crimsonrat | hxxp://google[.]com

Analysis

max time kernel
300s
max time network
301s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
04-11-2024 17:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://google.com

Score

10^/10

crimsonrat defense_evasion discovery evasion persistence privilege_escalation rat upx

Malware Config

Extracted

Family

crimsonrat

185.136.161.124

Signatures

CrimsonRAT main payload 1 IoCs

resource	yara_rule
behavioral1/files/0x001900000002acbe-777.dat	family_crimsonrat

CrimsonRat
Crimson RAT is a malware linked to a Pakistani-linked threat actor.
rat crimsonrat
Crimsonrat family
crimsonrat
Downloads MZ/PE file

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2184	netsh.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BitcoinMiner.bat	xcopy.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BitcoinMiner.bat	xcopy.exe

Executes dropped EXE 3 IoCs

pid	Process
2624	BlueScreen.exe
2140	CrimsonRAT.exe
2044	dlrarhsiva.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
45	raw.githubusercontent.com
85	camo.githubusercontent.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x001a00000002ac6c-394.dat	upx
behavioral1/memory/2624-396-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral1/memory/2624-397-0x0000000000400000-0x0000000000409000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 2 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\BlueScreen.exe:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\CrimsonRAT.exe:Zone.Identifier	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BlueScreen.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
2808	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133752161554695119"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings	chrome.exe

NTFS ADS 5 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\49cccd30a564410d1f9bbce89fa15890.zip:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\BlueScreen.exe:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\L0Lz.bat:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\Paypal.zip:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\CrimsonRAT.exe:Zone.Identifier	chrome.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4044	chrome.exe
4044	chrome.exe
1268	chrome.exe
1268	chrome.exe
1268	chrome.exe
1268	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe
Token: SeShutdownPrivilege	4044	chrome.exe
Token: SeCreatePagefilePrivilege	4044	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe

Suspicious use of SendNotifyMessage 14 IoCs

pid	Process
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe
4044	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4044 wrote to memory of 4644	4044	chrome.exe	80
PID 4044 wrote to memory of 4644	4044	chrome.exe	80
PID 4044 wrote to memory of 2904	4044	chrome.exe	81
PID 4044 wrote to memory of 2904	4044	chrome.exe	81
PID 4044 wrote to memory of 2904	4044	chrome.exe	81
PID 4044 wrote to memory of 2904	4044	chrome.exe	81
PID 4044 wrote to memory of 2904	4044	chrome.exe	81
PID 4044 wrote to memory of 2904	4044	chrome.exe	81
PID 4044 wrote to memory of 2904	4044	chrome.exe	81
PID 4044 wrote to memory of 2904	4044	chrome.exe	81
PID 4044 wrote to memory of 2904	4044	chrome.exe	81
PID 4044 wrote to memory of 2904	4044	chrome.exe	81
PID 4044 wrote to memory of 2904	4044	chrome.exe	81
PID 4044 wrote to memory of 2904	4044	chrome.exe	81
PID 4044 wrote to memory of 2904	4044	chrome.exe	81
PID 4044 wrote to memory of 2904	4044	chrome.exe	81
PID 4044 wrote to memory of 2904	4044	chrome.exe	81
PID 4044 wrote to memory of 2904	4044	chrome.exe	81
PID 4044 wrote to memory of 2904	4044	chrome.exe	81
PID 4044 wrote to memory of 2904	4044	chrome.exe	81
PID 4044 wrote to memory of 2904	4044	chrome.exe	81
PID 4044 wrote to memory of 2904	4044	chrome.exe	81
PID 4044 wrote to memory of 2904	4044	chrome.exe	81
PID 4044 wrote to memory of 2904	4044	chrome.exe	81
PID 4044 wrote to memory of 2904	4044	chrome.exe	81
PID 4044 wrote to memory of 2904	4044	chrome.exe	81
PID 4044 wrote to memory of 2904	4044	chrome.exe	81
PID 4044 wrote to memory of 2904	4044	chrome.exe	81
PID 4044 wrote to memory of 2904	4044	chrome.exe	81
PID 4044 wrote to memory of 2904	4044	chrome.exe	81
PID 4044 wrote to memory of 2904	4044	chrome.exe	81
PID 4044 wrote to memory of 2904	4044	chrome.exe	81
PID 4044 wrote to memory of 3152	4044	chrome.exe	82
PID 4044 wrote to memory of 3152	4044	chrome.exe	82
PID 4044 wrote to memory of 3464	4044	chrome.exe	83
PID 4044 wrote to memory of 3464	4044	chrome.exe	83
PID 4044 wrote to memory of 3464	4044	chrome.exe	83
PID 4044 wrote to memory of 3464	4044	chrome.exe	83
PID 4044 wrote to memory of 3464	4044	chrome.exe	83
PID 4044 wrote to memory of 3464	4044	chrome.exe	83
PID 4044 wrote to memory of 3464	4044	chrome.exe	83
PID 4044 wrote to memory of 3464	4044	chrome.exe	83
PID 4044 wrote to memory of 3464	4044	chrome.exe	83
PID 4044 wrote to memory of 3464	4044	chrome.exe	83
PID 4044 wrote to memory of 3464	4044	chrome.exe	83
PID 4044 wrote to memory of 3464	4044	chrome.exe	83
PID 4044 wrote to memory of 3464	4044	chrome.exe	83
PID 4044 wrote to memory of 3464	4044	chrome.exe	83
PID 4044 wrote to memory of 3464	4044	chrome.exe	83
PID 4044 wrote to memory of 3464	4044	chrome.exe	83
PID 4044 wrote to memory of 3464	4044	chrome.exe	83
PID 4044 wrote to memory of 3464	4044	chrome.exe	83
PID 4044 wrote to memory of 3464	4044	chrome.exe	83
PID 4044 wrote to memory of 3464	4044	chrome.exe	83
PID 4044 wrote to memory of 3464	4044	chrome.exe	83
PID 4044 wrote to memory of 3464	4044	chrome.exe	83
PID 4044 wrote to memory of 3464	4044	chrome.exe	83
PID 4044 wrote to memory of 3464	4044	chrome.exe	83
PID 4044 wrote to memory of 3464	4044	chrome.exe	83
PID 4044 wrote to memory of 3464	4044	chrome.exe	83
PID 4044 wrote to memory of 3464	4044	chrome.exe	83
PID 4044 wrote to memory of 3464	4044	chrome.exe	83
PID 4044 wrote to memory of 3464	4044	chrome.exe	83
PID 4044 wrote to memory of 3464	4044	chrome.exe	83

