Overview

overview

10

Static

static

7

winprofile

windows7-x64

10

winprofile

windows10-1703-x64

10

Analysis

  • max time kernel
    299s
  • max time network
    300s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    06-05-2024 22:29

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    261011f79fe1b04fc9c3565c25a3fd82f9f3289f1795164750c82dc4085c5b3d.exe

  • Size

    1.7MB

  • MD5

    37a44f6e40e64696e3b92e19e3f20e6f

  • SHA1

    62312d8aab044fb54b94fe6e30978b1e0a966d20

  • SHA256

    261011f79fe1b04fc9c3565c25a3fd82f9f3289f1795164750c82dc4085c5b3d

  • SHA512

    cf230b005e5390b17c71700be3568bda44404d72d0f67e40e0e5b1b36a1e18c95e2b22f2fe9c357aa276e169ad42a49281a836a7c5c44ec31f208e374303a644

  • SSDEEP

    49152:J0ZzENe9Z9w3pM7TzYZ1blMDWZQdaLPsM4tcrRuuFdtXCk:J0ZzENe/aczjRArsTcrM6XCk

Score
10/10
amadeyriseproevasionexecutionpersistencespywarestealerthemidatrojan

Malware Config

Extracted

Family

amadey

Version

4.20

C2

http://193.233.132.139

Attributes
  • install_dir

    5454e6f062

  • install_file

    explorta.exe

  • strings_key

    c7a869c5ba1d72480093ec207994e2bf

  • url_paths

    /sev56rkm/index.php

rc4.plain

Extracted

Family

risepro

C2

147.45.47.126:58709

Extracted

Family

amadey

Version

4.18

C2

http://193.233.132.56

Attributes
  • install_dir

    09fd851a4f

  • install_file

    explorha.exe

  • strings_key

    443351145ece4966ded809641c77cfa8

  • url_paths

    /Pneh2sXQk0/index.php

rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 15 IoCs
    evasion
  • Blocklisted process makes network request 2 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 30 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 15 IoCs
  • Identifies Wine through registry keys 2 TTPs 7 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 3 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Themida packer 40 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 8 IoCs
    evasiontrojan
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 31 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 63 IoCs
  • Suspicious use of SendNotifyMessage 60 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\261011f79fe1b04fc9c3565c25a3fd82f9f3289f1795164750c82dc4085c5b3d.exe
    "C:\Users\Admin\AppData\Local\Temp\261011f79fe1b04fc9c3565c25a3fd82f9f3289f1795164750c82dc4085c5b3d.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:1448
    • C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
      "C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:2248
      • C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
        "C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious behavior: EnumeratesProcesses
        PID:3900
      • C:\Users\Admin\AppData\Local\Temp\1000019001\amert.exe
        "C:\Users\Admin\AppData\Local\Temp\1000019001\amert.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4964
        • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
          "C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2296
          • C:\Windows\SysWOW64\rundll32.exe
            "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
            5⤵
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:1424
            • C:\Windows\system32\rundll32.exe
              "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
              6⤵
              • Blocklisted process makes network request
              • Loads dropped DLL
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:5064
              • C:\Windows\system32\netsh.exe
                netsh wlan show profiles
                7⤵
                  PID:4976
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\604470191232_Desktop.zip' -CompressionLevel Optimal
                  7⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3276
            • C:\Windows\SysWOW64\rundll32.exe
              "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
              5⤵
              • Blocklisted process makes network request
              • Loads dropped DLL
              PID:208
        • C:\Users\Admin\AppData\Local\Temp\1000020001\0771813e1f.exe
          "C:\Users\Admin\AppData\Local\Temp\1000020001\0771813e1f.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Checks whether UAC is enabled
          PID:404
        • C:\Users\Admin\1000021002\5a34e1b79e.exe
          "C:\Users\Admin\1000021002\5a34e1b79e.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:4432
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
            4⤵
            • Enumerates system info in registry
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of WriteProcessMemory
            PID:1604
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffeab689758,0x7ffeab689768,0x7ffeab689778
              5⤵
                PID:2108
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1536 --field-trial-handle=1720,i,8948252938286832693,17887368984517441876,131072 /prefetch:2
                5⤵
                  PID:3852
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2008 --field-trial-handle=1720,i,8948252938286832693,17887368984517441876,131072 /prefetch:8
                  5⤵
                    PID:2140
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2096 --field-trial-handle=1720,i,8948252938286832693,17887368984517441876,131072 /prefetch:8
                    5⤵
                      PID:1560
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2972 --field-trial-handle=1720,i,8948252938286832693,17887368984517441876,131072 /prefetch:1
                      5⤵
                        PID:3048
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2980 --field-trial-handle=1720,i,8948252938286832693,17887368984517441876,131072 /prefetch:1
                        5⤵
                          PID:3324
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3844 --field-trial-handle=1720,i,8948252938286832693,17887368984517441876,131072 /prefetch:1
                          5⤵
                            PID:1368
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4688 --field-trial-handle=1720,i,8948252938286832693,17887368984517441876,131072 /prefetch:8
                            5⤵
                              PID:652
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4660 --field-trial-handle=1720,i,8948252938286832693,17887368984517441876,131072 /prefetch:8
