Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/04/2024, 22:34

General

  • Target

    937749856b2253b541232393c4c584411429dcbca9e23e19bc4af8d4d6da21d3.exe

  • Size

    1.8MB

  • MD5

    48ac3259b0fdd5f749428bd7ebb472b9

  • SHA1

    f5336a039709bd017eed3e343bb931f4559422eb

  • SHA256

    937749856b2253b541232393c4c584411429dcbca9e23e19bc4af8d4d6da21d3

  • SHA512

    df2058745f08825244a0a7a87d97e51cac4e6a631387240f75a84bd28a4f2a9075d6f4efd82080ba61560fc350c1171717d76aa50a42de511916924a64e24f93

  • SSDEEP

    49152:V3/bnpzPFRJPVUpFppguVbE2ABsHboF2a9n+uqf:VjnBPFgFpp5Vr7oj+uq

Malware Config

Extracted

Family

amadey

Version

4.20

C2

http://193.233.132.139

Attributes
  • install_dir

    5454e6f062

  • install_file

    explorta.exe

  • strings_key

    c7a869c5ba1d72480093ec207994e2bf

  • url_paths

    /sev56rkm/index.php

rc4.plain

Extracted

Family

amadey

Version

4.17

C2

http://193.233.132.167

Attributes
  • install_dir

    4d0ab15804

  • install_file

    chrosha.exe

  • strings_key

    1a9519d7b465e1f4880fa09a6162d768

  • url_paths

    /enigma/index.php

rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs
  • Blocklisted process makes network request 2 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 14 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 7 IoCs
  • Identifies Wine through registry keys 2 TTPs 7 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 3 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 33 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 63 IoCs
  • Suspicious use of SendNotifyMessage 60 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\937749856b2253b541232393c4c584411429dcbca9e23e19bc4af8d4d6da21d3.exe
    "C:\Users\Admin\AppData\Local\Temp\937749856b2253b541232393c4c584411429dcbca9e23e19bc4af8d4d6da21d3.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3164
    • C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
      "C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1644
      • C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
        "C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe"
        3⤵
          PID:2636
        • C:\Users\Admin\AppData\Local\Temp\1000015001\amert.exe
          "C:\Users\Admin\AppData\Local\Temp\1000015001\amert.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          PID:4644
        • C:\Users\Admin\AppData\Local\Temp\1000016001\2684e01719.exe
          "C:\Users\Admin\AppData\Local\Temp\1000016001\2684e01719.exe"
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:944
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
            4⤵
            • Enumerates system info in registry
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of WriteProcessMemory
            PID:4616
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8cbc0ab58,0x7ff8cbc0ab68,0x7ff8cbc0ab78
              5⤵
                PID:3696
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1776 --field-trial-handle=1956,i,9236549510112467234,12161413674465383394,131072 /prefetch:2
                5⤵
                  PID:560
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 --field-trial-handle=1956,i,9236549510112467234,12161413674465383394,131072 /prefetch:8
                  5⤵
                    PID:1188
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2284 --field-trial-handle=1956,i,9236549510112467234,12161413674465383394,131072 /prefetch:8
                    5⤵
                      PID:4356
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3104 --field-trial-handle=1956,i,9236549510112467234,12161413674465383394,131072 /prefetch:1
                      5⤵
                        PID:3676
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3112 --field-trial-handle=1956,i,9236549510112467234,12161413674465383394,131072 /prefetch:1
                        5⤵
                          PID:880
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4344 --field-trial-handle=1956,i,9236549510112467234,12161413674465383394,131072 /prefetch:1
                          5⤵
                            PID:4388
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3500 --field-trial-handle=1956,i,9236549510112467234,12161413674465383394,131072 /prefetch:1
                            5⤵
                              PID:4872
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4492 --field-trial-handle=1956,i,9236549510112467234,12161413674465383394,131072 /prefetch:8
                              5⤵
                                PID:3520
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4564 --field-trial-handle=1956,i,9236549510112467234,12161413674465383394,131072 /prefetch:8
                                5⤵
                                • Modifies registry class
                                PID:1680
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5004 --field-trial-handle=1956,i,9236549510112467234,12161413674465383394,131072 /prefetch:8
                                5⤵
                                  PID:3612
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5100 --field-trial-handle=1956,i,9236549510112467234,12161413674465383394,131072 /prefetch:8
                                  5⤵
                                    PID:1876
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 --field-trial-handle=1956,i,9236549510112467234,12161413674465383394,131072 /prefetch:8
                                    5⤵
                                      PID:3904
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 --field-trial-handle=1956,i,9236549510112467234,12161413674465383394,131072 /prefetch:8
                                      5⤵
                                        PID:4788
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5476 --field-trial-handle=1956,i,9236549510112467234,12161413674465383394,131072 /prefetch:8
                                        5⤵
                                          PID:3140
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5492 --field-trial-handle=1956,i,9236549510112467234,12161413674465383394,131072 /prefetch:8
                                          5⤵
                                            PID:2996
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=848 --field-trial-handle=1956,i,9236549510112467234,12161413674465383394,131072 /prefetch:2
                                            5⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:796
                                      • C:\Users\Admin\1000017002\90b41e266c.exe
                                        "C:\Users\Admin\1000017002\90b41e266c.exe"
                                        3⤵
                                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                        • Checks BIOS information in registry
                                        • Executes dropped EXE
                                        • Identifies Wine through registry keys
                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:5072
                                  • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                                    "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
                                    1⤵
                                      PID:1748
                                    • C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
                                      C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
                                      1⤵
                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                      • Checks BIOS information in registry
                                      • Checks computer location settings
                                      • Executes dropped EXE
                                      • Identifies Wine through registry keys
                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:4392
                                      • C:\Windows\SysWOW64\rundll32.exe
                                        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
                                        2⤵
                                        • Loads dropped DLL
                                        PID:4988
                                        • C:\Windows\system32\rundll32.exe
                                          "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
                                          3⤵
                                          • Blocklisted process makes network request
                                          • Loads dropped DLL
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:944
                                          • C:\Windows\system32\netsh.exe
                                            netsh wlan show profiles
                                            4⤵
                                              PID:636
                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\906287020291_Desktop.zip' -CompressionLevel Optimal
                                              4⤵
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:3956
                                        • C:\Windows\SysWOW64\rundll32.exe
                                          "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main
                                          2⤵
                                          • Blocklisted process makes network request
                                          • Loads dropped DLL
                                          PID:1140
                                      • C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
                                        C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
                                        1⤵
                                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                        • Checks BIOS information in registry
                                        • Executes dropped EXE
                                        • Identifies Wine through registry keys
                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:4688
                                      • C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
                                        C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
                                        1⤵
                                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                        • Checks BIOS information in registry
                                        • Executes dropped EXE
                                        • Identifies Wine through registry keys
                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:1132