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://google.com
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9f2cacc40,0x7ff9f2cacc4c,0x7ff9f2cacc58
  2⤵
  PID:4644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1796,i,18373251490984527504,14230236789946748245,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1792 /prefetch:2
  2⤵
  PID:2904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2036,i,18373251490984527504,14230236789946748245,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2124 /prefetch:3
  2⤵
  PID:3152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2136,i,18373251490984527504,14230236789946748245,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2184 /prefetch:8
  2⤵
  PID:3464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3024,i,18373251490984527504,14230236789946748245,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3036 /prefetch:1
  2⤵
  PID:4132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3040,i,18373251490984527504,14230236789946748245,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3068 /prefetch:1
  2⤵
  PID:4212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3572,i,18373251490984527504,14230236789946748245,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:3228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3304,i,18373251490984527504,14230236789946748245,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4732 /prefetch:8
  2⤵
  PID:2208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3676,i,18373251490984527504,14230236789946748245,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4540 /prefetch:1
  2⤵
  PID:3796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4932,i,18373251490984527504,14230236789946748245,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4876 /prefetch:8
  2⤵
  - NTFS ADS
  PID:1004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5028,i,18373251490984527504,14230236789946748245,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5292 /prefetch:8
  2⤵
  PID:3992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5104,i,18373251490984527504,14230236789946748245,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5508 /prefetch:8
  2⤵
  PID:4388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5060,i,18373251490984527504,14230236789946748245,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5488 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:540
- C:\Users\Admin\Downloads\BlueScreen.exe
  "C:\Users\Admin\Downloads\BlueScreen.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5072,i,18373251490984527504,14230236789946748245,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=3796,i,18373251490984527504,14230236789946748245,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:3260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5684,i,18373251490984527504,14230236789946748245,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=740 /prefetch:1
  2⤵
  PID:4928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5792,i,18373251490984527504,14230236789946748245,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  PID:1180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5964,i,18373251490984527504,14230236789946748245,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5944 /prefetch:8
  2⤵
  PID:3156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=5644,i,18373251490984527504,14230236789946748245,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:3784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5880,i,18373251490984527504,14230236789946748245,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5084 /prefetch:8
  2⤵
  - NTFS ADS
  PID:1236
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\L0Lz.bat" "
  2⤵
  PID:4588
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:3544
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:932
- - C:\Windows\system32\net.exe
    net stop "SDRSVC"
    3⤵
    PID:1524
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "SDRSVC"
      4⤵
      PID:4984
- - C:\Windows\system32\net.exe
    net stop "WinDefend"
    3⤵
    PID:3880
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "WinDefend"
      4⤵
      PID:244
- - C:\Windows\system32\taskkill.exe
    taskkill /f /t /im "MSASCui.exe"
    3⤵
    - Kills process with taskkill
    PID:2808
- - C:\Windows\system32\net.exe
    net stop "security center"
    3⤵
    PID:4100
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "security center"
      4⤵
      PID:4488
- - C:\Windows\system32\net.exe
    net stop sharedaccess
    3⤵
    PID:3656
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop sharedaccess
      4⤵
      PID:4748
- - C:\Windows\system32\netsh.exe
    netsh firewall set opmode mode-disable
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2184
- - C:\Windows\system32\net.exe
    net stop "wuauserv"
    3⤵
    PID:1192
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "wuauserv"
      4⤵
      PID:3884
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo tasklist "
    3⤵
    PID:1032
- - C:\Windows\system32\find.exe
    find /I "L0Lz"
    3⤵
    PID:780
- - C:\Windows\system32\xcopy.exe
    XCOPY "BitcoinMiner.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup"
    3⤵
    - Drops startup file
    PID:4296
- - C:\Windows\system32\xcopy.exe
    XCOPY "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BitcoinMiner.bat"
    3⤵
    PID:1592
- - C:\Windows\system32\xcopy.exe
    XCOPY "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BitcoinMiner.bat"
    3⤵
    PID:3864
- - C:\Windows\system32\xcopy.exe
    XCOPY "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BitcoinMiner.bat"
    3⤵
    PID:4452
- - C:\Windows\system32\xcopy.exe
    XCOPY "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BitcoinMiner.bat"
    3⤵
    PID:1316
- - C:\Windows\system32\xcopy.exe
    XCOPY "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BitcoinMiner.bat"
    3⤵
    PID:1272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=952,i,18373251490984527504,14230236789946748245,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4828 /prefetch:8
  2⤵
  - NTFS ADS
  PID:3236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5744,i,18373251490984527504,14230236789946748245,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:1040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=4844,i,18373251490984527504,14230236789946748245,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  PID:2184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2988,i,18373251490984527504,14230236789946748245,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3260 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:2816
- C:\Users\Admin\Downloads\CrimsonRAT.exe
  "C:\Users\Admin\Downloads\CrimsonRAT.exe"
  2⤵
  - Executes dropped EXE
  PID:2140
- - C:\ProgramData\Hdlharas\dlrarhsiva.exe
    "C:\ProgramData\Hdlharas\dlrarhsiva.exe"
    3⤵
    - Executes dropped EXE
    PID:2044

