Overview

overview

10

Static

static

7

winprofile

windows7-x64

10

winprofile

windows10-1703-x64

10

Analysis

  • max time kernel
    299s
  • max time network
    303s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    05-05-2024 22:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4f59cf1f566021a6fa0ce0dc63ec40060baf970db3062a10ef25fce2f4304cef.exe

  • Size

    1.7MB

  • MD5

    9cfb4f803076a321d61e8493374be103

  • SHA1

    f3e4007305eb66b412e0ef8e1999f780f2abaf44

  • SHA256

    4f59cf1f566021a6fa0ce0dc63ec40060baf970db3062a10ef25fce2f4304cef

  • SHA512

    13d942f1e0c7c3368aabff5cdbb30a6a6ec75cee8e31a25d3e1c531d0e3029c0f44c27ac36a2b959bc62040b1e1133d25f9d62c74974d5acff4a96b45e0b7265

  • SSDEEP

    24576:JXeFlzFIx2oCfkVhhm5iCHtT2pcv3MbpcwGu+vLQ6goB+R9rS5777GaJb1f:JX2l3oYkVgxHOcvmAxv1/B+K57fGSZ

Score
10/10
amadeyriseproevasionexecutionpersistencespywarestealerthemidatrojan

Malware Config

Extracted

Family

amadey

Version

4.20

C2

http://193.233.132.139

Attributes
  • install_dir

    5454e6f062

  • install_file

    explorta.exe

  • strings_key

    c7a869c5ba1d72480093ec207994e2bf

  • url_paths

    /sev56rkm/index.php

rc4.plain

Extracted

Family

amadey

Version

4.18

C2

http://193.233.132.56

Attributes
  • install_dir

    09fd851a4f

  • install_file

    explorha.exe

  • strings_key

    443351145ece4966ded809641c77cfa8

  • url_paths

    /Pneh2sXQk0/index.php

rc4.plain

Extracted

Family

risepro

C2

147.45.47.93:58709

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 15 IoCs
    evasion
  • Blocklisted process makes network request 2 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 30 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 15 IoCs
  • Identifies Wine through registry keys 2 TTPs 7 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 3 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Themida packer 54 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 8 IoCs
    evasiontrojan
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
  • Drops file in Windows directory 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 32 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 63 IoCs
  • Suspicious use of SendNotifyMessage 60 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4f59cf1f566021a6fa0ce0dc63ec40060baf970db3062a10ef25fce2f4304cef.exe
    "C:\Users\Admin\AppData\Local\Temp\4f59cf1f566021a6fa0ce0dc63ec40060baf970db3062a10ef25fce2f4304cef.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:3796
    • C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
      "C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Suspicious use of WriteProcessMemory
      PID:4236
      • C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
        "C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe"
        3⤵
          PID:3960
        • C:\Users\Admin\AppData\Local\Temp\1000019001\amert.exe
          "C:\Users\Admin\AppData\Local\Temp\1000019001\amert.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2144
          • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
            "C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"
            4⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious behavior: EnumeratesProcesses
            PID:3932
            • C:\Windows\SysWOW64\rundll32.exe
              "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
              5⤵
              • Loads dropped DLL
              PID:4028
              • C:\Windows\system32\rundll32.exe
                "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
                6⤵
                • Blocklisted process makes network request
                • Loads dropped DLL
                • Suspicious behavior: EnumeratesProcesses
                PID:5036
                • C:\Windows\system32\netsh.exe
                  netsh wlan show profiles
                  7⤵
                    PID:2860
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\604470191232_Desktop.zip' -CompressionLevel Optimal
                    7⤵
                    • Command and Scripting Interpreter: PowerShell
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2516
              • C:\Windows\SysWOW64\rundll32.exe
                "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
                5⤵
                • Blocklisted process makes network request
                • Loads dropped DLL
                PID:1604
          • C:\Users\Admin\AppData\Local\Temp\1000020001\497a9d51d9.exe
            "C:\Users\Admin\AppData\Local\Temp\1000020001\497a9d51d9.exe"
            3⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Checks whether UAC is enabled
            PID:2792
          • C:\Users\Admin\1000021002\8503300f8b.exe
            "C:\Users\Admin\1000021002\8503300f8b.exe"
            3⤵
            • Executes dropped EXE
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of WriteProcessMemory
            PID:3564
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
              4⤵
              • Enumerates system info in registry
              • Modifies data under HKEY_USERS
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of WriteProcessMemory
              PID:2140
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ff8b3599758,0x7ff8b3599768,0x7ff8b3599778
                5⤵
                  PID:4224
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1532 --field-trial-handle=1820,i,8080083756211037337,2594697734559479342,131072 /prefetch:2
                  5⤵
                    PID:2616
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1800 --field-trial-handle=1820,i,8080083756211037337,2594697734559479342,131072 /prefetch:8
                    5⤵
                      PID:4080
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2116 --field-trial-handle=1820,i,8080083756211037337,2594697734559479342,131072 /prefetch:8
