Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

cryptolaemus

windows10-2004-x64

10

cryptolaemus

windows11-21h2-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/04/2024, 11:37

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b7b89484ef2322e2c2d175b5a52324bc01ff74b5a18937fe52f4caafa17ea700.exe

  • Size

    1.8MB

  • MD5

    2a32676fb29d480f4fa2239fd1150169

  • SHA1

    9d667a64e0435d611535e3ecb942ca29816deb39

  • SHA256

    b7b89484ef2322e2c2d175b5a52324bc01ff74b5a18937fe52f4caafa17ea700

  • SHA512

    7541203406640d75134372b6bcfad9a3d95a8a020ebf3cf09325136fddfbf6b7745ba34398a72647989d0d6af48551b2ba37eef1d5cc31f44bf25c25b9e58c62

  • SSDEEP

    24576:2UKn1+ElUjHXTGNrtkx4/hqS12jZ2uWeWKa67X6gkA/ghWtOASJKGUFLYx21zQ05:580E63i/I4/hZWEiWc6WcWtNYUlYAhQ

Score
10/10
amadeyevasionpersistencespywarestealertrojan

Malware Config

Extracted

Family

amadey

Version

4.18

C2

http://193.233.132.56

Attributes
  • install_dir

    09fd851a4f

  • install_file

    explorha.exe

  • strings_key

    443351145ece4966ded809641c77cfa8

  • url_paths

    /Pneh2sXQk0/index.php

rc4.plain

Extracted

Family

amadey

Version

4.17

C2

http://185.215.113.32

Attributes
  • install_dir

    00c07260dc

  • install_file

    explorgu.exe

  • strings_key

    461809bd97c251ba0c0c8450c7055f1d

  • url_paths

    /yandex/index.php

rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 8 IoCs
    evasion
  • Blocklisted process makes network request 4 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 16 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 8 IoCs
  • Identifies Wine through registry keys 2 TTPs 8 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 6 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 46 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 63 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b7b89484ef2322e2c2d175b5a52324bc01ff74b5a18937fe52f4caafa17ea700.exe
    "C:\Users\Admin\AppData\Local\Temp\b7b89484ef2322e2c2d175b5a52324bc01ff74b5a18937fe52f4caafa17ea700.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:4980
    • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
      "C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4188
      • C:\Users\Admin\AppData\Local\Temp\1000042001\b056a438a7.exe
        "C:\Users\Admin\AppData\Local\Temp\1000042001\b056a438a7.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious behavior: EnumeratesProcesses
        PID:4948
      • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
        "C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"
        3⤵
          PID:3632
        • C:\Users\Admin\AppData\Local\Temp\1000049001\amert.exe
          "C:\Users\Admin\AppData\Local\Temp\1000049001\amert.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          PID:2056
        • C:\Users\Admin\AppData\Local\Temp\1000051001\4e785a95f7.exe
          "C:\Users\Admin\AppData\Local\Temp\1000051001\4e785a95f7.exe"
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:2940
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
            4⤵
            • Enumerates system info in registry
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of WriteProcessMemory
            PID:1536
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe54319758,0x7ffe54319768,0x7ffe54319778
              5⤵
                PID:3504
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1724 --field-trial-handle=1916,i,16604875919166289090,3541583857284474458,131072 /prefetch:2
                5⤵
                  PID:1860
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1916,i,16604875919166289090,3541583857284474458,131072 /prefetch:8
                  5⤵
                    PID:440
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2232 --field-trial-handle=1916,i,16604875919166289090,3541583857284474458,131072 /prefetch:8
                    5⤵
                      PID:1272
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3052 --field-trial-handle=1916,i,16604875919166289090,3541583857284474458,131072 /prefetch:1
                      5⤵
                        PID:5092
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3060 --field-trial-handle=1916,i,16604875919166289090,3541583857284474458,131072 /prefetch:1
                        5⤵
                          PID:3660
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4576 --field-trial-handle=1916,i,16604875919166289090,3541583857284474458,131072 /prefetch:1
                          5⤵
                            PID:3432
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4908 --field-trial-handle=1916,i,16604875919166289090,3541583857284474458,131072 /prefetch:8
                            5⤵
                              PID:3660
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4996 --field-trial-handle=1916,i,16604875919166289090,3541583857284474458,131072 /prefetch:8
                              5⤵
                                PID:1840
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4984 --field-trial-handle=1916,i,16604875919166289090,3541583857284474458,131072 /prefetch:8
                                5⤵
                                  PID:2336
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1848 --field-trial-handle=1916,i,16604875919166289090,3541583857284474458,131072 /prefetch:2
                                  5⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:2112
                            • C:\Windows\SysWOW64\rundll32.exe
                              "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
                              3⤵
                              • Loads dropped DLL
                              PID:3568
                              • C:\Windows\system32\rundll32.exe
                                "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
                                4⤵