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:3168

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3532

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Hdlharas\dlrarhsiva.exe

Filesize
9.1MB

MD5
64261d5f3b07671f15b7f10f2f78da3f

SHA1
d4f978177394024bb4d0e5b6b972a5f72f830181

SHA256
87f51b4632c5fbc351a59a234dfefef506d807f2c173aac23162b85d0d73c2ad

SHA512
3a9ff39e6bc7585b0b03f7327652e4c3b766563e8b183c25b6497e30956945add5684f1579862117e44c6bac2802601fc7c4d2a0daa1824f16c4da1fd6c9c91a

Download Submit
C:\ProgramData\Hdlharas\mdkhm.zip

Filesize
56KB

MD5
b635f6f767e485c7e17833411d567712

SHA1
5a9cbdca7794aae308c44edfa7a1ff5b155e4aa8

SHA256
6838286fb88e9e4e68882601a13fa770f1b510a0a86389b6a29070a129bf2e5e

SHA512
551ba05bd44e66685f359802b35a8c9775792a12844906b4b53e1a000d56624c6db323754331c9f399072790991c1b256d9114a50fb78111652a1c973d2880af

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Filesize
64KB

MD5
b5ad5caaaee00cb8cf445427975ae66c

SHA1
dcde6527290a326e048f9c3a85280d3fa71e1e22

SHA256
b6409b9d55ce242ff022f7a2d86ae8eff873daabf3a0506031712b8baa6197b8

SHA512
92f7fbbcbbea769b1af6dd7e75577be3eb8bb4a4a6f8a9288d6da4014e1ea309ee649a7b089be09ba27866e175ab6f6a912413256d7e13eaf60f6f30e492ce7f

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Filesize
4B

MD5
f49655f856acb8884cc0ace29216f511

SHA1
cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

SHA256
7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

SHA512
599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Filesize
1008B

MD5
d222b77a61527f2c177b0869e7babc24

SHA1
3f23acb984307a4aeba41ebbb70439c97ad1f268

SHA256
80dc3ffa698e4ff2e916f97983b5eae79470203e91cb684c5ccd4ff1a465d747

SHA512
d17d836ea77aeaff4cd01f9c7523345167a4a6bc62528aac74acde12679f48079d75d159e9cea2e614da50e83c2dcd92c374c899ea6c4fe8e5513d9bf06c01ff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\349733c2-1cdd-4963-922e-6d93c8d8d413.tmp

Filesize
10KB

MD5
f56239f91f118c51ae326d290701ef4e

SHA1
48d8b92cbd6dcfbf53ef0daa32161aa5e012cec2

SHA256
51f52a53ebd48160f4d25a1972e453eb2173442982545039f4742e1e28d266c6

SHA512
a464db30d1fd7e753701589a5e663e1b14fb4713aaab431e3707cbfaec2832079683a2266a5655049c8011658d341a219ea2d3cbf01d6e0f069a1acfe64dc3e6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
df303e72ad76df29a7e542797fa02552

SHA1
3312b84de7b2e70e687af5d10d657ab99636b04e

SHA256
604a1d1b3be20934aa01c4f0c85e6da93cd817c924fb8d4067a4cb2bfb67df22

SHA512
fb6130c27f86799b6c8f1059a7d25e43a8f06f017e7f4339947e975619cc39bd8a19ff3257fa1adbf661393b286ef7c77cd3c3b269889b3f340dadd92dd6b447

