51db95fb72ba2b52a47d6824bc65cf055852e7e71b517c282004e47001b631f2

Resubmissions

01-11-2023 06:15

231101-gzwcdabd61 10

01-11-2023 06:14

01-11-2023 05:56

01-11-2023 05:48

01-11-2023 05:45

Analysis

max time kernel
129s
max time network
344s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
01-11-2023 05:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

y+tu+keri+o+nooo++#magicgang.mp4
Size

593KB
MD5

017ef81026c1956d8c5cdd2eb68b51c4
SHA1

7a511485e691cc1a7a299f11b5be49fb7e32fd2f
SHA256

51db95fb72ba2b52a47d6824bc65cf055852e7e71b517c282004e47001b631f2
SHA512

44fb405addc45d3efce74e4ddf1542ff50a74c468b38767f11816dce9a8274cd2430f3bf92f20343f470dfa20923458b3f603c0adff65554ccc9f42f57065ef8
SSDEEP

12288:Odeu59/kMA28kWqKF3oa8yzC02xQum10HDdwwvego0BHmdfxqaf:OB/PfmRoNy202nmaHDdwwvelfkaf

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1952	NOTEPAD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2920	vlc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
696	chrome.exe
696	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2920	vlc.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: 33	2920	vlc.exe
Token: SeIncBasePriorityPrivilege	2920	vlc.exe
Token: SeShutdownPrivilege	696	chrome.exe
Token: SeShutdownPrivilege	696	chrome.exe
Token: SeShutdownPrivilege	696	chrome.exe
Token: SeShutdownPrivilege	696	chrome.exe
Token: SeShutdownPrivilege	696	chrome.exe
Token: SeShutdownPrivilege	696	chrome.exe
Token: SeShutdownPrivilege	696	chrome.exe
Token: SeShutdownPrivilege	696	chrome.exe
Token: SeShutdownPrivilege	696	chrome.exe
Token: SeShutdownPrivilege	696	chrome.exe
Token: SeShutdownPrivilege	696	chrome.exe
Token: SeShutdownPrivilege	696	chrome.exe
Token: SeShutdownPrivilege	696	chrome.exe
Token: SeShutdownPrivilege	696	chrome.exe
Token: SeShutdownPrivilege	696	chrome.exe
Token: SeShutdownPrivilege	696	chrome.exe
Token: SeShutdownPrivilege	696	chrome.exe
Token: SeShutdownPrivilege	696	chrome.exe
Token: SeShutdownPrivilege	696	chrome.exe
Token: SeShutdownPrivilege	696	chrome.exe
Token: SeShutdownPrivilege	696	chrome.exe
Token: SeShutdownPrivilege	696	chrome.exe
Token: SeShutdownPrivilege	696	chrome.exe
Token: SeShutdownPrivilege	696	chrome.exe
Token: SeShutdownPrivilege	696	chrome.exe
Token: SeShutdownPrivilege	696	chrome.exe
Token: SeShutdownPrivilege	696	chrome.exe
Token: SeShutdownPrivilege	696	chrome.exe
Token: SeShutdownPrivilege	696	chrome.exe
Token: SeShutdownPrivilege	696	chrome.exe
Token: SeShutdownPrivilege	696	chrome.exe
Token: SeShutdownPrivilege	696	chrome.exe
Token: SeShutdownPrivilege	696	chrome.exe
Token: SeShutdownPrivilege	696	chrome.exe
Token: SeShutdownPrivilege	696	chrome.exe
Token: SeShutdownPrivilege	696	chrome.exe
Token: SeShutdownPrivilege	696	chrome.exe
Token: SeShutdownPrivilege	696	chrome.exe
Token: SeShutdownPrivilege	696	chrome.exe
Token: SeShutdownPrivilege	696	chrome.exe
Token: SeShutdownPrivilege	696	chrome.exe
Token: SeShutdownPrivilege	696	chrome.exe
Token: SeShutdownPrivilege	696	chrome.exe
Token: SeShutdownPrivilege	696	chrome.exe
Token: SeShutdownPrivilege	696	chrome.exe
Token: SeShutdownPrivilege	696	chrome.exe
Token: SeShutdownPrivilege	696	chrome.exe
Token: SeShutdownPrivilege	696	chrome.exe
Token: SeShutdownPrivilege	696	chrome.exe
Token: SeShutdownPrivilege	696	chrome.exe
Token: SeShutdownPrivilege	696	chrome.exe
Token: SeShutdownPrivilege	696	chrome.exe
Token: SeShutdownPrivilege	696	chrome.exe
Token: SeShutdownPrivilege	696	chrome.exe
Token: SeShutdownPrivilege	696	chrome.exe
Token: SeShutdownPrivilege	696	chrome.exe
Token: SeShutdownPrivilege	696	chrome.exe
Token: SeShutdownPrivilege	696	chrome.exe
Token: SeShutdownPrivilege	696	chrome.exe
Token: SeShutdownPrivilege	696	chrome.exe
Token: SeShutdownPrivilege	696	chrome.exe
Token: SeShutdownPrivilege	696	chrome.exe