                                      Network

                                      MITRE ATT&CK Enterprise v15

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      • C:\Users\Admin\1000017002\90b41e266c.exe

                                        Filesize

                                        2.3MB

                                        MD5

                                        801b19f2796d2286d2f7fdf447a13e05

                                        SHA1

                                        8e3e634361026edb79593710c090438a59f2e7a8

                                        SHA256

                                        1b3bc235e7b608b8300d495a99da998fffe0325db9a66802f053a28086ec44d8

                                        SHA512

                                        b77ac069e257ad83a189fb3eb7b16533d6fd3ba5ffde6db88e447d0614377ad7b4cea1727ade685cbaf787ea546c237c60a8369cb10cb6fa1ee791268b1fa8b1

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                        Filesize

                                        336B

                                        MD5

                                        c5c2a809883238db14faebc8a88e5c69

                                        SHA1

                                        5fb7da144763d7070127457035d08c7c022cfb1a

                                        SHA256

                                        5a992fb0a2d95627c43f300c782779ba62efec2dab45e29e7daef9ad7b262585

                                        SHA512

                                        0b5eb80202c5b9dad9c3bf96073c4ffbb08f0963ca63bc819608cd705e5b7dbc45ee3752719f8ac9522be7f0d52da6d682d92ed0b4d6e00168d7fba36e71c0e1

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                        Filesize