                                • Blocklisted process makes network request
                                • Loads dropped DLL
                                • Suspicious behavior: EnumeratesProcesses
                                PID:1940
                                • C:\Windows\system32\netsh.exe
                                  netsh wlan show profiles
                                  5⤵
                                    PID:3624
                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                    powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\660967641992_Desktop.zip' -CompressionLevel Optimal
                                    5⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:4328
                              • C:\Windows\SysWOW64\rundll32.exe
                                "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
                                3⤵
                                • Blocklisted process makes network request
                                • Loads dropped DLL
                                PID:540
                          • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                            C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                            1⤵
                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                            • Checks BIOS information in registry
                            • Executes dropped EXE
                            • Identifies Wine through registry keys
                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                            • Suspicious behavior: EnumeratesProcesses
                            PID:3064
                          • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                            "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                            1⤵
                              PID:2276
                            • C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
                              C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
                              1⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • Suspicious behavior: EnumeratesProcesses
                              PID:876
                              • C:\Windows\SysWOW64\rundll32.exe
                                "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
                                2⤵
                                • Loads dropped DLL
                                PID:4064
                                • C:\Windows\system32\rundll32.exe
                                  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
                                  3⤵
                                  • Blocklisted process makes network request
                                  • Loads dropped DLL
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:3004
                                  • C:\Windows\system32\netsh.exe
                                    netsh wlan show profiles
                                    4⤵
                                      PID:3252
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\660967641992_Desktop.zip' -CompressionLevel Optimal
                                      4⤵
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:220
                                • C:\Windows\SysWOW64\rundll32.exe
                                  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
                                  2⤵
                                  • Blocklisted process makes network request
                                  • Loads dropped DLL
                                  PID:4576
                              • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                1⤵
                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Identifies Wine through registry keys
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                • Suspicious behavior: EnumeratesProcesses
                                PID:4576
                              • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                1⤵
                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Identifies Wine through registry keys
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                • Suspicious behavior: EnumeratesProcesses
                                PID:1940

                              Network

                              MITRE ATT&CK Enterprise v15

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                Filesize

                                216B

                                MD5

                                caa6c1675ae64a8c0e1f784e6e701d85

                                SHA1

                                d494e73b64589f4fc964c89e2f8045cb5cd5dd15

                                SHA256

                                9450db9a992bf4fc2f8a851fec5b3c540fe540de852a30cdc516ca3c1721d8ad

                                SHA512

                                67cb0fb770868ae7e75b2e9758deeb5099aeb2e174f67d28e20d4a840882ce311dd11b2e61157116346a0eca9403363dfb223eee77db5697ee136888c370da6a

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                Filesize

                                2KB

                                MD5

                                115939316ada77132717d2156f5e33b7

                                SHA1

                                0bc3555e3edb9884bcfd758ba3a990bb81ff5b49

                                SHA256

                                8d5897e3fd866403cf6066c2623d61b7055f8163a11ac00318760937aa400b45

                                SHA512

                                16c22ea62389af85594a688214977353ddf4145ee0a3bb37be38d1e8bc21f69f3467255f45e2e099eed93d9956b25235553494d8002f92c9d009ae03aacc56e5