Suspicious use of FindShellTrayWindow 63 IoCs

pid	Process
2920	vlc.exe
2920	vlc.exe
2920	vlc.exe
2920	vlc.exe
2920	vlc.exe
2920	vlc.exe
2920	vlc.exe
2920	vlc.exe
2920	vlc.exe
2920	vlc.exe
2920	vlc.exe
2920	vlc.exe
2920	vlc.exe
2920	vlc.exe
2920	vlc.exe
2920	vlc.exe
2920	vlc.exe
2920	vlc.exe
2920	vlc.exe
2920	vlc.exe
2920	vlc.exe
2920	vlc.exe
2920	vlc.exe
2920	vlc.exe
2920	vlc.exe
2920	vlc.exe
2920	vlc.exe
2920	vlc.exe
2920	vlc.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe

Suspicious use of SendNotifyMessage 41 IoCs

pid	Process
2920	vlc.exe
2920	vlc.exe
2920	vlc.exe
2920	vlc.exe
2920	vlc.exe
2920	vlc.exe
2920	vlc.exe
2920	vlc.exe
2920	vlc.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe
696	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2920	vlc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 696 wrote to memory of 568	696	chrome.exe	36
PID 696 wrote to memory of 568	696	chrome.exe	36
PID 696 wrote to memory of 568	696	chrome.exe	36
PID 696 wrote to memory of 1688	696	chrome.exe	38
PID 696 wrote to memory of 1688	696	chrome.exe	38
PID 696 wrote to memory of 1688	696	chrome.exe	38
PID 696 wrote to memory of 1688	696	chrome.exe	38
PID 696 wrote to memory of 1688	696	chrome.exe	38
PID 696 wrote to memory of 1688	696	chrome.exe	38
PID 696 wrote to memory of 1688	696	chrome.exe	38
PID 696 wrote to memory of 1688	696	chrome.exe	38
PID 696 wrote to memory of 1688	696	chrome.exe	38
PID 696 wrote to memory of 1688	696	chrome.exe	38
PID 696 wrote to memory of 1688	696	chrome.exe	38
PID 696 wrote to memory of 1688	696	chrome.exe	38
PID 696 wrote to memory of 1688	696	chrome.exe	38
PID 696 wrote to memory of 1688	696	chrome.exe	38
PID 696 wrote to memory of 1688	696	chrome.exe	38
PID 696 wrote to memory of 1688	696	chrome.exe	38
PID 696 wrote to memory of 1688	696	chrome.exe	38
PID 696 wrote to memory of 1688	696	chrome.exe	38
PID 696 wrote to memory of 1688	696	chrome.exe	38
PID 696 wrote to memory of 1688	696	chrome.exe	38
PID 696 wrote to memory of 1688	696	chrome.exe	38
PID 696 wrote to memory of 1688	696	chrome.exe	38
PID 696 wrote to memory of 1688	696	chrome.exe	38
PID 696 wrote to memory of 1688	696	chrome.exe	38
PID 696 wrote to memory of 1688	696	chrome.exe	38
PID 696 wrote to memory of 1688	696	chrome.exe	38
PID 696 wrote to memory of 1688	696	chrome.exe	38
PID 696 wrote to memory of 1688	696	chrome.exe	38
PID 696 wrote to memory of 1688	696	chrome.exe	38
PID 696 wrote to memory of 1688	696	chrome.exe	38
PID 696 wrote to memory of 1688	696	chrome.exe	38
PID 696 wrote to memory of 1688	696	chrome.exe	38
PID 696 wrote to memory of 1688	696	chrome.exe	38
PID 696 wrote to memory of 1688	696	chrome.exe	38
PID 696 wrote to memory of 1688	696	chrome.exe	38
PID 696 wrote to memory of 1688	696	chrome.exe	38
PID 696 wrote to memory of 1688	696	chrome.exe	38
PID 696 wrote to memory of 1688	696	chrome.exe	38
PID 696 wrote to memory of 1688	696	chrome.exe	38
PID 696 wrote to memory of 2088	696	chrome.exe	40
PID 696 wrote to memory of 2088	696	chrome.exe	40
PID 696 wrote to memory of 2088	696	chrome.exe	40
PID 696 wrote to memory of 2228	696	chrome.exe	39
PID 696 wrote to memory of 2228	696	chrome.exe	39
PID 696 wrote to memory of 2228	696	chrome.exe	39
PID 696 wrote to memory of 2228	696	chrome.exe	39