                      5⤵
                        PID:1212
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2932 --field-trial-handle=1820,i,8080083756211037337,2594697734559479342,131072 /prefetch:1
                        5⤵
                          PID:3916
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2944 --field-trial-handle=1820,i,8080083756211037337,2594697734559479342,131072 /prefetch:1
                          5⤵
                            PID:1056
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4452 --field-trial-handle=1820,i,8080083756211037337,2594697734559479342,131072 /prefetch:1
                            5⤵
                              PID:4644
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4712 --field-trial-handle=1820,i,8080083756211037337,2594697734559479342,131072 /prefetch:8
                              5⤵
                                PID:2424
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4816 --field-trial-handle=1820,i,8080083756211037337,2594697734559479342,131072 /prefetch:8
                                5⤵
                                  PID:2744
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4756 --field-trial-handle=1820,i,8080083756211037337,2594697734559479342,131072 /prefetch:8
                                  5⤵
                                    PID:1636
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3152 --field-trial-handle=1820,i,8080083756211037337,2594697734559479342,131072 /prefetch:2
                                    5⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:1056
                          • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                            "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                            1⤵
                              PID:4976
                            • C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
                              C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
                              1⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Checks whether UAC is enabled
                              PID:2860
                            • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                              C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                              1⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • Suspicious behavior: EnumeratesProcesses
                              PID:2628
                            • C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
                              C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
                              1⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Checks whether UAC is enabled
                              PID:4744
                            • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                              C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                              1⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • Suspicious behavior: EnumeratesProcesses
                              PID:1636
                            • C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
                              C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
                              1⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Checks whether UAC is enabled
                              PID:4264
                            • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                              C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                              1⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • Suspicious behavior: EnumeratesProcesses
                              PID:372
                            • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                              C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                              1⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • Suspicious behavior: EnumeratesProcesses
                              PID:3228
                            • C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
                              C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
                              1⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Checks whether UAC is enabled
                              PID:1200
                            • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                              C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                              1⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • Suspicious behavior: EnumeratesProcesses
                              PID:2960
                            • C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
                              C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
                              1⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Checks whether UAC is enabled
                              PID:1628

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\1000021002\8503300f8b.exe
                              Filesize

                              1.1MB

                              MD5

                              eb9d9984da999e896730c644df24b147

                              SHA1

                              0f10fa621aaedd8d30fd6bc9a95bc74a5bf20f68

                              SHA256

                              634a436f42cac1098bf608da65abe493f0b72f36d63827decc5254e9a6f44aea

                              SHA512

                              86dc1affbc8a0efd1b5e4597747dc5426673c12222e5e06337aec92f070200b51fd49463adc21a3209d625df6669563efa232a4bbd12f044c380b6fdf1c3a261

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                              Filesize