                              5⤵
                                PID:3672
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4712 --field-trial-handle=1720,i,8948252938286832693,17887368984517441876,131072 /prefetch:8
                                5⤵
                                  PID:512
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=812 --field-trial-handle=1720,i,8948252938286832693,17887368984517441876,131072 /prefetch:2
                                  5⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:3732
                        • C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
                          C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
                          1⤵
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Checks whether UAC is enabled
                          PID:4996
                        • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                          "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                          1⤵
                            PID:2656
                          • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                            C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                            1⤵
                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                            • Checks BIOS information in registry
                            • Executes dropped EXE
                            • Identifies Wine through registry keys
                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                            • Suspicious behavior: EnumeratesProcesses
                            PID:4876
                          • C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
                            C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
                            1⤵
                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                            • Checks BIOS information in registry
                            • Executes dropped EXE
                            • Checks whether UAC is enabled
                            PID:600
                          • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                            C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                            1⤵
                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                            • Checks BIOS information in registry
                            • Executes dropped EXE
                            • Identifies Wine through registry keys
                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                            • Suspicious behavior: EnumeratesProcesses
                            PID:4572
                          • C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
                            C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
                            1⤵
                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                            • Checks BIOS information in registry
                            • Executes dropped EXE
                            • Checks whether UAC is enabled
                            PID:2292
                          • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                            C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                            1⤵
                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                            • Checks BIOS information in registry
                            • Executes dropped EXE
                            • Identifies Wine through registry keys
                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                            • Suspicious behavior: EnumeratesProcesses
                            PID:4948
                          • C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
                            C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
                            1⤵
                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                            • Checks BIOS information in registry
                            • Executes dropped EXE
                            • Checks whether UAC is enabled
                            PID:3872
                          • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                            C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                            1⤵
                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                            • Checks BIOS information in registry
                            • Executes dropped EXE
                            • Identifies Wine through registry keys
                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                            • Suspicious behavior: EnumeratesProcesses
                            PID:1340
                          • C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
                            C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
                            1⤵
                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                            • Checks BIOS information in registry
                            • Executes dropped EXE
                            • Checks whether UAC is enabled
                            PID:2588

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\1000021002\5a34e1b79e.exe
                            Filesize

                            1.1MB

                            MD5

                            0260f9b186c84a38b51213fbb1c620cb

                            SHA1

                            afd8d5b12887ecbed343828cbc33d67494ba6210

                            SHA256

                            545d0a5662b6bfc9e67092bda3046198019df3c79402a7259bcd1da4e4dbc295

                            SHA512

                            1461d9e158d1d2869175a6842e1dfcc8a662723ff1342554ac5c26e6d646c4778538f8aea4794b5f427f589e2ed00574cb6fe24d91bb02c86c8cfb29e2cc0ad5

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                            Filesize