PID 696 wrote to memory of 2228	696	chrome.exe	39
PID 696 wrote to memory of 2228	696	chrome.exe	39
PID 696 wrote to memory of 2228	696	chrome.exe	39
PID 696 wrote to memory of 2228	696	chrome.exe	39
PID 696 wrote to memory of 2228	696	chrome.exe	39
PID 696 wrote to memory of 2228	696	chrome.exe	39
PID 696 wrote to memory of 2228	696	chrome.exe	39
PID 696 wrote to memory of 2228	696	chrome.exe	39
PID 696 wrote to memory of 2228	696	chrome.exe	39
PID 696 wrote to memory of 2228	696	chrome.exe	39
PID 696 wrote to memory of 2228	696	chrome.exe	39
PID 696 wrote to memory of 2228	696	chrome.exe	39
PID 696 wrote to memory of 2228	696	chrome.exe	39
PID 696 wrote to memory of 2228	696	chrome.exe	39
PID 696 wrote to memory of 2228	696	chrome.exe	39

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\y+tu+keri+o+nooo++#magicgang.mp4"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2920

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:2432

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\test.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:1952

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7feee7a9758,0x7feee7a9768,0x7feee7a9778
  2⤵
  PID:568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1112 --field-trial-handle=1340,i,13746655049409399991,6639570540453749298,131072 /prefetch:2
  2⤵
  PID:1688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1568 --field-trial-handle=1340,i,13746655049409399991,6639570540453749298,131072 /prefetch:8
  2⤵
  PID:2228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1516 --field-trial-handle=1340,i,13746655049409399991,6639570540453749298,131072 /prefetch:8
  2⤵
  PID:2088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2212 --field-trial-handle=1340,i,13746655049409399991,6639570540453749298,131072 /prefetch:1
  2⤵
  PID:1116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2204 --field-trial-handle=1340,i,13746655049409399991,6639570540453749298,131072 /prefetch:1
  2⤵
  PID:1948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1360 --field-trial-handle=1340,i,13746655049409399991,6639570540453749298,131072 /prefetch:2
  2⤵
  PID:1592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1416 --field-trial-handle=1340,i,13746655049409399991,6639570540453749298,131072 /prefetch:1
  2⤵
  PID:2012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3476 --field-trial-handle=1340,i,13746655049409399991,6639570540453749298,131072 /prefetch:8
  2⤵
  PID:2652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1208 --field-trial-handle=1340,i,13746655049409399991,6639570540453749298,131072 /prefetch:8
  2⤵
  PID:2376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3612 --field-trial-handle=1340,i,13746655049409399991,6639570540453749298,131072 /prefetch:8
  2⤵
  PID:3028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3860 --field-trial-handle=1340,i,13746655049409399991,6639570540453749298,131072 /prefetch:8
  2⤵
  PID:2860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4052 --field-trial-handle=1340,i,13746655049409399991,6639570540453749298,131072 /prefetch:1
  2⤵
  PID:2020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4244 --field-trial-handle=1340,i,13746655049409399991,6639570540453749298,131072 /prefetch:8
  2⤵
  PID:1888