                                        2KB

                                        MD5

                                        0a0fc85f6cf5cb985ce384e6dfe8efd7

                                        SHA1

                                        a7b0494854108b63d315e98d2b0a7dce184871ec

                                        SHA256

                                        5d16689f209542ecc52765903f496c4280a6015142d0982ff7a235d3cad0668d

                                        SHA512

                                        a6739bd374e98b43492b5a570d90f84e00cfa14cfc84ac24faa4f0f04945bc49fe347aaf50f0aefcf53e51bcd2bbf0602a978522cf7fc2a2b5bf1128c52cc8b6

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                        Filesize

                                        2KB

                                        MD5

                                        c35d1cd186cade8eb93dc8f70a54848c

                                        SHA1

                                        493e2092f9eb41f34577d295665db423da8af500

                                        SHA256

                                        8bd47a9289488fabf7b13e8db2789d4bd27183992541e9a77cf598b06390d888

                                        SHA512

                                        310cfedc15c039cb7cd4d673c7da18d0f45fcad1168345974ac1c5667c15cdcc9ca805e5706cb49d5ac7e7e4439c36a5e24d53b3f240bbb5abdf792f1e4d3fcd

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                        Filesize

                                        2B

                                        MD5

                                        d751713988987e9331980363e24189ce

                                        SHA1

                                        97d170e1550eee4afc0af065b78cda302a97674c

                                        SHA256

                                        4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                        SHA512

                                        b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                        Filesize

                                        524B

                                        MD5

                                        daf6d85bfe216d6e3f3036a625ce7019

                                        SHA1

                                        f5561ca7bd1390e71f23ae3a4c8ad0eb66a210cf

                                        SHA256

                                        beb276a5c8d63cfa0e03d91a79fe98422242eb27f40cfa213d6bf7ac0be6ad45

                                        SHA512

                                        ff853811dc9a14cce44e6dbe772ac5938635e8371f3f7dffe71f8fb2e93b963c05644d43aedc735f627712d0e9880abc09614034877f0243d5f47b02f0fa1723

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                        Filesize

                                        524B

                                        MD5

                                        9f67a73a77eccfca15577cc2ec02d7cb

                                        SHA1

                                        64bb8a19edd31b7ed5edc5464c795cad974e1d36

                                        SHA256

                                        b34835cb24bd0e15de7340bcad1eacab9f6f600128a7952c22027c8533752638

                                        SHA512

                                        95b61cf8ff19128cd4eb2077f40547cfa7b22512724f434159f5bc788b98b234d5f1134e6a1f315e4eae635e917593cade15b3025b61155dc1af9fea0411a4bc

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                        Filesize

                                        7KB

                                        MD5

                                        f2c7a61273db395884a343a3b85c7bb2

                                        SHA1

                                        8ad2d2ab0b8cc29c1f444b4e7805e83c39618e62

                                        SHA256

                                        c56de18e434c74a52b3a8db8ba2344f440bd8c467fca6d3ac38608ecfd6bb2c5

                                        SHA512

                                        2a400483bc5451ff299d273202c7115a8f0ae66cf9203580e6b3d788294542efe8bb66232e74bc3e32b89c861a4169d11b65f4f76f324e8d0bacfb7938ad33c0

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                        Filesize

                                        259KB

                                        MD5

                                        68714f3ffc3994c91ba575dfd2ef8134

                                        SHA1

                                        1e2a10b49d7f9bb516cbe4b8b8610241f2cdfe93

                                        SHA256

                                        bbd2d4232f7d722c07ac047873fb4b294ebe8b3c2cdfb8103ce4aedbc1f75c5a

                                        SHA512

                                        b16f4ca533092de8fd4053aab60fcfc5d91fcecb92272058621de9becec58cd7cf1998902ba3e811229ae96a0deb4aac4b6d2e69fb038a6770c7c2330f16ac76

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                        Filesize

                                        258KB

                                        MD5

                                        d95ac99f10cb754e6a159a1d7a3a2fe4

                                        SHA1

                                        d8d93a3964912b4b088e3c393778bd243b608620

                                        SHA256

                                        40549e9ff34282e6ad03b7bfa84d9989a3f83d223debe6c1e342e6d2366c5256

                                        SHA512

                                        7be66f870ce59e24c615a0b127d7e050228013bb160ab988ca7de82222868b0f34dd809f27bd5651a1c82b193db5540db37f978d7b237cf3f57c63559ad97654

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                        Filesize