                            216B

                            MD5

                            56ea9255c579bd7cb846ceea111f797d

                            SHA1

                            601c66661dd7677f6073fa539ec669fa07fbd648

                            SHA256

                            1ba54ba7afc52a762d8fac7c0ab6ac93977946dfab994205296a923c985b03f9

                            SHA512

                            28d6726f91d9fdae891d577a4686ea7f54c54b8003a091e30185dae1ea9835289d9569072dccab6f454c1281547d47c8de6a758cc352c71c1619ce3665ba54b3

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\87f7822a-6b6d-4a24-9a5c-f7bab3870ddd.tmp
                            Filesize

                            2KB

                            MD5

                            950f833a667706126155431b66974cdb

                            SHA1

                            3962d803a87a49b9054a98e0c42c942d502a2eee

                            SHA256

                            e6447520a0fa9c699ad89eb4ad5fa775897a30ec8af70cb572d82e3ad790bb4f

                            SHA512

                            87535c880c6dd88860afcd885825870cc96d683e4af60a56a0149991a80fbe6e2439507c69cd8b3da0c65fa4734dd0729bdfe11d66f7a7480bdab44722d94e4a

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                            Filesize

                            2KB

                            MD5

                            04f0c13fc28c5300edd28a35da50fd28

                            SHA1

                            86ee06fe2cf4056072ea72bcd00113e8f9593ece

                            SHA256

                            858a40b08c5d9bc06f2474e6594a12ee7ad15afa9fb6cbb0291d0f900429fc8d

                            SHA512

                            26fe3248045ee517893939b02ade7339b8955964b166f34b87ce87fe52372223b5208fbee680574ffc5e20ea48ba3dc5f21fdf75bf3f600806f368d598b2913b

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                            Filesize

                            1KB

                            MD5

                            975991bd278930a1dcd44ddfb6f8a876

                            SHA1

                            674da149b2ad9b2d4d20c1dbdcecc9e1c282f9d7

                            SHA256

                            a22957dc655314f5a6e957ed0c7ec459702a9ec8f2fde60b4ab6166225931db9

                            SHA512

                            7fdf54ca035f0e2937cd75ff41c06065d8eed6d19a6f0a3fe3b0a5d36011c0875017df33bfee58a45d8a2de50949854fbfaf2acc69c930890240fee4fe167a8f

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                            Filesize

                            705B

                            MD5

                            e6099b8ebd29db7bccd19eecc921ac33

                            SHA1

                            6061fbc4e8757364420a1c31a1ead98bde4a9a01

                            SHA256

                            ab0561d2888a2406e87b95252bf688f38b6703091f0ef6166f03eccbbeda196a

                            SHA512

                            1300af3db9391aefeb8faf34a773d9285320ccda23e4930c4afaea5852930db3f6bacd44fa494d79710177822a3c6890254f76ad365acb71f066bdf62868cd45

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                            Filesize

                            6KB

                            MD5

                            e34d3acef730988d33ce071203366013

                            SHA1

                            2dfce7a03e07d2a7c0c5a1b06844169a2b2a06c7

                            SHA256

                            29c707e88f2b9aeef1af7698ee5e519ccd58c6754b25c5c4534acc67acfeef06

                            SHA512

                            0de882e0b37f9cfeb1ec31a2a1fb7c62072c254a1bda174a3a1a3d3662ec5411deab3541b34dde47b38aaa381c319ee04de8c99e79d53dc49096c557f456b078

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                            Filesize

                            6KB

                            MD5

                            b4cc8eb0e0ff00592ffb816ee92de0b7

                            SHA1

                            62378283a6db7f260d2db19ecc7883ac27268f83

                            SHA256

                            3d8d13f8589ad4d434e3e2d119ec001da8e58c64d6b39b89fdeddf5ce39b0f4f

                            SHA512

                            a80b9e082f5601db41580f32c9e3663e9db8261c5e5132b54cd57d6588cb5ec53109c79acf9bf26e41055961da61825e19e00a25bbe84db6d627bc29ef68ebab

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                            Filesize