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2680

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:1572

C:\Windows\system32\cmd.exe
cmd /c ""C:\Users\Admin\Desktop\test.bat" "
1⤵
PID:2380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
7c99a77bf2d14ec7aeca78a08ad066f1

SHA1
f3dbd5a29f304d8be660a4221db0fc7dbb65cbe6

SHA256
532dc96a3efcacce0d75b1377632f4cf669c82b1f9137d6f5d04bab5c3f57e28

SHA512
2fe296f0d078a7ada3f1530eb2bc766e25256f38ffdbeefd0cba0c47911c86edc882f7ce4cf070848ebf47661eb9d786e0f6d2f4b5b941cb26b482f63fb29def

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
363B

MD5
b9b30dee01b2835e5a3137ce38a52023

SHA1
0405ba1d9ea325037f018ca7a115ec88b1910b4b

SHA256
b2d44c03dd03e991b4a8a75ae7b7baaca994d41c4db8915a5dbb9a85f3bfdabc

SHA512
982f0ad9d59089a7fae60789fe0e29d8c2044c65d955b03395c64c820d4b89904d98bff59e482ec23003f53247af7cd8ee0d87631ad0abd1c0a222e225562720

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
03163f6eb5d7a24b44b5dd741f127c81

SHA1
a439a6adced7b9e879aae0423217d409225a97e7

SHA256
3555fd73083b2266a83a97d90b232ab37332d46ee280630fca99a668e48e4b5f

SHA512
ebdf9985eb7e0b5653010628ec1ec9fb392eb06352004b4db08b57b3d1959a22b75b9fa0cc57acd14027a83d5f7472ac00f3a51c985523d33c4aa2cec5ddc233

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
af44357bc5a8e50c3e3e9ae5151c1af4

SHA1
2ace4cff3370c4ae88a7481552c55ef335fbfe20

SHA256
4bba480d4123754da73b47a0d485020772c9f51ec95c4ebb84a0741e67f545c5

SHA512
3b2f926ecfd6c70a6cb4cde50b15ca2331d62f8bbc4c8c4b061a28cb6038e30bd84e5465d892bcbd327359acc34a6b0fa6380b37c3552cc1b8ad68e86c3d2a99

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
b49ab8373ba4b7297b0a74b9c59b0dce

SHA1
bbd801bf487ff6b8b3f5eaf614f58db3b4104ebf

SHA256
3b1b2891f1258e2a601df74f14c1d3a7411ee74a73c4cac129bf2db4ff07ece8

SHA512
c3247d087aa9a02f0f8261c65161294f2019069eb3e7f41766ec42ce0882bb45d41f86cb8479e0d553deb15c08318711247f278c237a97720d3336900319da24

Download Submit
C:\Users\Admin\Desktop\test.bat

Filesize
39B

MD5
37696e6276a43d3eb4e637dbe6982815

SHA1
0f7dcb788316ff1aa55035ca7670b543cc5a7ae8

SHA256
1cc14416d42548e0f2150a0b0466b4a3ca7702929fbbfa9aa82842fe0ddbb84d

SHA512
7ca93cb9f9a08cba6fd3a6ab3fe27ca1841df934a77c2ebe9f89ea3da02d1a8d016be05163a3c6442a0043341ce1de10a7a313defb3da390a48caee926fb164a