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
2KB

MD5
3f88ea4f4e1220fc29b5a22e7c1613c3

SHA1
40633e3f673e21b6f9edd2d6f6dc5862d245daa5

SHA256
219f179b57dd4cbb9158fcd45f85b206da1bdb043cfab6bcee3edce1f9013327

SHA512
587a10d68282bd747d89ed3fa6da73924d3d316737266c4827066b3998378db0cc3315dd3b05293f7e2d3214f07d7e39b82724f1e4bd9b2e1fdd1925962244d9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
3280c2e07ae68937f6e7a016c04951e6

SHA1
050206efe8761b739d85e4f7502f54f7fcce4a39

SHA256
66688e6d6dc138f5031c9aacc314719338cc2c02fad22d34da02ab15a49bb466

SHA512
9ae4e2fcaaf72b101a0ecf922508fee34536d6000810fba63a8ee7ee3aa684ed4bc6d9d4870e0bed399a293a22f9169a18ea34b1b8c925bf225aa6e68f4e7046

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
6KB

MD5
94effad66a1b645ff2b77842d3ac6a95

SHA1
839d01ef39c66bfd8710ec422ec0cd05005df808

SHA256
65f8b9df10df59cda3ee7a47981ce38929c928d827f6584782030ddcfd360cfc

SHA512
69bff81b0abe5309e1631aa1576ed582e52a1357cace9d2a8b2ff4bece0105316bedc6a857865e6583380c7e08fc43eb10d0e70cf82453f05f6538fff539ec54

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
6KB

MD5
83b942d607ac11583082859d0d3f7602

SHA1
5c908f238ff1d06cd828b6f29980aabcceb15192

SHA256
c93a16b58ee1fd605f1feaba88b3cf4bb3d3fe02cfa9d0ad4a2faf8a223b9c18

SHA512
138bfd4e42841f78cb23725038d09fb8ee8410c47be15cb9364518b848077f6685442a496488547e8d75598ed813d842d4a73d5dd0ae870fb8abe15b473e0891

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
10KB

MD5
17f7f507fb36511a5a11325b9883622d

SHA1
7be9a658ca972d59f5055d880fd7189bbc372b34

SHA256
948571faf17bdbaf212cfb2228ccd37e35a8c9d3c56df50c19b261da287459bd

SHA512
8cb18e2e6ce811f55ba836db6cf2078a57d609094a6bb693c1ab32197ec979d491a47b167fb48b920efcb3cfcaaed0fc8332ba27b93acd8cd02f416f8b14b758

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
0ee8a0bd75a01bc2b0d2f6299ff92ae6

SHA1
9fb673e8972c9cb41f8be3df31ded0b8b9525035

SHA256
c3958c2bb536cbbd26c6f4422716ab26d163dcd184257b51936c340fc3257ddd

SHA512
09878c1e4863f849b835ee5b9b175b0e449d4d47c67675ec7f3fa7648b4456566baeab3e1e2ce9af30327ed740b13321651044f474907176b281ab3579431e21

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
01170be3063c85ce770194a4ddc2b381

SHA1
02696c61ed6e904b6784882ad9804ecf274cc737

SHA256
c963023288dcb22d2e780e393170f3f743dfe0a0225bb9598c7680e37f654ebf

SHA512
78034c3730031d6a5253737fa50814104077beaf227d38e754bb2dde6b2352e58e1639b3c4d02878ea32b87c4530ca8444b93c8c015176caba1f2bed376cbc3b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
1530a004ccf6495c1d08879fba031551

SHA1
817dfdc5edbf7c9476c26b5883b4f2f365833545

SHA256
752356bcb829429f702debdbebd7ab39ee34ec86c1531848347a30ba774bddad

SHA512
a91ae228214fd1a2f8833ac9823bf9efecba87d7ef61024af4544a097445cbd59b89592f8947da0962f7164d96be736c144435911e931bbca9ce59e53051f07c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
579b47504169db481c7691352c9131ef

SHA1
7ccd7936dc5e0ed8cb780d1ac17b5805b9bc2665

SHA256
7f8de2d9938a07f35167985987af1f2e07ce4b2c0c1ccdef15b11cc654209d63

SHA512
73f32bc541d1a08b50c767588705f9a4985b556f34936e12b353b862256e3da834f8cad24b2c3aa281397cb61e6a16656fe3bf38b9ac140e063d4595f4d95758

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
30ca11bf72fed194c795ff75c3677bb6

SHA1
1c62bf135c3245b9842cbed3f89db6c998361c63

SHA256
01769278505978156d662ceff5d8a9c06047670144694cc559b0a05c6fec1b09

SHA512
f0f963d38d5743de5f76f6f97f07acdc95a383af8cdc9b5351a921c8c4565305c592272bbcfd35228f4066c8df451ee66991f10d99540a633da692625253b9de

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
2674d2fa83d61b45e1989e6bbde5e90a