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                Filesize

                                2KB

                                MD5

                                8eb326f6a6b6f8cc9de583ffac920f49

                                SHA1

                                81144c17c9294d77a407f7b3309643cc3bc8677c

                                SHA256

                                8afff0ff1ba6972f9e03ae7e5b119006d3848188511c025e4960f199bb9353cd

                                SHA512

                                f2df8f998ababf2dd41ceb101f9fbe854b910cc01b0b7e0d1a03d4c318237a73c53523a70f85db4da57661530a01bbf45f9e4bd7c474fa8330770b998faac598

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                Filesize

                                707B

                                MD5

                                844e55f366f1799288e9c015054caeea

                                SHA1

                                06771d319ae227c64fde91f620c061541b591248

                                SHA256

                                85940c94ea8e5b01721a4a8f7a35ddd29393fe656cec536123e21601f57c7220

                                SHA512

                                0b226d589eb8459b0ec28ed4d34f3b93d75ca04185d6419479cd2b7667a61373ec875a4308edd41c94431a4d2343c6643938da9bba37ecef7caa97afc7d04859

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                Filesize

                                6KB

                                MD5

                                3567454b3aebb6b802eca79d756da576

                                SHA1

                                c90f18ad58285e953c4825685fc4a9998c9bc689

                                SHA256

                                8c5366b2be8eb7c87f267d7402756d7080b2a51117cf90d46cda8b4feb76079d

                                SHA512

                                806ad7acf8df917bfa9c35fd27974dc847d7dfe6beeb880d16cd8233d424a8c55ff13439deaaeba6dd86ffae1472eb846d81efd775a7c2cb51bf5f7ab49b95e0

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                Filesize

                                15KB

                                MD5

                                6010de6cc6aa568fcdb97ecfee457c34

                                SHA1

                                5a74812d0d037bf0c2c8b201763502ded27ccd2d

                                SHA256

                                706046d2f992706be5019226a5aec0ac075c1d56d520831c86c68eaf251c9f39

                                SHA512

                                dff700c4cfbd3aad1afb36547d43e9ea2d7ce319eeddc73847372ad52608975b54b1537568963b25e627cca2df36b95d57e1ede09f7ef4eb0f1e84d448e54497

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                Filesize

                                260KB

                                MD5

                                2763770a70f7824febef0376a6bba042

                                SHA1

                                43e8ba70a35191c47333cedbc70e497be4c9f53f

                                SHA256

                                42ec1d5d6cc6a8ac0514479bcbd472fa1c2ff11b4f575dec4f831862681dd3be

                                SHA512

                                df6a9c19b07ad6986a1b170839ad345ff28e50a1420c2b1c7d2e4c8bbf8a4f3ec237976aa5625ee3a7086dfc19a7c11b1246a1e78307b10c9e6e77467af20aec

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
                                Filesize

                                2B

                                MD5

                                99914b932bd37a50b983c5e7c90ae93b

                                SHA1

                                bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                SHA256

                                44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                SHA512

                                27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                Filesize

                                3KB

                                MD5

                                fe3aab3ae544a134b68e881b82b70169

                                SHA1

                                926e9b4e527ae1bd9b3b25726e1f59d5a34d36a6

                                SHA256

                                bda499e3f69d8fe0227e734bbb935dc5bf0050d37adf03bc41356dfcb5bcca0b

                                SHA512

                                3fbd3499d98280b6c79c67b0ee183b27692dbc31acf103b4f8ca4dcdf392afff2b3aad500037f4288581ed37e85f45c3bbb5dcde11cddf3ef0609f44b2ecb280

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                Filesize

                                1KB

                                MD5

                                baa7aea69f1fc6de5c6744a3de244d9c

                                SHA1

                                7ac32cd8e4afa29cbb6c04bb8727735c29ebadc5

                                SHA256

                                adb474e336b151cf28ead952e8248f9ec8daf30aadc78e716822d9c27f6dde69

                                SHA512

                                4927c72a9d778a8343f812714356150069349e39937f2e32c62f19ffee226b94eada91756f07f96e22472252f20185177038b3e1e1dd7b8920d676e4e2198f0c