Download Submit
memory/2920-36-0x000007FEF4450000-0x000007FEF449C000-memory.dmp

Filesize
304KB

Download
memory/2920-64-0x000007FEF1F30000-0x000007FEF1F42000-memory.dmp

Filesize
72KB

Download
memory/2920-11-0x000007FEF73C0000-0x000007FEF73D7000-memory.dmp

Filesize
92KB

Download
memory/2920-10-0x000007FEF73E0000-0x000007FEF73F1000-memory.dmp

Filesize
68KB

Download
memory/2920-12-0x000007FEF73A0000-0x000007FEF73B1000-memory.dmp

Filesize
68KB

Download
memory/2920-13-0x000007FEF7380000-0x000007FEF739D000-memory.dmp

Filesize
116KB

Download
memory/2920-14-0x000007FEF7360000-0x000007FEF7371000-memory.dmp

Filesize
68KB

Download
memory/2920-15-0x000007FEF5A80000-0x000007FEF5C80000-memory.dmp

Filesize
2.0MB

Download
memory/2920-16-0x000007FEF49D0000-0x000007FEF5A7B000-memory.dmp

Filesize
16.7MB

Download
memory/2920-17-0x000007FEF7320000-0x000007FEF735F000-memory.dmp

Filesize
252KB

Download
memory/2920-40-0x000007FEF2880000-0x000007FEF4030000-memory.dmp

Filesize
23.7MB

Download
memory/2920-19-0x000007FEF71C0000-0x000007FEF71D8000-memory.dmp

Filesize
96KB

Download
memory/2920-20-0x000007FEF71A0000-0x000007FEF71B1000-memory.dmp

Filesize
68KB

Download
memory/2920-21-0x000007FEF6670000-0x000007FEF6681000-memory.dmp

Filesize
68KB

Download
memory/2920-22-0x000007FEF6650000-0x000007FEF6661000-memory.dmp

Filesize
68KB

Download
memory/2920-23-0x000007FEF6630000-0x000007FEF664B000-memory.dmp

Filesize
108KB

Download
memory/2920-24-0x000007FEF6610000-0x000007FEF6621000-memory.dmp

Filesize
68KB

Download
memory/2920-25-0x000007FEF49B0000-0x000007FEF49C8000-memory.dmp

Filesize
96KB

Download
memory/2920-27-0x000007FEF4910000-0x000007FEF4977000-memory.dmp

Filesize
412KB

Download
memory/2920-26-0x000007FEF4980000-0x000007FEF49B0000-memory.dmp

Filesize
192KB

Download
memory/2920-28-0x000007FEF48A0000-0x000007FEF490F000-memory.dmp

Filesize
444KB

Download
memory/2920-29-0x000007FEF4880000-0x000007FEF4891000-memory.dmp

Filesize
68KB

Download
memory/2920-30-0x000007FEF4820000-0x000007FEF4876000-memory.dmp

Filesize
344KB

Download
memory/2920-31-0x000007FEF46A0000-0x000007FEF4818000-memory.dmp

Filesize
1.5MB

Download
memory/2920-32-0x000007FEF4680000-0x000007FEF4697000-memory.dmp

Filesize
92KB

Download
memory/2920-33-0x000007FEF4510000-0x000007FEF4680000-memory.dmp

Filesize
1.4MB

Download
memory/2920-34-0x000007FEF44F0000-0x000007FEF4502000-memory.dmp

Filesize
72KB

Download
memory/2920-35-0x000007FEF44A0000-0x000007FEF44E2000-memory.dmp

Filesize
264KB

Download
memory/2920-8-0x000007FEFB050000-0x000007FEFB068000-memory.dmp

Filesize
96KB

Download
memory/2920-37-0x000007FEF42E0000-0x000007FEF444B000-memory.dmp

Filesize
1.4MB

Download
memory/2920-66-0x000007FEF1EF0000-0x000007FEF1F03000-memory.dmp

Filesize
76KB

Download
memory/2920-9-0x000007FEFAFB0000-0x000007FEFAFC7000-memory.dmp

Filesize
92KB