SHA1
53b1a510fb918d731e89166d4abb41127e469510

SHA256
6a12f9f927fe48258b7a18503c6a5e24920020cf2eebe07e53446e2abbb01d2b

SHA512
b19a127063873e252fe9f788297a9e43d6acbf52b7b6bb82e19ea842321bfc24626162eef0dc581233163a051c2a5072f668bc77c070d82e5a1358fcca6d64fb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
b849152f249767cab13ba9c828bf6e51

SHA1
9eb21ce61260edd218dfc15964ffa0a767ca7e46

SHA256
fb663e17bff6d6abc6149bb1f6ad7d324171f6fbba4f82f3fc6f0890461d567f

SHA512
28b6e18a355fa9102fdaaf53d791c218bb138708a94f909812adb23bc19890b28077538e3dbd8476b5f2b609438869f301eff0f07bcfd54fefd43e3385ce62f1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
156a589c9efd5aa1fc5329527a6e0e81

SHA1
2a93dbc0bd909e3ef59c73c6f05340e29c93ee70

SHA256
4186847e4f09049d985dd2a7c16d53e4247830ffb2d8155dc619e62b6999c0a9

SHA512
1cb4d5103290c16d80a76e6d8e194a2747d385bc47f46b56b91d9f435211698fb1d117430d68e64fe7b52c5b98f8ae7bd853958c41f52e740daf16ea10e28c7a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
c969e5a64d6fdce93eb952ce1453bbba

SHA1
250e5ecaa5c26bce640c7ac6f36233685b6ccb07

SHA256
e6a62ec1c1efe771d1cbe7a32319549001759df7239282cfa343b7eebf78cbb7

SHA512
984947137f03d776317e7c66c6e887ba06f05567075b1accccdb090f6267f34573332dcb99959def59a5db58b1146f40b25c42a550bc6f711f6f0da2cb5426db

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
26fd9836e9fb7ce6f71af9f3d9b9a39e

SHA1
64c72c12fd7139cbfa29b79fbd5ee460a4269651

SHA256
cad478909b3dea09f0cbd9edc729739a828d36cda98c2f1227c9f4fc81bfd168

SHA512
544a52b661f99f8bc21f477d3700e073f6d97e2d9d89b58e8271b49b41d4e2389923a66b2731d812bde5f92e5f5b7778f7750fdf4cc65450d9a35f559d3786eb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
3c21c4372a71abb8992301140f390337

SHA1
ffa808c40d931c2de25b2a0f21938b3b635868cf

SHA256
e49eb170ec29dace89ac887b34db29c187d3237e138a357160133f09aa03ab13

SHA512
6483a632c9893303574a2d8e0c702386fadb0205a3d647cc96f00d5b612b79d18226ffabcbb3273c9ec11d6a5157952187d9cd17c9381f9a2d2de8bcab2e72a6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
f0263c6343504482c1038c0c537def7d

SHA1
c0de903ffe08b75aa7e3ff48372cb70ead10eb67

SHA256
74ea0a567d03972de89fd83f83e49d3d8a904d03e5048102a4856ac4b3763e08

SHA512
9eba2816fe203cf741440f36d394856ddb29bd6fdc7eeb8d5e14ce5899bae09c77cda72657945928265365b53f6b61fcbf7942489346d20a41b8cf8b478f2b70

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
917b35ada8ea38bf7fba762add96a0ec

SHA1
e52ac8a4f263f2d4bb44ecb7dffd064212548f85

SHA256
f6a04d82553a12144ef85f9d532a5131db4567bd2fdc6cdfdf6eca608ddc35b0

SHA512
ab952d87996ef29ad0f4037e26debef62fdcb9dbe6fe13bc4fae4046f409a406d421163d7bdecec9daf55c67d56f4b632d4502f4e12731cc70b506eb5763c294

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
94bd51afd14890d0e086b4d7553771f5

SHA1
562c624b8edc91033ef2c50cf04f5ae12fa98367

SHA256
46c11522c1b49e7e09d234ca2448c458fb26bf6b0f64a376eff5859d8e7a6572

SHA512
a8e9ede5ed5c3175622183921fbeeef89db36dde54cfcd0799b0b0b5ab9e7fb868de6844d465a99781c3e1aa2baefc1549231e8cd5fe0f73b18d2f79b4c16651

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
4c302e15b81f4223c3a9f6b3c768c52b

SHA1
5b4002d7f27d1c475f2917e30cef02efd76aa21f

SHA256
152f18a231af7beff259e8a3b8310a7f7cd4e7dec1be2f5339a80a743bb93586

SHA512
4809dbeefed3979ddbafb5afa0e93b257c4ed7b22f11156883241a8bd45913ed83780a3ebc140320112bc3d8b07cf8bc20612725a4761ad297e829e1c5e2d7fa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
e6de53bd483cdd626950773ee155dcd6

SHA1
1e5231242141b85ea6cdddf3ccf723212960285d

SHA256
9c184b22df94347bfb2863ba878b9d08cc2c2466b860d08730a1f51e59a460c3

SHA512
e3a24ad0c025ad7bce0bfff9857d4c24b9065cc3fc7101fa7bb0c286d9a3edd22b2af53617e45bb24d226e721c138f206f8b5ac7316f8dfb5f28dade8e55c055