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                Filesize

                                1.8MB

                                MD5

                                2a32676fb29d480f4fa2239fd1150169

                                SHA1

                                9d667a64e0435d611535e3ecb942ca29816deb39

                                SHA256

                                b7b89484ef2322e2c2d175b5a52324bc01ff74b5a18937fe52f4caafa17ea700

                                SHA512

                                7541203406640d75134372b6bcfad9a3d95a8a020ebf3cf09325136fddfbf6b7745ba34398a72647989d0d6af48551b2ba37eef1d5cc31f44bf25c25b9e58c62

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1000042001\b056a438a7.exe
                                Filesize

                                2.1MB

                                MD5

                                b929da8c9fcb6cb73857a40ddac5aab1

                                SHA1

                                b24c4024d3b05f95f784af653603f25210de4354

                                SHA256

                                458a716c62104a5a109edcab77c4b7bb25c52ceb1458efa42d3a9b723018c39c

                                SHA512

                                8c1cd44820273de254c1e4e2af61429280cabaf50f93c88a3890df6f7db072290febc8366ab8f9b09d592533c51287f90946d72f7131e96cd02137fb7677ab41

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1000049001\amert.exe
                                Filesize

                                1.8MB

                                MD5

                                beeee61e8b6cfe13fa2c7d7ce21338a1

                                SHA1

                                79c7f39d270fb7fcd54c947940c4183ffe226350

                                SHA256

                                d110bf26f41ba5f0cee6407fde0baf3fff62e714e43eec41c805cec168436905

                                SHA512

                                5dcee188f325fc1b07cccfaa9ebd92c197e306d2385de35d83794bc5bceed35034acbdccd985af106ebb25a9aa4f46cf4ea1fd25154bf4badb6cee6c8c3f375b

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1000051001\4e785a95f7.exe
                                Filesize

                                1.1MB

                                MD5

                                dd6890ad7fd476d16a355e1417246deb

                                SHA1

                                c1d5cb52902b6d17cda89a791b1d0c2e5e6f5620

                                SHA256

                                cfd42211d3ca585193e805a9573889ad2364eae5a037c440ee6efbf038b46bae

                                SHA512

                                03f4dfebcca08fc90793d0d781e9f70bb25781c6c6474e65e0e8b6badc026c8ceeba3698745eb643d029cfcb39272bbc4b0b6472490513435c83a8779c78a863

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ajhzeznk.j3w.ps1
                                Filesize

                                60B

                                MD5

                                d17fe0a3f47be24a6453e9ef58c94641

                                SHA1

                                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                SHA256

                                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                SHA512

                                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
                                Filesize

                                109KB

                                MD5

                                2afdbe3b99a4736083066a13e4b5d11a

                                SHA1

                                4d4856cf02b3123ac16e63d4a448cdbcb1633546

                                SHA256

                                8d31b39170909595b518b1a03e9ec950540fabd545ed14817cac5c84b91599ee

                                SHA512

                                d89b3c46854153e60e3fa825b394344eee33936d7dbf186af9d95c9adae54428609e3bf21a18d38fce3d96f3e0b8e4e0ed25cb5004fbe288de3aef3a85b1d93f

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll
                                Filesize

                                1.2MB

                                MD5

                                92fbdfccf6a63acef2743631d16652a7

                                SHA1

                                971968b1378dd89d59d7f84bf92f16fc68664506

                                SHA256

                                b4588feacc183cd5a089f9bb950827b75df04bd5a6e67c95ff258e4a34aa0d72

                                SHA512

                                b8ea216d4a59d8858fd4128abb555f8dcf3acca9138e663b488f09dc5200db6dc11ecc235a355e801145bbbb44d7beac6147949d75d78b32fe9cfd2fa200d117

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
                                Filesize

                                109KB

                                MD5

                                726cd06231883a159ec1ce28dd538699

                                SHA1

                                404897e6a133d255ad5a9c26ac6414d7134285a2

                                SHA256

                                12fef2d5995d671ec0e91bdbdc91e2b0d3c90ed3a8b2b13ddaa8ad64727dcd46

                                SHA512

                                9ea82e7cb6c6a58446bd5033855947c3e2d475d2910f2b941235e0b96aa08eec822d2dd17cc86b2d3fce930f78b799291992408e309a6c63e3011266810ea83e