                            6KB

                            MD5

                            572f140cbbd9bc8bf9abc50ce6f20d38

                            SHA1

                            91da2189a2472fe6dbd54dcd82f29aba540f5b50

                            SHA256

                            46ffd6933e2e2f0ffc1d089060b7197a7bdf97d4c5fe9fa18bb77bc70845450e

                            SHA512

                            cd14ed6a2672ba82a7dfb865db6c6b8a866096d71b798dfc67db44909a22daa8120e60f046a4997440fbe87c83de9b3bea31724e12d05fe344d3e5fd8389bbe1

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                            Filesize

                            12KB

                            MD5

                            c9e0556c3de06cc32743bc1cf01e65f0

                            SHA1

                            b66835b9441cd9cfab9216279ed0a0517412ac8f

                            SHA256

                            f4011d7383db17416f95f723d231519f8d0bddf1aeb5823298c25c9d9ed87571

                            SHA512

                            28c71ea1eb5e2a328b9e841ac90583df298159d48a4863f26078035953d9198b2fe76f1360e2dd9784b7b5cbd2b4f5e6d78bcc128d7117da4543a4348b8bedd0

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                            Filesize

                            272KB

                            MD5

                            51e320a851a471c5c2a9cda64ce98a0d

                            SHA1

                            992a944249497773936c469d60476ef0e1903466

                            SHA256

                            b15116da9828aab0434e2d59693c62fac467153556100c27b1935f5056611616

                            SHA512

                            cb5e9cc4c2c6b8cecffb1e2fa7db2a6e797b52e8c1d0121b2a5229d68387664829cce09c707411ef377514a4d1d2f17986c9bc27272749ad67e2dc72e1d16c42

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
                            Filesize

                            2B

                            MD5

                            99914b932bd37a50b983c5e7c90ae93b

                            SHA1

                            bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                            SHA256

                            44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                            SHA512

                            27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\1000019001\amert.exe
                            Filesize

                            1.9MB

                            MD5

                            14aa60915c0a1f90e99e5ca8f88d2b33

                            SHA1

                            9930452558c4453b6771a52292f11f23403fe351

                            SHA256

                            513b0ca34cd922998a21f47bf44007ed6852e1ca305473de8feae2abbcce1fe3

                            SHA512

                            2074d8df8e285d116680887bde335aec5adaac4843373133ea49508636c9a00fff16082f37a0ff36bb23d839bee9823aa8e1697ebd893c296d05afd690fd56f2

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\1000020001\0771813e1f.exe
                            Filesize

                            2.2MB

                            MD5

                            c4a9ff8a79d240d0fde388afdd0198ef

                            SHA1

                            5ac7f46ed51d959068cd4514b138165effd979a3

                            SHA256

                            1c9bc1c5cfaf476df48ab4583233a4fe46323acde6141fe754fd487b5a402dde

                            SHA512

                            0ab1b8345fd7619ea24ed90c9f0de2cceee8d41a67527fc166702b02fb54585c2a6faf6eca3e6e8aae143299f2ab8b9031fba391ad2fad9561446a65afdc129a

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
                            Filesize

                            1.7MB

                            MD5

                            37a44f6e40e64696e3b92e19e3f20e6f

                            SHA1

                            62312d8aab044fb54b94fe6e30978b1e0a966d20

                            SHA256

                            261011f79fe1b04fc9c3565c25a3fd82f9f3289f1795164750c82dc4085c5b3d

                            SHA512

                            cf230b005e5390b17c71700be3568bda44404d72d0f67e40e0e5b1b36a1e18c95e2b22f2fe9c357aa276e169ad42a49281a836a7c5c44ec31f208e374303a644

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5vk1rhz5.knz.ps1
                            Filesize

                            1B

                            MD5

                            c4ca4238a0b923820dcc509a6f75849b

                            SHA1

                            356a192b7913b04c54574d18c28d46e6395428ab

                            SHA256

                            6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

                            SHA512

                            4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
                            Filesize