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
fcf42bb59e97523f988ffd1a664cac3d

SHA1
8979785e756fb3062445ff183373902cfe88b2b3

SHA256
e1c398ea15b2ec8c5138a194578859bdfb71e651c7179d38b6bc1e6e44505d3c

SHA512
dc422a26a10faa7d9e82df8c92627a13d2b8c816da6353f60f5c24f79224af8e777809953f3ad2be8b909faa4c56b17d3256e212b74f3bef640f5138e709f51c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
b489afa650729f0200f438192712c528

SHA1
bf2502a23ab8bd88049d8c4c5ca78ac5ec5311c8

SHA256
debfa11de692291486d7b07089565b1e5bf67b6f53b1e2b059d8faba93226fa0

SHA512
55808b18b56094536b6e238bf09f865ebf4bfa99899dfab866be256a824f98b38de4127c852e4ad5992a093dfb03bc8371cc4bda0c99e14634bc4f3c469cb690

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
58530e30edf746177b72f290b359f6d2

SHA1
b32ff80a44796edc43fdca04e7a588c4b48ed9d1

SHA256
627f8d6bc8fac019931352ce5d3bd603d28d15d84c9c1b5d38d5facd271be0c5

SHA512
80c71bba771774356cba005a46aed95b42bac06151da96e39ed7a99d80e42ac580e7b559587c9751109c6b5af40ad332819cc7bc5119b0f8058962130a45e655

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
6bb58f075103dea95ae620760432285a

SHA1
d6ebeaa831e02488e3d8418769ee483cc8c3a71b

SHA256
1a49e6b08d500a9d143cc353723471cb355a6b35b72e7dd1e7d957ddb2003b67

SHA512
546d99016d72de646ffb26b9b34bd01ca12a7600df446693a61ea035f2bb6b46785dc324ceac08d4ddfc0e7c2c34feab172f88f5bd249a50e762009f22655eaf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
c6c5593ff5482e8eccdb784db79f7474

SHA1
e20304e7cf114b9308486d9cf2a5d3339a8e1d02

SHA256
c45e320ee71678ce4e3c0e21a9afafe1881a36e0a39245517656aac1f23b464b

SHA512
d2c36b5086ea43f01d08015ae11ec27c7325dee4137ddd6c608176c69c87c523d4896c574699b1084eaa06f7a076f50e726a8f00c093117ee4b1cefc98a2b9e6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
5b32ef090fa30cbe3bb138d5e751e1e8

SHA1
873db05f2b04fa0c48a0e4acf11548bc945a486d

SHA256
bce8b0c57782992b73a12a78e3d018644b3a6b65a1fb812d48a95b1490297781

SHA512
57055b0194722e2280023efdbe3fe6e902d26874b283ef8e389db8b3e6ef61bd4437e2a23f92752597401e6e22a8f3f7631db9fd8b8b2f5ddd8d3cc29d8aee2b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
7f0d72170a5400f739b0cc4ae2764c15

SHA1
460fc45b131b674bebd506b757c2140fbfe0a2e6

SHA256
544f3c583568fba066fce0f0a89e6d22ebb72f3df42eff3039582fe38f0e8ce8

SHA512
377f2007904850696709b4b447e74835bd77462a6db6f94d1529374c103555de1e7c2afc2d78795a0c652f7434ba5c65daf9cbc458a786f16c693cdc26155a01

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
cfb4f180f1e8dd0c55d5e92f6cbb69e0

SHA1
08039dd5e5c8508b8d89ef77fe70514fbbc3f70c

SHA256
4dfcaf672f45cb4348d0c47b769290904aad4c0259c2a52dec2b02846f05c804

SHA512
de37126e47c83562a81b2baf58d896865a28b3f2f1321091ad1ca0a6fdc85323b5cd074568b745db3e533c7bc3a8566e3911ea09f8d5a230bbd048390b3b7111

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
3459116db3f461e30a1335e05298d94c

SHA1
dca16ae35b79da210b1d71167684e67f399cac04

SHA256
9a13af14111b48ee871fed365767e7875b53856b734a4dfb8f9e7d78fdbb612c

SHA512
bafb19b97c98180d30f86e9f2fe47ae1b384fe657b0f82dbc034657f75caba82e93b4e20df224aa401bf07356e3944c44e0985647e1aaae94a61659426648df9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
9b8483d3043df32b409d3f56da53a880

SHA1
f1f4d17c3064551fbb5b8476c8f13ed98c6079b7

SHA256
62926441caa9198ed8bce35891b49b137beb93db6b4bef9956c500daa7279f24

SHA512
a6401d2dffa3a7503043e90d39c11ed8616d1223c120f3b4222a8e9a03724d4ecbaa44b15aa5bb28baccfb6f1da8f729d184fa346f88106fc7bf003614dc877b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
a7d7ca85b59d03805c184b8fc3660ab1