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
                                Filesize

                                1.2MB

                                MD5

                                15a42d3e4579da615a384c717ab2109b

                                SHA1

                                22aeedeb2307b1370cdab70d6a6b6d2c13ad2301

                                SHA256

                                3c97bb410e49b11af8116feb7240b7101e1967cae7538418c45c3d2e072e8103

                                SHA512

                                1eb7f126dccc88a2479e3818c36120f5af3caa0d632b9ea803485ee6531d6e2a1fd0805b1c4364983d280df23ea5ca3ad4a5fca558ac436efae36af9b795c444

                                Download Submit

                              • memory/876-355-0x0000000000100000-0x00000000005BD000-memory.dmp

                                Filesize

                                4.7MB

                                Download

                              • memory/876-349-0x0000000000100000-0x00000000005BD000-memory.dmp

                                Filesize

                                4.7MB

                                Download

                              • memory/876-376-0x0000000000100000-0x00000000005BD000-memory.dmp

                                Filesize

                                4.7MB

                                Download

                              • memory/876-359-0x0000000000100000-0x00000000005BD000-memory.dmp

                                Filesize

                                4.7MB

                                Download

                              • memory/876-388-0x0000000000100000-0x00000000005BD000-memory.dmp

                                Filesize

                                4.7MB

                                Download

                              • memory/876-335-0x0000000000100000-0x00000000005BD000-memory.dmp

                                Filesize

                                4.7MB

                                Download

                              • memory/876-352-0x0000000000100000-0x00000000005BD000-memory.dmp

                                Filesize

                                4.7MB

                                Download

                              • memory/876-284-0x0000000000100000-0x00000000005BD000-memory.dmp

                                Filesize

                                4.7MB

                                Download

                              • memory/1940-368-0x0000000000430000-0x00000000008C3000-memory.dmp

                                Filesize

                                4.6MB

                                Download

                              • memory/2056-100-0x0000000004D70000-0x0000000004D71000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/2056-103-0x0000000004DF0000-0x0000000004DF1000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/2056-104-0x0000000004DE0000-0x0000000004DE1000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/2056-101-0x0000000004DC0000-0x0000000004DC1000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/2056-99-0x0000000004D80000-0x0000000004D81000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/2056-116-0x0000000000CC0000-0x000000000117D000-memory.dmp

                                Filesize

                                4.7MB

                                Download

                              • memory/2056-97-0x0000000004DD0000-0x0000000004DD1000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/2056-98-0x0000000004D60000-0x0000000004D61000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/2056-95-0x0000000004D90000-0x0000000004D91000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/2056-96-0x0000000004DA0000-0x0000000004DA1000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/2056-94-0x0000000000CC0000-0x000000000117D000-memory.dmp

                                Filesize

                                4.7MB

                                Download

                              • memory/2056-93-0x0000000000CC0000-0x000000000117D000-memory.dmp

                                Filesize

                                4.7MB

                                Download

                              • memory/3064-41-0x0000000000430000-0x00000000008C3000-memory.dmp

                                Filesize

                                4.6MB

                                Download

                              • memory/3064-38-0x00000000050C0000-0x00000000050C1000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/3064-24-0x0000000000430000-0x00000000008C3000-memory.dmp

                                Filesize

                                4.6MB

                                Download

                              • memory/3064-33-0x00000000050A0000-0x00000000050A1000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/3064-32-0x0000000005090000-0x0000000005091000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/3064-34-0x0000000005080000-0x0000000005081000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/3064-35-0x00000000050D0000-0x00000000050D1000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/3064-37-0x0000000005070000-0x0000000005071000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/3064-36-0x0000000005060000-0x0000000005061000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/4188-30-0x0000000004C10000-0x0000000004C11000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/4188-25-0x0000000004C30000-0x0000000004C31000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/4188-387-0x0000000000430000-0x00000000008C3000-memory.dmp