                            1.2MB

                            MD5

                            15a42d3e4579da615a384c717ab2109b

                            SHA1

                            22aeedeb2307b1370cdab70d6a6b6d2c13ad2301

                            SHA256

                            3c97bb410e49b11af8116feb7240b7101e1967cae7538418c45c3d2e072e8103

                            SHA512

                            1eb7f126dccc88a2479e3818c36120f5af3caa0d632b9ea803485ee6531d6e2a1fd0805b1c4364983d280df23ea5ca3ad4a5fca558ac436efae36af9b795c444

                            Download Submit

                          • \Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
                            Filesize

                            109KB

                            MD5

                            726cd06231883a159ec1ce28dd538699

                            SHA1

                            404897e6a133d255ad5a9c26ac6414d7134285a2

                            SHA256

                            12fef2d5995d671ec0e91bdbdc91e2b0d3c90ed3a8b2b13ddaa8ad64727dcd46

                            SHA512

                            9ea82e7cb6c6a58446bd5033855947c3e2d475d2910f2b941235e0b96aa08eec822d2dd17cc86b2d3fce930f78b799291992408e309a6c63e3011266810ea83e

                            Download Submit

                          • memory/404-300-0x0000000000DA0000-0x000000000142E000-memory.dmp

                            Filesize

                            6.6MB

                            Download

                          • memory/404-203-0x0000000000DA0000-0x000000000142E000-memory.dmp

                            Filesize

                            6.6MB

                            Download

                          • memory/600-271-0x00000000011F0000-0x000000000173E000-memory.dmp

                            Filesize

                            5.3MB

                            Download

                          • memory/600-280-0x00000000011F0000-0x000000000173E000-memory.dmp

                            Filesize

                            5.3MB

                            Download

                          • memory/1340-446-0x0000000000910000-0x0000000000DF3000-memory.dmp

                            Filesize

                            4.9MB

                            Download

                          • memory/1340-433-0x0000000000910000-0x0000000000DF3000-memory.dmp

                            Filesize

                            4.9MB

                            Download

                          • memory/1448-17-0x0000000000FF0000-0x000000000153E000-memory.dmp

                            Filesize

                            5.3MB

                            Download

                          • memory/1448-7-0x0000000000FF0000-0x000000000153E000-memory.dmp

                            Filesize

                            5.3MB

                            Download

                          • memory/1448-2-0x0000000000FF0000-0x000000000153E000-memory.dmp

                            Filesize

                            5.3MB

                            Download

                          • memory/1448-1-0x0000000000FF0000-0x000000000153E000-memory.dmp

                            Filesize

                            5.3MB

                            Download

                          • memory/1448-5-0x0000000000FF0000-0x000000000153E000-memory.dmp

                            Filesize

                            5.3MB

                            Download

                          • memory/1448-3-0x0000000000FF0000-0x000000000153E000-memory.dmp

                            Filesize

                            5.3MB

                            Download

                          • memory/1448-4-0x0000000000FF0000-0x000000000153E000-memory.dmp

                            Filesize

                            5.3MB

                            Download

                          • memory/1448-6-0x0000000000FF0000-0x000000000153E000-memory.dmp

                            Filesize

                            5.3MB

                            Download

                          • memory/1448-0-0x0000000000FF0000-0x000000000153E000-memory.dmp

                            Filesize

                            5.3MB

                            Download

                          • memory/2248-20-0x00000000011F0000-0x000000000173E000-memory.dmp

                            Filesize

                            5.3MB

                            Download

                          • memory/2248-24-0x00000000011F0000-0x000000000173E000-memory.dmp

                            Filesize

                            5.3MB

                            Download

                          • memory/2248-21-0x00000000011F0000-0x000000000173E000-memory.dmp

                            Filesize

                            5.3MB

                            Download

                          • memory/2248-25-0x00000000011F0000-0x000000000173E000-memory.dmp

                            Filesize

                            5.3MB

                            Download

                          • memory/2248-100-0x00000000011F0000-0x000000000173E000-memory.dmp

                            Filesize

                            5.3MB

                            Download

                          • memory/2248-19-0x00000000011F0000-0x000000000173E000-memory.dmp

                            Filesize

                            5.3MB

                            Download

                          • memory/2248-23-0x00000000011F0000-0x000000000173E000-memory.dmp

                            Filesize