                                        131KB

                                        MD5

                                        ac71c08cb26b83ee3cf97891306edbcd

                                        SHA1

                                        dcc8f8ded8299ac95922002c32bfd050a0524e43

                                        SHA256

                                        f1b909c62b5b9746ef728664c7ad0792f049c4baf37ec3b0081afa5580cd0f24

                                        SHA512

                                        a63dbda65323212370c7893ca22586a00dd75b2ee1910022c1eece6918027021cd978cab1b3ec9e9388d08fde101ac9d5334156ac08284848df3e091a39c00d9

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                        Filesize

                                        258KB

                                        MD5

                                        7b72089985630be943ba5dbb77078d98

                                        SHA1

                                        3723c4978e7a208054c82bd548a8c5b2ef3cbd9b

                                        SHA256

                                        a788551d0c2ba7c29d95adec48a117588d1c65fc9b5a1d7ec1d03683f300acb8

                                        SHA512

                                        267dd38ddaf1107f206dcc1a43f28c2c089a87dda12ca8f850772fd8903e7cccac98894bea020a923ac54355dcc65f298f084a96b1a9a2e5986277b3f2dfb8ae

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                        Filesize

                                        278KB

                                        MD5

                                        76b65236110512c7abcdf886a0e2c0cc

                                        SHA1

                                        53ccd22cf134c33149eddb9e46955e08782d83ce

                                        SHA256

                                        1d2f530d02db9758087e31645a0dfb4d072de73c0e5f650a611dbbc9cb781ed5

                                        SHA512

                                        c0327172959ac3e0c0775e658ec64b6d78e57179256449c2a23c467b8033eab83526429624371b8cbbb52d040b72f5d3cc7731a827fec5c8af531a311346858a

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

                                        Filesize

                                        97KB

                                        MD5

                                        2686f94ca4090cccf36c283d5734b662

                                        SHA1

                                        dffe0c676e0fb49dfd790656c36f050d1e57799d

                                        SHA256

                                        b503fe4283db2b8c9bc6b23d2dcc0dd430da9f9972cbfa72d4e5a2120b0ff307

                                        SHA512

                                        d4671e965df9fe9066ae12908af8eb0f796145b36ca624ef7cf4a98d75980ac6e77d6d81a84c1b9c8c8108803718a3dba9ddbf2668c4646be76320245b64baa4

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe57f9d1.TMP

                                        Filesize

                                        94KB

                                        MD5

                                        3d6c5d7d4bdc8bfcdaa394529ecd2f7e

                                        SHA1

                                        7f81334ce2e26251649020ad273749a99efb60e5

                                        SHA256

                                        9463152b1c07de4c9f2ed056e53ad0a9f8375f01c49d5ac2b3fb04b718860109

                                        SHA512

                                        0d9bcc34b00907d034e816ab9703d2f154ec1b066395ba45b646aa7c5312cfd95be2037423482a7d2d79d335975717e32e169d959887f9c316b4f34788a39c8c

                                      • C:\Users\Admin\AppData\Local\Temp\1000015001\amert.exe

                                        Filesize

                                        1.8MB

                                        MD5

                                        9f6e7b7f50b93456b02188a035326eaf

                                        SHA1

                                        cdaee45f2159e5e827b0f55a1ed7a8646a5213c8

                                        SHA256

                                        171bbf7a3a793e554588cc9f295df6e503f6742ebf1e8314220e19bfb3daa524

                                        SHA512

                                        458fc3566163e5be71bcb873ba2fc26645cd4850a0d765955494827b76e94ef379d1704f29193ff2395aa155169360bb31ae907e7decb7e92a602eb11178225d

                                      • C:\Users\Admin\AppData\Local\Temp\1000016001\2684e01719.exe

                                        Filesize

                                        1.1MB

                                        MD5

                                        ad1cee06a18fc8ad3f39f0fab7ef45c8

                                        SHA1

                                        942a8d7c97877b99c1dc81a57f8a21b3e5630eb1

                                        SHA256

                                        ae7efc2b7715a2a23740a457e88d87abbb9ef289b149508eaeb6ff426b0edd8b

                                        SHA512

                                        9c8f99a9512732ae1c0e79b64530006d065d54e47761ee7b15f4df17ff4690039a8595bdbf1b2f8d3b892fccdfc60695b5c2329ea2fa75528289a77a928d3b41