                                Filesize

                                4.6MB

                                Download

                              • memory/4188-375-0x0000000000430000-0x00000000008C3000-memory.dmp

                                Filesize

                                4.6MB

                                Download

                              • memory/4188-358-0x0000000000430000-0x00000000008C3000-memory.dmp

                                Filesize

                                4.6MB

                                Download

                              • memory/4188-354-0x0000000000430000-0x00000000008C3000-memory.dmp

                                Filesize

                                4.6MB

                                Download

                              • memory/4188-351-0x0000000000430000-0x00000000008C3000-memory.dmp

                                Filesize

                                4.6MB

                                Download

                              • memory/4188-348-0x0000000000430000-0x00000000008C3000-memory.dmp

                                Filesize

                                4.6MB

                                Download

                              • memory/4188-40-0x0000000004C80000-0x0000000004C81000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/4188-39-0x0000000004C90000-0x0000000004C91000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/4188-22-0x0000000000430000-0x00000000008C3000-memory.dmp

                                Filesize

                                4.6MB

                                Download

                              • memory/4188-334-0x0000000000430000-0x00000000008C3000-memory.dmp

                                Filesize

                                4.6MB

                                Download

                              • memory/4188-155-0x0000000000430000-0x00000000008C3000-memory.dmp

                                Filesize

                                4.6MB

                                Download

                              • memory/4188-201-0x0000000000430000-0x00000000008C3000-memory.dmp

                                Filesize

                                4.6MB

                                Download

                              • memory/4188-26-0x0000000004C40000-0x0000000004C41000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/4188-27-0x0000000004C20000-0x0000000004C21000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/4188-283-0x0000000000430000-0x00000000008C3000-memory.dmp

                                Filesize

                                4.6MB

                                Download

                              • memory/4188-244-0x0000000000430000-0x00000000008C3000-memory.dmp

                                Filesize

                                4.6MB

                                Download

                              • memory/4188-77-0x0000000000430000-0x00000000008C3000-memory.dmp

                                Filesize

                                4.6MB

                                Download

                              • memory/4188-242-0x0000000000430000-0x00000000008C3000-memory.dmp

                                Filesize

                                4.6MB

                                Download

                              • memory/4188-255-0x0000000000430000-0x00000000008C3000-memory.dmp

                                Filesize

                                4.6MB

                                Download

                              • memory/4188-257-0x0000000000430000-0x00000000008C3000-memory.dmp

                                Filesize

                                4.6MB

                                Download

                              • memory/4188-29-0x0000000004C00000-0x0000000004C01000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/4188-28-0x0000000004C70000-0x0000000004C71000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/4188-31-0x0000000004C60000-0x0000000004C61000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/4328-179-0x00000198B25B0000-0x00000198B25D2000-memory.dmp

                                Filesize

                                136KB

                                Download

                              • memory/4328-200-0x00007FFE4F5B0000-0x00007FFE50071000-memory.dmp

                                Filesize

                                10.8MB

                                Download

                              • memory/4328-194-0x00000198B2580000-0x00000198B258A000-memory.dmp

                                Filesize

                                40KB

                                Download

                              • memory/4328-193-0x00000198B2920000-0x00000198B2932000-memory.dmp

                                Filesize

                                72KB

                                Download

                              • memory/4328-192-0x00000198B25A0000-0x00000198B25B0000-memory.dmp

                                Filesize

                                64KB

                                Download

                              • memory/4328-191-0x00000198B25A0000-0x00000198B25B0000-memory.dmp

                                Filesize

                                64KB

                                Download

                              • memory/4328-190-0x00000198B25A0000-0x00000198B25B0000-memory.dmp

                                Filesize

                                64KB

                                Download

                              • memory/4328-189-0x00007FFE4F5B0000-0x00007FFE50071000-memory.dmp

                                Filesize

                                10.8MB

                                Download

                              • memory/4576-278-0x0000000000430000-0x00000000008C3000-memory.dmp

                                Filesize

                                4.6MB

                                Download

                              • memory/4576-261-0x0000000000430000-0x00000000008C3000-memory.dmp

                                Filesize

                                4.6MB

                                Download

                              • memory/4948-66-0x0000000004C90000-0x0000000004C91000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/4948-347-0x0000000000FF0000-0x0000000001567000-memory.dmp