                              216B

                              MD5

                              2fd5ad92400fdd4be8ce9f67de9fa6a9

                              SHA1

                              6a6e71311631a17a2a8500f493845d32e54b0be3

                              SHA256

                              e4431019ab62fa34bbf4158fbc462476b7b8ba027b55c0ae1327932b600f60ef

                              SHA512

                              fade8a82691ffb13b65888537891006f9812500c30a8b29dc69ba42d71ff90fd6fc0c79ee86d0359ff3005e9ebf825776f615a2081e061c0b57ac8466f05bd28

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                              Filesize

                              2KB

                              MD5

                              c7c285007a39818f0b5208744225c6d6

                              SHA1

                              d94f1ceff5ec92d3798536b0d83b68a5d9c4f226

                              SHA256

                              aecb9b0c936159d62cc8186d42ed35a01503c044ada52ab6fe301aecf2adf12e

                              SHA512

                              d65a820ac94607dc150d3f3dc78575e76a22497f5755c4f17b8fc6bcdbcbaf0d13aeddbcc8b8135c864e0b391197871d38fb1b4e25997164aae4177c8eab6e02

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                              Filesize

                              1KB

                              MD5

                              c952ab7bef5f76176252db9eaddff1b6

                              SHA1

                              811ac33ec30d633309162a928464091a8dd3c479

                              SHA256

                              ad2eb91c1dadfd2d3fa222ba0f9bc857025168619d5ad3e89074cc74eb9230b9

                              SHA512

                              eed0e1430b1e61fcd19672528a0be00a208b57cd2436a69e289977f4017fb0ec6517e71aee74ea37be5400e79fbd8467baae921bdfd2ea28a61e14299b319eef

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                              Filesize

                              2KB

                              MD5

                              22215f5184ece496d620adc04189e1f3

                              SHA1

                              dfbb2edc8164745630bb31bd98679e5954f54b49

                              SHA256

                              d7292288e58a24877f877b75be43ca252124fab6b15867d81ddd795e23f68f6b

                              SHA512

                              7d9e86b887a71711cf1c65db9ff2332f4f3f838104ad1ea3ec114100cc78662c043050a9eb30fda895e68b9fd8b4727159a36c96b6a54fb8d0aa9c7c711b86e9

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                              Filesize

                              707B

                              MD5

                              c196c0b78b38f0fc877e80a661b78f61

                              SHA1

                              1801632f1cf5b1f828278640c89f4a380433f55f

                              SHA256

                              aa93ec7b8b50d0547b31492ba997c32a8bc7f5387831fae79454ac6985573758

                              SHA512

                              fd120bfd1dc90cbbdf815dfd1734d720bf644683eeff7d7186675e1e41644938826901f0cacfb831e6b2e3ac5c31dd6043249060d8fa88522de140ec3cab91f8

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                              Filesize

                              6KB

                              MD5

                              6b12fe28ec0e100d63831c1be3718e36

                              SHA1

                              969f0ef94247ffd5e6b96233c9975c561c278b59

                              SHA256

                              5fffb0cfd0d3351fb36061cc5fe27bb2e825467e5c212f848eabc8deb0fa0cbe

                              SHA512

                              b36da4924b41e413cff147d41db0921cf62c94716db9b51832000eee4e2f1582668e051b0cd1e8ad8dd6a1cc3486b3b40c758a1b4bb43a7805a3198841c6d70f

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                              Filesize

                              6KB

                              MD5

                              2dbb1864dc8cb173ce19a366f9ce8356

                              SHA1

                              bf000f355346352958db1c5d1c0a5930236bd684

                              SHA256

                              b8061b9ff5a747f174976bf95badab81846b4852d6b1d7657baab92431ad1d1a

                              SHA512

                              21e3e689e64bd764d2f412cfaa50ca2182c54b04a43ae265005e0522941526e08b3e4315f44eb741b4727e018a0e2867962039dc60a4510e674e95ccf9ca718e

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                              Filesize