                                      • C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe

                                        Filesize

                                        1.8MB

                                        MD5

                                        48ac3259b0fdd5f749428bd7ebb472b9

                                        SHA1

                                        f5336a039709bd017eed3e343bb931f4559422eb

                                        SHA256

                                        937749856b2253b541232393c4c584411429dcbca9e23e19bc4af8d4d6da21d3

                                        SHA512

                                        df2058745f08825244a0a7a87d97e51cac4e6a631387240f75a84bd28a4f2a9075d6f4efd82080ba61560fc350c1171717d76aa50a42de511916924a64e24f93

                                      • C:\Users\Admin\AppData\Local\Temp\906287020291_Desktop.zip

                                        Filesize

                                        302KB

                                        MD5

                                        9468d4f33b9922f32c07be1f56e8dbe5

                                        SHA1

                                        8fc0057903391ae0a30237792d549388340c4c1b

                                        SHA256

                                        eadb23f922bb57ab2278610cb6bd160bf67d85fc594f9c9e8c3675df2d0ba419

                                        SHA512

                                        f7cf34357145c5df0a0d76756cc47998fde99ae25eab0aa8e3764c57917c0cbd229a6782cdc83e593fa9ddf6c7cc17e70902a1fc24403535100cdc6d5afb140b

                                      • C:\Users\Admin\AppData\Local\Temp\_Files_\OptimizeExpand.docx

                                        Filesize

                                        179KB

                                        MD5

                                        f99da72efeaf7e16fb24722540af26b9

                                        SHA1

                                        9b64ff603d5412c06e683d52bb28b0f75fab348d

                                        SHA256

                                        84eacdc92345f1bfa395576b0d48e2f1bdc1b990caa97288d6657638b6770a09

                                        SHA512

                                        5b7709c86c54b288c65b63f9200f602094d7044b1f155e918cca2fa6565be634ed67c10455c2a9fe8a5063aa20cda684b67fedbba6babeb556b40d19c5343d27

                                      • C:\Users\Admin\AppData\Local\Temp\_Files_\SearchTrace.txt

                                        Filesize

                                        121KB

                                        MD5

                                        e43ff42056da7240f20ca42f64f63b9f

                                        SHA1

                                        c6b6ed4b19232196811b696f20016779d8f6e5dd

                                        SHA256

                                        a29e530d2908a29f5533ee0ce718445e77991e431b0c38418cd4e35d50080b7c

                                        SHA512

                                        fd842aac07a894c2785443f91abed89418a597efaf1a4155f351eaebfbd3bc4ade88ecf7db962e99dbecf0a025ef5a21bd263b06b1acf27ffe6c302ec8ba3037

                                      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qlc20hhy.vgo.ps1

                                        Filesize

                                        60B

                                        MD5

                                        d17fe0a3f47be24a6453e9ef58c94641

                                        SHA1

                                        6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                        SHA256

                                        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                        SHA512

                                        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                      • C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll

                                        Filesize

                                        109KB

                                        MD5

                                        154c3f1334dd435f562672f2664fea6b

                                        SHA1

                                        51dd25e2ba98b8546de163b8f26e2972a90c2c79

                                        SHA256

                                        5f431129f97f3d56929f1e5584819e091bd6c854d7e18503074737fc6d79e33f

                                        SHA512

                                        1bca69bbcdb7ecd418769e9d4befc458f9f8e3cee81feb7316bb61e189e2904f4431e4cc7d291e179a5dec441b959d428d8e433f579036f763bbad6460222841

                                      • C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll

                                        Filesize

                                        1.2MB

                                        MD5

                                        f35b671fda2603ec30ace10946f11a90

                                        SHA1

                                        059ad6b06559d4db581b1879e709f32f80850872

                                        SHA256

                                        83e3df5bec15d5333935bea8b719a6d677e2fb3dc1cf9e18e7b82fd0438285c7

                                        SHA512

                                        b5fa27d08c64727cef7fdda5e68054a4359cd697df50d70d1d90da583195959a139066a6214531bbc5f20cd4f9bc1ca3e4244396547381291a6a1d2df9cf8705

