959bbfad178f2437be9759ec80078a1b5b2f44656830396

SHA512
5a65a2b81c0d001be174a100363adae86bdc9af02360fbd2c87ebdb45d62833104e4cca90473f1156792473af5922e947677585c55052a99868e6a395aa457ff

Download Submit
C:\Windows\_CutButterball

Filesize
839B

MD5
b06ac899c4bc60a04c2715813c4d8fed

SHA1
690ed470798e597a8c529fd8a038352f413c3cee

SHA256
5bda765e5dcad5d2b468b30ecfde341e983c9c3bfb5a6fe613bac2290a3c7da1

SHA512
60bd855d861c6c19d6220ad43a1aafeaa9e96ffda759cb605b1eb2cfd096e7b12639fb3ce4d004117f42d8cf88a5dfc0c110c9675372cfbbab053a08c97a7d23

Download Submit
C:\Windows\_CutButterball

Filesize
3KB

MD5
64fa6881c89cd8a1e99348ff1aa7199c

SHA1
d9096e85634c541c9f4ca5d3ee1ea549108f65e6

SHA256
b15a2f7de280e56a3cbfc9f712caa785ac2a13aa9d34c4c251f2ec7f2a3170c1

SHA512
a49479b57f5e3d16fa29dd4107bb0f43f9bfac8912e7b6690f49884fcc434c6a4b84cbbf6a78fc7e3591ac9c92a2bd9031a772e2fe3ae256ef57f483252a9857

Download Submit
C:\Windows\_CutButterball

Filesize
6KB

MD5
5ea3e163c52533aa14e32d2cc7b7f173

SHA1
ba1da600a61341422d60360b4f7fa7db6d9faf6e

SHA256
5e2df3bb0a77d9cc1cc6dd07a923ea091239629636e8bf1bf56c6a7a24f49fd4

SHA512
c52cf9ae4fa9fff6d3669c202a39c6c68e832ec5cca7b2579739433223fe6d132135611e881375b1eead41772445800e0f05a0ce53b5687663df887a1f929c9b

Download Submit
\??\c:\Program Files (x86)\Briano\UWPHook\MaterialDesignColors.dll

Filesize
292KB

MD5
39367419516f5f3df9ab1f9e5d0bbcd5

SHA1
762c9acdb09bfdf40e700645131999202abbc871

SHA256
976eea4567656d536a6344b3834f958f2b9e27401b94c643681770437d5abc68

SHA512
20ea8a64a14579ef5403eae8a6345afa0f9b12229fdb8bc869f7a8cdd4e785093b9f60f9445be738266a161d75f53a8b8e42a69b2f9b4cbf4684f5dbf5113ae9

Download Submit
\??\c:\Program Files (x86)\Briano\UWPHook\MaterialDesignThemes.Wpf.dll

Filesize
7.1MB

MD5
fbd761926164043ac71ee9b83ab37fd1

SHA1
38d44b0f40fa31124ba139adeb6f7adc7e53ee19

SHA256
013a42b8c6ffa29e2198eed4faf6168247b6550a4c4ed5d82023a1d82a08e27e

SHA512
c2a0be2d8b5b98dc19ad167aadc1e68905ad259e3b0e020cfb95a8a816964549c98a9c5bc44b8f4640147bfd8555e799216b8dba13bf0eefed9582782da552d2

Download Submit
\??\c:\Program Files (x86)\Briano\UWPHook\System.Management.Automation.dll

Filesize
352KB

MD5
835e9ede7e7c774e7a2d56cfdf6e9b17

SHA1
a43ed886b68c6ee913da85df9ad2064f1d81c470

SHA256
c3a5868584a777422cebcf31d6718fd2b26d5e2314d3b5ba6d8e47aa40faba0c

SHA512
74284fd44497beb74326d11a0f63d96aff20aa44cfa8385f6b63b7e6743403c36e2ea4fb0d991767117a97d320e04d2b21f0a4730916244af4ffdaf51e834a26

Download Submit
memory/436-982-0x000002C1C3150000-0x000002C1C316E000-memory.dmp

Filesize
120KB

Download
memory/1356-358-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/1356-360-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/1356-650-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/1356-640-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/1356-630-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/1356-921-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/1356-609-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/1356-598-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/1356-596-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/1356-586-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/1356-963-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/1356-583-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/1356-554-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/1356-543-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/1356-524-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/1356-1006-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/1356-480-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/1356-461-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/1356-1033-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/1356-442-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/1356-1043-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/1356-405-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/1356-1053-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/1356-377-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/1356-1066-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/1356-768-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/1356-1076-0x0000000001FF0000-0x0000000002014000-memory.dmp

Filesize
144KB

Download
memory/1356-359-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/1356-357-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/1356-356-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/1356-346-0x0000000000454000-0x000000000047C000-memory.dmp

Filesize
160KB

Download
memory/1356-345-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/1356-337-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/1356-339-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/1356-338-0x0000000000454000-0x000000000047C000-memory.dmp

Filesize
160KB

Download
memory/1356-340-0x0000000002020000-0x0000000002022000-memory.dmp

Filesize
8KB

Download
memory/1356-341-0x0000000001FF0000-0x0000000002014000-memory.dmp

Filesize
144KB

Download
memory/1356-342-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/1356-343-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/1356-344-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/1520-1158-0x00007FFBF6230000-0x00007FFBF6240000-memory.dmp

Filesize
64KB

Download
memory/1520-1159-0x00007FFBF6230000-0x00007FFBF6240000-memory.dmp

Filesize
64KB

Download
memory/1520-1160-0x00007FFBF6230000-0x00007FFBF6240000-memory.dmp

Filesize
64KB

Download
memory/1520-1161-0x00007FFBF6230000-0x00007FFBF6240000-memory.dmp

Filesize
64KB

Download
memory/1728-1013-0x000002F65D8F0000-0x000002F65E204000-memory.dmp

Filesize
9.1MB

Download
memory/3880-1091-0x00007FFBF6230000-0x00007FFBF6240000-memory.dmp

Filesize
64KB

Download
memory/3880-1090-0x00007FFBF6230000-0x00007FFBF6240000-memory.dmp

Filesize
64KB

Download
memory/3880-1089-0x00007FFBF6230000-0x00007FFBF6240000-memory.dmp

Filesize
64KB

Download
memory/3880-1092-0x00007FFBF6230000-0x00007FFBF6240000-memory.dmp

Filesize
64KB

Download
memory/3880-1093-0x00007FFBF6230000-0x00007FFBF6240000-memory.dmp

Filesize
64KB

Download
memory/3880-1094-0x00007FFBF46F0000-0x00007FFBF4700000-memory.dmp

Filesize
64KB

Download
memory/3880-1095-0x00007FFBF46F0000-0x00007FFBF4700000-memory.dmp

Filesize
64KB

Download