SHA1
e31f980c838da57ebd412a6e6d5764f66696a9e6

SHA256
2ed0dbcab8e64d17e6236048aa72f8008e54630ee1e0b1c922ca1e0548ef28ef

SHA512
417e6ea277e6f0524a65076fec62a5f33a74f2555bc1f84dfaa42a851ba1e9109554d8ee21b7761a51e28601bc993c41a353112873490d9feb2fbf0b4cd1c90c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
75e74dab23141698d9e462338edeb181

SHA1
6228526e38e1a152154b74d2acda5fa234958c7c

SHA256
cca040247c370769793f47057b9f66071eba109406370252c54b1480468912f7

SHA512
29958c052c278046ad7b55580602d2d957ba0bf8958537730b37a65f66f367ddfb1d9b16168414ad624a17f372cccbf93e8f66455155e0036bbc0a2dfa5aa096

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
887ce7d0a972d72dde1768e4168d3186

SHA1
811956ef0ea686232aadb33d85b5a4c56708edff

SHA256
ef71f7c4674f377717200e9fbb9ca82884db3e2b6f482679391f8d3548cc977a

SHA512
ed0075b4ef6874d6364ece4871689f268c18385731efc8b8576f970a201f3d8e2b953a85352d474019b3c8be623702f289bbce9eb1676a930eb5285c6970b9d7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
576e3cf31cce5728070a120d368fc347

SHA1
a32da25215ebaed1ecf8f7cd67cbca7d93271c84

SHA256
9333be19f5ef005dd363c40d7deef27800b5c9036b6a95eb81993341f05bf5ab

SHA512
ab4663f7c7751e294efcc7ceaf03980a2fadc051db9bc04dff591f41e2f9ea059786621612fca7cef439448ddc084b68325c1909bab3b60254eb6b0d176746b8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
c9dcdf41a91bbff64ca37a5c38445a25

SHA1
87fa4c04e03f4da028ca75c59e92e45a547cfa67

SHA256
78657ce56f4a5d918aa15c77ce2f6ed4cb62840059f14dc42d50e207fa6531d6

SHA512
f8da7b1c36734bc261c0ee414316da2737dc1111add5620261f2b3c4f15d27d57b684bd9061130d1fe5b4febfd04e994a68a04371d711e22696b8c1aeb114e98

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
4df9b0cf3c542df2c7e9347eb7db02a0

SHA1
194a7cdba91cb66081773aa566d708ae7ed4a4a6

SHA256
696be8cf8735be7d1b980adf23a47f87725da949815ef37451619739ca1d8235

SHA512
0084d1e36bb4e16f6e872783cab076356d9a711cb01b4d3c56b42e803b05cfdb4b072b10ddc063a9d16c7072379721806336b4ef37bd827f3026d18029a87216

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
c95fb52f5e3825c94834ce0df1072747

SHA1
5303ddc2c8683031421daebd34bffb395482593e

SHA256
0f2d923aefca9aaa48b0aa777d43765e38f8a7f5857d806cb4cdcb5235b1751e

SHA512
1da7bf373136e032f028731b70c6f39ffaac1bd834c7c201113b6150beb9aa963430cf905e380c53327568c70f7f0400fa4eef7b5e21d0c607932f874d4eebf1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
4bd24755f7a567e6aee4bb8979e22621

SHA1
4af3e415d4abc6f98575eadf3fdd2672efbc2bd6

SHA256
b9e1ce9c7e00bb12b602f7f60c712239d75aaf35ecc3de4a1a14b8965b16fbe3

SHA512
123f7cd22a49d350a99cae0423d76dfcd288466eeeee15a9d32490383ff9f07689a20403603bbbb6c7e98a7b7e81f7ae73e298bdc637d3c47492407f34eda730

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
228KB

MD5
91cacf9e5d64ca9ea993f000b5dae0ae

SHA1
1d781479182086c4ed8995e7e209b650dbf8b7e8

SHA256
e9e214fd5ac73c5107af36f5c2fc60d389fc94873c0685d88b489ea12f98ae19

SHA512
430d341b24b1086d0bd89f8795c9330b6a7ee835ef2327238cfd7a8dc98ab093ef2134bf2383d839236e71e5c180b951beaf6bc434aa88a67542b3fe809940af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
228KB

MD5
fcf2d90d5d4292845ee439ff467ea21f

SHA1
71e1c9e121fa47e3ac152502d2dac1f83154704e

SHA256
b8f4daad898967992fc8d02be3d3d3104cf9256c004530d734debd9fc39e56bb

SHA512
c8aa9c7a033cc5e96d6935dc0ff3cad8dbfeb8bdef280b158dbdcc3a94254892ff5b6b0399f6e74983f730827e2ff5ba05251489bc2572ccd993a4d80d6a313e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
228KB

MD5
aa07f60f8d2eb81276febc632ffd7e68

SHA1
7d8550e34e69b1f7f6faa7f4979b4c54e7348843

SHA256
6e6091f52611a3a7734f39bd60974e4ab86e300378502742c57f2c4aed625a44

SHA512
417fc9234e15a345d99f79708938c016a39fecc64c33f5a19307a956e2a3d5719a63f481df4f80ff72bff267c321816ad2497de1fc0671a553dbcf37ef40f0fd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
228KB