                              6KB

                              MD5

                              281ebca195906635d16a8335066e756a

                              SHA1

                              a6366e485d36f4a04e413103aeb2b6fe3f422f28

                              SHA256

                              f6d12990c521c84b109cdd41c7fd6bf8f264a1eae8d6aec016805257803808fd

                              SHA512

                              f55f13d1bd1d09e794ea573857568af0b06c956393f7325f7520d16c816b4f24b256d34bc977b6128e39edb7922fdaaaa870791a715c4c57fbab26bc866b6152

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                              Filesize

                              12KB

                              MD5

                              38a54182bbb3ef6f12d97b5133464646

                              SHA1

                              bf1940407beead246708584be666fdc917ab9759

                              SHA256

                              d99ffa9b189724f2afb1efa72e721211763b606b228412dd8669398cb450f540

                              SHA512

                              e33983aecb7efe3426ca69195ed220bd3ce6161b1c366d7d2577d06440c98fd49c4a8ceb4ad52808c6e5ad8ee05f57d27693f3f7257c8a5cde800cd0b9e23586

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                              Filesize

                              272KB

                              MD5

                              b1ea8456531c16986f0b9cbc41c68c0e

                              SHA1

                              3afcef2d73cffa8a6395d3993723bef7b7c0eb73

                              SHA256

                              75dbcb8927b5b98999175c8a779d05f735e684831a40b7bbc2ddd374d2a5e693

                              SHA512

                              c87e8ee7ae7ea06d61b257fd32b823e0f61f451e31cad594f5840fc6b9542d97ab0e19fd3da4521bf08a47dd9d10da0c537910717509855cb351d7ea8ecd2ac5

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
                              Filesize

                              2B

                              MD5

                              99914b932bd37a50b983c5e7c90ae93b

                              SHA1

                              bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                              SHA256

                              44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                              SHA512

                              27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\1000019001\amert.exe
                              Filesize

                              1.8MB

                              MD5

                              e30a7d55336c5da8caa04caff1ce114e

                              SHA1

                              e1ee65f973cb132b1609f2c39eace8e6fae85051

                              SHA256

                              32fa22b59bf2ce238b5f70a17ec19ecac7b03a283c628d1b684c7175394180e8

                              SHA512

                              10a746583f4cffa7b1008f9e40f2101bd9183dea124c2f9176e6a8a6660fe20c637b727e3bc2d138343359869b464a6e62b3f47a7213a02c80282b38b202eafc

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\1000020001\497a9d51d9.exe
                              Filesize

                              2.1MB

                              MD5

                              8a11f3f7f1d24eb64175036a7c85654c

                              SHA1

                              40f198442835de440c378effe8f023cdf0d45e30

                              SHA256

                              d14edb85b599d38a15b2a266526803e5ebf80ab0ddc68e9ae80ea97ae9a85371

                              SHA512

                              a4a934f4f9229a4aa9dda50452af1bdb1e12f60ed310d77c991bcdcf9970b4e9dfbe39f00e2258e12021dda6f4b71712d475aba67d5ea5315fc12af5bfc91c66

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
                              Filesize

                              1.7MB

                              MD5

                              9cfb4f803076a321d61e8493374be103

                              SHA1

                              f3e4007305eb66b412e0ef8e1999f780f2abaf44

                              SHA256

                              4f59cf1f566021a6fa0ce0dc63ec40060baf970db3062a10ef25fce2f4304cef

                              SHA512

                              13d942f1e0c7c3368aabff5cdbb30a6a6ec75cee8e31a25d3e1c531d0e3029c0f44c27ac36a2b959bc62040b1e1133d25f9d62c74974d5acff4a96b45e0b7265

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\604470191232_Desktop.zip
                              Filesize

                              94KB

                              MD5

                              96b0609f646ed21146a1d7865bd6d656

                              SHA1

                              37b7ced42a3f791f6261024550d995f2c4d17488

                              SHA256

                              dac29ea63435af96e3c3de22830259dcde119fee45c4214d3c995463ba046bc9

                              SHA512

                              7c649426c1d91e248de20616dea7f8735d8d68ebd5ed52b2d76be52fbfe6a2c9c8b56b1db3bb74a4f3a6b8407dd65054bebaf71b907c5785a4235f38cfa6e26b