Download
memory/2920-18-0x000007FEF72F0000-0x000007FEF7311000-memory.dmp

Filesize
132KB

Download
memory/2920-41-0x000007FEFB020000-0x000007FEFB030000-memory.dmp

Filesize
64KB

Download
memory/2920-42-0x000007FEF2850000-0x000007FEF287F000-memory.dmp

Filesize
188KB

Download
memory/2920-43-0x000007FEF2830000-0x000007FEF2841000-memory.dmp

Filesize
68KB

Download
memory/2920-44-0x000007FEF2810000-0x000007FEF2826000-memory.dmp

Filesize
88KB

Download
memory/2920-45-0x000007FEF2740000-0x000007FEF2805000-memory.dmp

Filesize
788KB

Download
memory/2920-46-0x000007FEF26C0000-0x000007FEF2735000-memory.dmp

Filesize
468KB

Download
memory/2920-47-0x000007FEF2650000-0x000007FEF26B2000-memory.dmp

Filesize
392KB

Download
memory/2920-48-0x000007FEF25E0000-0x000007FEF264D000-memory.dmp

Filesize
436KB

Download
memory/2920-49-0x000007FEF25C0000-0x000007FEF25D3000-memory.dmp

Filesize
76KB

Download
memory/2920-50-0x000007FEF25A0000-0x000007FEF25B4000-memory.dmp

Filesize
80KB

Download
memory/2920-51-0x000007FEF2550000-0x000007FEF25A0000-memory.dmp

Filesize
320KB

Download
memory/2920-52-0x000007FEF2530000-0x000007FEF2545000-memory.dmp

Filesize
84KB

Download
memory/2920-53-0x000007FEF2310000-0x000007FEF252D000-memory.dmp

Filesize
2.1MB

Download
memory/2920-54-0x000007FEF22D0000-0x000007FEF22E1000-memory.dmp

Filesize
68KB

Download
memory/2920-55-0x000007FEF22B0000-0x000007FEF22C5000-memory.dmp

Filesize
84KB

Download
memory/2920-56-0x000007FEF2290000-0x000007FEF22A2000-memory.dmp

Filesize
72KB

Download
memory/2920-57-0x000007FEF2110000-0x000007FEF228A000-memory.dmp

Filesize
1.5MB

Download
memory/2920-58-0x000007FEF20E0000-0x000007FEF2103000-memory.dmp

Filesize
140KB

Download
memory/2920-59-0x000007FEF20C0000-0x000007FEF20D3000-memory.dmp

Filesize
76KB

Download
memory/2920-60-0x000007FEF1FC0000-0x000007FEF20B4000-memory.dmp

Filesize
976KB

Download
memory/2920-61-0x000007FEF1F90000-0x000007FEF1FBA000-memory.dmp

Filesize
168KB

Download
memory/2920-62-0x000007FEF1F70000-0x000007FEF1F83000-memory.dmp

Filesize
76KB

Download
memory/2920-63-0x000007FEF1F50000-0x000007FEF1F6B000-memory.dmp

Filesize
108KB

Download
memory/2920-7-0x000007FEF5C80000-0x000007FEF5F34000-memory.dmp

Filesize
2.7MB

Download
memory/2920-6-0x000007FEFAC90000-0x000007FEFACC4000-memory.dmp

Filesize
208KB

Download
memory/2920-5-0x000000013FC50000-0x000000013FD48000-memory.dmp

Filesize
992KB

Download
memory/2920-39-0x000007FEF4030000-0x000007FEF427B000-memory.dmp

Filesize
2.3MB

Download
memory/2920-65-0x000007FEF1F10000-0x000007FEF1F25000-memory.dmp

Filesize
84KB

Download
memory/2920-38-0x000007FEF4280000-0x000007FEF42D7000-memory.dmp

Filesize
348KB

Download
memory/2920-67-0x000007FEF1ED0000-0x000007FEF1EE4000-memory.dmp

Filesize
80KB

Download
memory/2920-68-0x000007FEF1EB0000-0x000007FEF1EC2000-memory.dmp

Filesize
72KB

Download