                                      • memory/1132-331-0x0000000000540000-0x00000000009E2000-memory.dmp

                                        Filesize

                                        4.6MB

                                      • memory/1132-332-0x0000000000540000-0x00000000009E2000-memory.dmp

                                        Filesize

                                        4.6MB

                                      • memory/1644-310-0x0000000000540000-0x00000000009E2000-memory.dmp

                                        Filesize

                                        4.6MB

                                      • memory/1644-223-0x0000000000540000-0x00000000009E2000-memory.dmp

                                        Filesize

                                        4.6MB

                                      • memory/1644-354-0x0000000000540000-0x00000000009E2000-memory.dmp

                                        Filesize

                                        4.6MB

                                      • memory/1644-33-0x0000000005210000-0x0000000005211000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/1644-342-0x0000000000540000-0x00000000009E2000-memory.dmp

                                        Filesize

                                        4.6MB

                                      • memory/1644-151-0x0000000000540000-0x00000000009E2000-memory.dmp

                                        Filesize

                                        4.6MB

                                      • memory/1644-32-0x0000000005220000-0x0000000005221000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/1644-25-0x00000000051C0000-0x00000000051C1000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/1644-26-0x00000000051D0000-0x00000000051D1000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/1644-174-0x0000000000540000-0x00000000009E2000-memory.dmp

                                        Filesize

                                        4.6MB

                                      • memory/1644-334-0x0000000000540000-0x00000000009E2000-memory.dmp

                                        Filesize

                                        4.6MB

                                      • memory/1644-179-0x0000000000540000-0x00000000009E2000-memory.dmp

                                        Filesize

                                        4.6MB

                                      • memory/1644-27-0x00000000051B0000-0x00000000051B1000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/1644-328-0x0000000000540000-0x00000000009E2000-memory.dmp

                                        Filesize

                                        4.6MB

                                      • memory/1644-186-0x0000000000540000-0x00000000009E2000-memory.dmp

                                        Filesize

                                        4.6MB

                                      • memory/1644-325-0x0000000000540000-0x00000000009E2000-memory.dmp

                                        Filesize

                                        4.6MB

                                      • memory/1644-192-0x0000000000540000-0x00000000009E2000-memory.dmp

                                        Filesize

                                        4.6MB

                                      • memory/1644-28-0x0000000005200000-0x0000000005201000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/1644-29-0x0000000005190000-0x0000000005191000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/1644-322-0x0000000000540000-0x00000000009E2000-memory.dmp

                                        Filesize

                                        4.6MB

                                      • memory/1644-214-0x0000000000540000-0x00000000009E2000-memory.dmp

                                        Filesize

                                        4.6MB

                                      • memory/1644-268-0x0000000000540000-0x00000000009E2000-memory.dmp

                                        Filesize

                                        4.6MB

                                      • memory/1644-24-0x0000000000540000-0x00000000009E2000-memory.dmp

                                        Filesize

                                        4.6MB

                                      • memory/1644-31-0x00000000051F0000-0x00000000051F1000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/1644-30-0x00000000051A0000-0x00000000051A1000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/3164-11-0x0000000005110000-0x0000000005111000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/3164-4-0x00000000050B0000-0x00000000050B1000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/3164-1-0x0000000077C54000-0x0000000077C56000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/3164-2-0x00000000050C0000-0x00000000050C1000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/3164-3-0x00000000050D0000-0x00000000050D1000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/3164-0-0x0000000000750000-0x0000000000BF2000-memory.dmp

                                        Filesize

                                        4.6MB

                                      • memory/3164-23-0x0000000000750000-0x0000000000BF2000-memory.dmp

                                        Filesize

                                        4.6MB

                                      • memory/3164-8-0x00000000050F0000-0x00000000050F1000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/3164-6-0x0000000005090000-0x0000000005091000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/3164-7-0x00000000050A0000-0x00000000050A1000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/3164-5-0x0000000005100000-0x0000000005101000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/3164-10-0x0000000005120000-0x0000000005121000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/3956-262-0x0000017C3F280000-0x0000017C3F28A000-memory.dmp