MD5
2bd2975af1a1b8a9aec16a62f913a72b

SHA1
3590efe5b37333ef722ce35ca509fe9def8a86eb

SHA256
21a250f6f03b90298851b3e0a462bfb14ea8bcd522c21f34316c872ec6e447c6

SHA512
a2b3713b2e47730dbb1f91a980c98eff9ad7bd102e105cfb1ac22b69221773a22ea662caae248857d0f0bc1d58ded8b45eb32ce1d88a7dd62e27c81653841f48

Download Submit
C:\Users\Admin\Downloads\49cccd30a564410d1f9bbce89fa15890.zip

Filesize
45KB

MD5
857e4709e6c467c1885f157cb7b1d0d7

SHA1
9340f27c082a99e8fab42a353f83c33824beb6e2

SHA256
97e3fb3fb0b77ba5ecce0d1d10d6408e3316baff66d7893605aab190578bafa1

SHA512
b934bc8f9ae69af15a255420a17bd301a2e5c8df79d6f61f899b4e9cec3764704852a301adaa87860ff63ba89aa4f3b14cb351887ad915c32a8a701245a11b91

Download Submit
C:\Users\Admin\Downloads\49cccd30a564410d1f9bbce89fa15890.zip:Zone.Identifier

Filesize
55B

MD5
0f98a5550abe0fb880568b1480c96a1c

SHA1
d2ce9f7057b201d31f79f3aee2225d89f36be07d

SHA256
2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1

SHA512
dbc1150d831950684ab37407defac0177b7583da0fe13ee8f8eeb65e8b05d23b357722246888189b4681b97507a4262ece96a1c458c4427a9a41d8ea8d11a2f6

Download Submit
C:\Users\Admin\Downloads\BitcoinMiner.bat

Filesize
262B

MD5
1b95e04dbd98deeabacd15b8cd17d161

SHA1
223280d1efaa506d6910fa8f0e954bf362b2c705

SHA256
76a32e2efb8b97a8c226bcb8bc5b113b4b6fce1077de6513405955bc6d74b169

SHA512
e2be3706491c1cdb9654d0720805dd96536c66f48bd7d8a4d781b5daeebfd22655cdb2d84ea1a1ec5c0d963b0f3982735975f032373c9083986cd1c01d379e70

Download Submit
C:\Users\Admin\Downloads\BlueScreen.exe

Filesize
9KB

MD5
b01ee228c4a61a5c06b01160790f9f7c

SHA1
e7cc238b6767401f6e3018d3f0acfe6d207450f8

SHA256
14e6ac84d824c0cf6ea8ebb5b3be10f8893449474096e59ff0fd878d49d0c160

SHA512
c849231c19590e61fbf15847af5062f817247f2bcd476700f1e1fa52dcafa5f0417cc01906b44c890be8cef9347e3c8f6b1594d750b1cebdd6a71256fed79140

Download Submit
C:\Users\Admin\Downloads\CrimsonRAT.exe

Filesize
84KB

MD5
b6e148ee1a2a3b460dd2a0adbf1dd39c

SHA1
ec0efbe8fd2fa5300164e9e4eded0d40da549c60

SHA256
dc31e710277eac1b125de6f4626765a2684d992147691a33964e368e5f269cba

SHA512
4b8c62ddfc7cd3e5ce1f8b5a1ba4a611ab1bfccf81d80cf2cfc831cffa1d7a4b6da0494616a53b419168bc3a324b57382d4a6186af083de6fc93d144c4503741

Download Submit
C:\Users\Admin\Downloads\L0Lz.bat

Filesize
6KB

MD5
74f8a282848b8a26ceafe1f438e358e0

SHA1
007b350c49b71b47dfc8dff003980d5f8da32b3a

SHA256
fc94130b45112bdf7fe64713eb807f4958cdcdb758c25605ad9318cd5a8e17ae

SHA512
3f73c734432b7999116452e673d734aa3f5fe9005efa7285c76d28a98b4c5d2620e772f421e030401ad223abbb07c6d0e79b91aa97b7464cb21e3dc0b49c5a81

Download Submit
C:\Users\Admin\Downloads\L0Lz.bat:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\Paypal.zip.crdownload

Filesize
3.0MB

MD5
6eed178386859ac9b3ae49d3dcec297c

SHA1
4e41a6375459adea394dc3ff8ec5f8fa189bf236

SHA256
3e5ac22cc012f4db06e208f26782f682fa97afc7250d4a472ceee9c6ed50bfe2

SHA512
345bf7cc25b364b67c809dbe124aeeee0e7c83db8d9627af1a1b9a06a737c5f6ecb49d80ef710a14d63b5283f1af7ac3b02a8dfd8e36fc25d715051429225890

Download Submit
memory/2044-786-0x0000028F86C70000-0x0000028F87584000-memory.dmp

Filesize
9.1MB

Download
memory/2140-754-0x00000226B00E0000-0x00000226B00FE000-memory.dmp

Filesize
120KB

Download
memory/2624-396-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2624-397-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download