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\_Files_\DisconnectWrite.docx
                              Filesize

                              94KB

                              MD5

                              0853e55235a876527a315a448aae6c4f

                              SHA1

                              38a6d22237e8607f952c59273e3ed4ea9b5181a7

                              SHA256

                              9970e66168d8ca0dc640d28f17b8afdaf2b11fc7314fc49d0bb96f0cf533e10c

                              SHA512

                              516dc5bfea969bee7e44a536fdb2fc570ada4e0bcf2824be718f2b0feb1dfcbb60c49680c67ac2a48ac1fa911c135564bcfbb1671e75a0898b13372c90094549

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_32b4fkne.x1t.ps1
                              Filesize

                              1B

                              MD5

                              c4ca4238a0b923820dcc509a6f75849b

                              SHA1

                              356a192b7913b04c54574d18c28d46e6395428ab

                              SHA256

                              6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

                              SHA512

                              4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
                              Filesize

                              109KB

                              MD5

                              726cd06231883a159ec1ce28dd538699

                              SHA1

                              404897e6a133d255ad5a9c26ac6414d7134285a2

                              SHA256

                              12fef2d5995d671ec0e91bdbdc91e2b0d3c90ed3a8b2b13ddaa8ad64727dcd46

                              SHA512

                              9ea82e7cb6c6a58446bd5033855947c3e2d475d2910f2b941235e0b96aa08eec822d2dd17cc86b2d3fce930f78b799291992408e309a6c63e3011266810ea83e

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
                              Filesize

                              1.2MB

                              MD5

                              15a42d3e4579da615a384c717ab2109b

                              SHA1

                              22aeedeb2307b1370cdab70d6a6b6d2c13ad2301

                              SHA256

                              3c97bb410e49b11af8116feb7240b7101e1967cae7538418c45c3d2e072e8103

                              SHA512

                              1eb7f126dccc88a2479e3818c36120f5af3caa0d632b9ea803485ee6531d6e2a1fd0805b1c4364983d280df23ea5ca3ad4a5fca558ac436efae36af9b795c444

                              Download Submit

                            • memory/372-360-0x00000000002E0000-0x0000000000783000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/372-364-0x00000000002E0000-0x0000000000783000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/1200-388-0x00000000001A0000-0x00000000006E9000-memory.dmp

                              Filesize

                              5.3MB

                              Download

                            • memory/1200-394-0x00000000001A0000-0x00000000006E9000-memory.dmp

                              Filesize

                              5.3MB

                              Download

                            • memory/1628-420-0x00000000001A0000-0x00000000006E9000-memory.dmp

                              Filesize

                              5.3MB

                              Download

                            • memory/1628-427-0x00000000001A0000-0x00000000006E9000-memory.dmp

                              Filesize

                              5.3MB

                              Download

                            • memory/1636-310-0x00000000002E0000-0x0000000000783000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/1636-320-0x00000000002E0000-0x0000000000783000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/2144-42-0x0000000000F80000-0x0000000001423000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/2144-52-0x0000000000F80000-0x0000000001423000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/2516-203-0x000001E6BDFF0000-0x000001E6BE002000-memory.dmp

                              Filesize

                              72KB

                              Download

                            • memory/2516-216-0x000001E6BDC50000-0x000001E6BDC5A000-memory.dmp

                              Filesize

                              40KB

                              Download

                            • memory/2516-169-0x000001E6BDC70000-0x000001E6BDCE6000-memory.dmp

                              Filesize

                              472KB

                              Download

                            • memory/2516-165-0x000001E6BD990000-0x000001E6BD9B2000-memory.dmp

                              Filesize

                              136KB

                              Download

                            • memory/2516-224-0x000001E6BD9C0000-0x000001E6BDAEC000-memory.dmp

                              Filesize

                              1.2MB

                              Download

                            • memory/2628-244-0x00000000002E0000-0x0000000000783000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/2628-248-0x00000000002E0000-0x0000000000783000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/2792-68-0x00000000003C0000-0x0000000000A40000-memory.dmp