                                Filesize

                                5.5MB

                                Download

                              • memory/4948-71-0x0000000004D30000-0x0000000004D31000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/4948-74-0x0000000004D60000-0x0000000004D62000-memory.dmp

                                Filesize

                                8KB

                                Download

                              • memory/4948-256-0x0000000000FF0000-0x0000000001567000-memory.dmp

                                Filesize

                                5.5MB

                                Download

                              • memory/4948-236-0x0000000000FF0000-0x0000000001567000-memory.dmp

                                Filesize

                                5.5MB

                                Download

                              • memory/4948-73-0x0000000004C80000-0x0000000004C81000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/4948-245-0x0000000000FF0000-0x0000000001567000-memory.dmp

                                Filesize

                                5.5MB

                                Download

                              • memory/4948-281-0x0000000000FF0000-0x0000000001567000-memory.dmp

                                Filesize

                                5.5MB

                                Download

                              • memory/4948-178-0x0000000000FF0000-0x0000000001567000-memory.dmp

                                Filesize

                                5.5MB

                                Download

                              • memory/4948-177-0x0000000000FF0000-0x0000000001567000-memory.dmp

                                Filesize

                                5.5MB

                                Download

                              • memory/4948-70-0x0000000004D40000-0x0000000004D41000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/4948-298-0x0000000000FF0000-0x0000000001567000-memory.dmp

                                Filesize

                                5.5MB

                                Download

                              • memory/4948-69-0x0000000004CF0000-0x0000000004CF1000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/4948-72-0x0000000004CD0000-0x0000000004CD1000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/4948-389-0x0000000000FF0000-0x0000000001567000-memory.dmp

                                Filesize

                                5.5MB

                                Download

                              • memory/4948-68-0x0000000004D10000-0x0000000004D11000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/4948-67-0x0000000004D00000-0x0000000004D01000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/4948-65-0x0000000004CA0000-0x0000000004CA1000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/4948-243-0x0000000000FF0000-0x0000000001567000-memory.dmp

                                Filesize

                                5.5MB

                                Download

                              • memory/4948-377-0x0000000000FF0000-0x0000000001567000-memory.dmp

                                Filesize

                                5.5MB

                                Download

                              • memory/4948-64-0x0000000004D20000-0x0000000004D21000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/4948-350-0x0000000000FF0000-0x0000000001567000-memory.dmp

                                Filesize

                                5.5MB

                                Download

                              • memory/4948-61-0x0000000000FF0000-0x0000000001567000-memory.dmp

                                Filesize

                                5.5MB

                                Download

                              • memory/4948-369-0x0000000000FF0000-0x0000000001567000-memory.dmp

                                Filesize

                                5.5MB

                                Download

                              • memory/4948-353-0x0000000000FF0000-0x0000000001567000-memory.dmp

                                Filesize

                                5.5MB

                                Download

                              • memory/4948-63-0x0000000004CB0000-0x0000000004CB1000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/4948-62-0x0000000004CE0000-0x0000000004CE1000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/4948-356-0x0000000000FF0000-0x0000000001567000-memory.dmp

                                Filesize

                                5.5MB

                                Download

                              • memory/4980-5-0x0000000004BD0000-0x0000000004BD1000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/4980-4-0x0000000004C30000-0x0000000004C31000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/4980-6-0x0000000004BF0000-0x0000000004BF1000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/4980-2-0x0000000004C00000-0x0000000004C01000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/4980-9-0x0000000004C50000-0x0000000004C51000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/4980-7-0x0000000004BE0000-0x0000000004BE1000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/4980-0-0x00000000003C0000-0x0000000000853000-memory.dmp

                                Filesize

                                4.6MB

                                Download

                              • memory/4980-3-0x0000000004C10000-0x0000000004C11000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/4980-8-0x0000000004C60000-0x0000000004C61000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/4980-1-0x00000000770A4000-0x00000000770A6000-memory.dmp

                                Filesize

                                8KB

                                Download

                              • memory/4980-21-0x00000000003C0000-0x0000000000853000-memory.dmp

                                Filesize

                                4.6MB

                                Download