                                        Filesize

                                        40KB

                                      • memory/3956-251-0x0000017C3F240000-0x0000017C3F262000-memory.dmp

                                        Filesize

                                        136KB

                                      • memory/3956-261-0x0000017C573E0000-0x0000017C573F2000-memory.dmp

                                        Filesize

                                        72KB

                                      • memory/4392-311-0x0000000000E20000-0x00000000012EA000-memory.dmp

                                        Filesize

                                        4.8MB

                                      • memory/4392-340-0x0000000000E20000-0x00000000012EA000-memory.dmp

                                        Filesize

                                        4.8MB

                                      • memory/4392-219-0x0000000000E20000-0x00000000012EA000-memory.dmp

                                        Filesize

                                        4.8MB

                                      • memory/4392-355-0x0000000000E20000-0x00000000012EA000-memory.dmp

                                        Filesize

                                        4.8MB

                                      • memory/4392-288-0x0000000000E20000-0x00000000012EA000-memory.dmp

                                        Filesize

                                        4.8MB

                                      • memory/4392-330-0x0000000000E20000-0x00000000012EA000-memory.dmp

                                        Filesize

                                        4.8MB

                                      • memory/4392-235-0x0000000000E20000-0x00000000012EA000-memory.dmp

                                        Filesize

                                        4.8MB

                                      • memory/4392-327-0x0000000000E20000-0x00000000012EA000-memory.dmp

                                        Filesize

                                        4.8MB

                                      • memory/4392-343-0x0000000000E20000-0x00000000012EA000-memory.dmp

                                        Filesize

                                        4.8MB

                                      • memory/4392-323-0x0000000000E20000-0x00000000012EA000-memory.dmp

                                        Filesize

                                        4.8MB

                                      • memory/4644-76-0x0000000000FC0000-0x000000000148A000-memory.dmp

                                        Filesize

                                        4.8MB

                                      • memory/4644-51-0x0000000000FC0000-0x000000000148A000-memory.dmp

                                        Filesize

                                        4.8MB

                                      • memory/4688-221-0x0000000000540000-0x00000000009E2000-memory.dmp

                                        Filesize

                                        4.6MB

                                      • memory/4688-218-0x0000000000540000-0x00000000009E2000-memory.dmp

                                        Filesize

                                        4.6MB

                                      • memory/5072-326-0x0000000000470000-0x0000000000A68000-memory.dmp

                                        Filesize

                                        6.0MB

                                      • memory/5072-185-0x0000000000470000-0x0000000000A68000-memory.dmp

                                        Filesize

                                        6.0MB

                                      • memory/5072-191-0x0000000000470000-0x0000000000A68000-memory.dmp

                                        Filesize

                                        6.0MB

                                      • memory/5072-222-0x0000000000470000-0x0000000000A68000-memory.dmp

                                        Filesize

                                        6.0MB

                                      • memory/5072-333-0x0000000000470000-0x0000000000A68000-memory.dmp

                                        Filesize

                                        6.0MB

                                      • memory/5072-173-0x0000000000470000-0x0000000000A68000-memory.dmp

                                        Filesize

                                        6.0MB

                                      • memory/5072-324-0x0000000000470000-0x0000000000A68000-memory.dmp

                                        Filesize

                                        6.0MB

                                      • memory/5072-341-0x0000000000470000-0x0000000000A68000-memory.dmp

                                        Filesize

                                        6.0MB

                                      • memory/5072-123-0x0000000000470000-0x0000000000A68000-memory.dmp

                                        Filesize

                                        6.0MB

                                      • memory/5072-213-0x0000000000470000-0x0000000000A68000-memory.dmp

                                        Filesize

                                        6.0MB

                                      • memory/5072-234-0x0000000000470000-0x0000000000A68000-memory.dmp

                                        Filesize

                                        6.0MB

                                      • memory/5072-353-0x0000000000470000-0x0000000000A68000-memory.dmp

                                        Filesize

                                        6.0MB

                                      • memory/5072-321-0x0000000000470000-0x0000000000A68000-memory.dmp

                                        Filesize

                                        6.0MB

                                      • memory/5072-309-0x0000000000470000-0x0000000000A68000-memory.dmp

                                        Filesize

                                        6.0MB

                                      • memory/5072-356-0x0000000000470000-0x0000000000A68000-memory.dmp

                                        Filesize

                                        6.0MB