                              Filesize

                              6.5MB

                              Download

                            • memory/2792-71-0x00000000003C0000-0x0000000000A40000-memory.dmp

                              Filesize

                              6.5MB

                              Download

                            • memory/2792-130-0x00000000003C0000-0x0000000000A40000-memory.dmp

                              Filesize

                              6.5MB

                              Download

                            • memory/2792-69-0x00000000003C0000-0x0000000000A40000-memory.dmp

                              Filesize

                              6.5MB

                              Download

                            • memory/2792-70-0x00000000003C0000-0x0000000000A40000-memory.dmp

                              Filesize

                              6.5MB

                              Download

                            • memory/2792-67-0x00000000003C0000-0x0000000000A40000-memory.dmp

                              Filesize

                              6.5MB

                              Download

                            • memory/2792-66-0x00000000003C0000-0x0000000000A40000-memory.dmp

                              Filesize

                              6.5MB

                              Download

                            • memory/2792-72-0x00000000003C0000-0x0000000000A40000-memory.dmp

                              Filesize

                              6.5MB

                              Download

                            • memory/2792-73-0x00000000003C0000-0x0000000000A40000-memory.dmp

                              Filesize

                              6.5MB

                              Download

                            • memory/2792-74-0x00000000003C0000-0x0000000000A40000-memory.dmp

                              Filesize

                              6.5MB

                              Download

                            • memory/2860-235-0x00000000001A0000-0x00000000006E9000-memory.dmp

                              Filesize

                              5.3MB

                              Download

                            • memory/2860-246-0x00000000001A0000-0x00000000006E9000-memory.dmp

                              Filesize

                              5.3MB

                              Download

                            • memory/2860-236-0x00000000001A0000-0x00000000006E9000-memory.dmp

                              Filesize

                              5.3MB

                              Download

                            • memory/2860-238-0x00000000001A0000-0x00000000006E9000-memory.dmp

                              Filesize

                              5.3MB

                              Download

                            • memory/2860-239-0x00000000001A0000-0x00000000006E9000-memory.dmp

                              Filesize

                              5.3MB

                              Download

                            • memory/2860-243-0x00000000001A0000-0x00000000006E9000-memory.dmp

                              Filesize

                              5.3MB

                              Download

                            • memory/2860-241-0x00000000001A0000-0x00000000006E9000-memory.dmp

                              Filesize

                              5.3MB

                              Download

                            • memory/2860-240-0x00000000001A0000-0x00000000006E9000-memory.dmp

                              Filesize

                              5.3MB

                              Download

                            • memory/2860-242-0x00000000001A0000-0x00000000006E9000-memory.dmp

                              Filesize

                              5.3MB

                              Download

                            • memory/2960-421-0x00000000002E0000-0x0000000000783000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/2960-429-0x00000000002E0000-0x0000000000783000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/3228-396-0x00000000002E0000-0x0000000000783000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/3796-0-0x0000000001200000-0x0000000001749000-memory.dmp

                              Filesize

                              5.3MB

                              Download

                            • memory/3796-1-0x0000000001200000-0x0000000001749000-memory.dmp

                              Filesize

                              5.3MB

                              Download

                            • memory/3796-7-0x0000000001200000-0x0000000001749000-memory.dmp

                              Filesize

                              5.3MB

                              Download

                            • memory/3796-5-0x0000000001200000-0x0000000001749000-memory.dmp

                              Filesize

                              5.3MB

                              Download

                            • memory/3796-8-0x0000000001200000-0x0000000001749000-memory.dmp

                              Filesize

                              5.3MB

                              Download

                            • memory/3796-18-0x0000000001200000-0x0000000001749000-memory.dmp

                              Filesize

                              5.3MB

                              Download

                            • memory/3796-4-0x0000000001200000-0x0000000001749000-memory.dmp

                              Filesize

                              5.3MB

                              Download

                            • memory/3796-6-0x0000000001200000-0x0000000001749000-memory.dmp

                              Filesize

                              5.3MB

                              Download

                            • memory/3796-2-0x0000000001200000-0x0000000001749000-memory.dmp

                              Filesize

                              5.3MB

                              Download

                            • memory/3796-3-0x0000000001200000-0x0000000001749000-memory.dmp

                              Filesize

                              5.3MB

                              Download

                            • memory/3932-53-0x00000000002E0000-0x0000000000783000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/3932-267-0x00000000002E0000-0x0000000000783000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/3932-285-0x00000000002E0000-0x0000000000783000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/3932-289-0x00000000002E0000-0x0000000000783000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/3932-237-0x00000000002E0000-0x0000000000783000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/3932-282-0x00000000002E0000-0x0000000000783000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/3932-249-0x00000000002E0000-0x0000000000783000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/3932-129-0x00000000002E0000-0x0000000000783000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/3932-270-0x00000000002E0000-0x0000000000783000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/4236-21-0x00000000001A0000-0x00000000006E9000-memory.dmp

                              Filesize

                              5.3MB

                              Download

                            • memory/4236-118-0x00000000001A0000-0x00000000006E9000-memory.dmp

                              Filesize

                              5.3MB

                              Download

                            • memory/4236-17-0x00000000001A0000-0x00000000006E9000-memory.dmp

                              Filesize

                              5.3MB

                              Download

                            • memory/4236-27-0x00000000001A0000-0x00000000006E9000-memory.dmp

                              Filesize

                              5.3MB

                              Download

                            • memory/4236-25-0x00000000001A0000-0x00000000006E9000-memory.dmp

                              Filesize

                              5.3MB

                              Download

                            • memory/4236-23-0x00000000001A0000-0x00000000006E9000-memory.dmp

                              Filesize

                              5.3MB

                              Download

                            • memory/4236-20-0x00000000001A0000-0x00000000006E9000-memory.dmp

                              Filesize

                              5.3MB

                              Download

                            • memory/4236-24-0x00000000001A0000-0x00000000006E9000-memory.dmp

                              Filesize

                              5.3MB

                              Download

                            • memory/4236-22-0x00000000001A0000-0x00000000006E9000-memory.dmp

                              Filesize

                              5.3MB

                              Download

                            • memory/4236-26-0x00000000001A0000-0x00000000006E9000-memory.dmp

                              Filesize

                              5.3MB

                              Download

                            • memory/4264-362-0x00000000001A0000-0x00000000006E9000-memory.dmp

                              Filesize

                              5.3MB

                              Download

                            • memory/4264-359-0x00000000001A0000-0x00000000006E9000-memory.dmp

                              Filesize

                              5.3MB

                              Download

                            • memory/4744-318-0x00000000001A0000-0x00000000006E9000-memory.dmp

                              Filesize

                              5.3MB

                              Download

                            • memory/4744-308-0x00000000001A0000-0x00000000006E9000-memory.dmp

                              Filesize

                              5.3MB

                              Download

                            • memory/4744-311-0x00000000001A0000-0x00000000006E9000-memory.dmp

                              Filesize

                              5.3MB

                              Download

                            • memory/4744-312-0x00000000001A0000-0x00000000006E9000-memory.dmp

                              Filesize

                              5.3MB

                              Download

                            • memory/4744-314-0x00000000001A0000-0x00000000006E9000-memory.dmp

                              Filesize

                              5.3MB

                              Download

                            • memory/4744-316-0x00000000001A0000-0x00000000006E9000-memory.dmp

                              Filesize

                              5.3MB

                              Download

                            • memory/4744-313-0x00000000001A0000-0x00000000006E9000-memory.dmp

                              Filesize

                              5.3MB

                              Download