                            5.3MB

                            Download

                          • memory/2248-61-0x00000000011F0000-0x000000000173E000-memory.dmp

                            Filesize

                            5.3MB

                            Download

                          • memory/2248-22-0x00000000011F0000-0x000000000173E000-memory.dmp

                            Filesize

                            5.3MB

                            Download

                          • memory/2248-16-0x00000000011F0000-0x000000000173E000-memory.dmp

                            Filesize

                            5.3MB

                            Download

                          • memory/2292-353-0x00000000011F0000-0x000000000173E000-memory.dmp

                            Filesize

                            5.3MB

                            Download

                          • memory/2292-347-0x00000000011F0000-0x000000000173E000-memory.dmp

                            Filesize

                            5.3MB

                            Download

                          • memory/2296-101-0x0000000000910000-0x0000000000DF3000-memory.dmp

                            Filesize

                            4.9MB

                            Download

                          • memory/2296-179-0x0000000000910000-0x0000000000DF3000-memory.dmp

                            Filesize

                            4.9MB

                            Download

                          • memory/2296-97-0x0000000000910000-0x0000000000DF3000-memory.dmp

                            Filesize

                            4.9MB

                            Download

                          • memory/2588-444-0x00000000011F0000-0x000000000173E000-memory.dmp

                            Filesize

                            5.3MB

                            Download

                          • memory/2588-438-0x00000000011F0000-0x000000000173E000-memory.dmp

                            Filesize

                            5.3MB

                            Download

                          • memory/3276-117-0x00000214FD280000-0x00000214FD2A2000-memory.dmp

                            Filesize

                            136KB

                            Download

                          • memory/3276-169-0x00000214FD4C0000-0x00000214FD4CA000-memory.dmp

                            Filesize

                            40KB

                            Download

                          • memory/3276-120-0x00000214FD330000-0x00000214FD3A6000-memory.dmp

                            Filesize

                            472KB

                            Download

                          • memory/3276-156-0x00000214FD4D0000-0x00000214FD4E2000-memory.dmp

                            Filesize

                            72KB

                            Download

                          • memory/3872-402-0x00000000011F0000-0x000000000173E000-memory.dmp

                            Filesize

                            5.3MB

                            Download

                          • memory/3872-396-0x00000000011F0000-0x000000000173E000-memory.dmp

                            Filesize

                            5.3MB

                            Download

                          • memory/3900-55-0x0000000000400000-0x00000000009DF000-memory.dmp

                            Filesize

                            5.9MB

                            Download

                          • memory/3900-59-0x0000000000400000-0x00000000009DF000-memory.dmp

                            Filesize

                            5.9MB

                            Download

                          • memory/3900-74-0x0000000000400000-0x00000000009DF000-memory.dmp

                            Filesize

                            5.9MB

                            Download

                          • memory/3900-28-0x0000000000400000-0x00000000009DF000-memory.dmp

                            Filesize

                            5.9MB

                            Download

                          • memory/3900-31-0x0000000000400000-0x00000000009DF000-memory.dmp

                            Filesize

                            5.9MB

                            Download

                          • memory/3900-32-0x0000000000400000-0x00000000009DF000-memory.dmp

                            Filesize

                            5.9MB

                            Download

                          • memory/3900-37-0x0000000000400000-0x00000000009DF000-memory.dmp

                            Filesize

                            5.9MB

                            Download

                          • memory/3900-38-0x0000000000400000-0x00000000009DF000-memory.dmp

                            Filesize

                            5.9MB

                            Download

                          • memory/3900-40-0x0000000000400000-0x00000000009DF000-memory.dmp

                            Filesize

                            5.9MB

                            Download

                          • memory/3900-44-0x0000000000400000-0x00000000009DF000-memory.dmp

                            Filesize

                            5.9MB

                            Download

                          • memory/3900-52-0x0000000000400000-0x00000000009DF000-memory.dmp

                            Filesize

                            5.9MB

                            Download

                          • memory/3900-57-0x0000000000400000-0x00000000009DF000-memory.dmp

                            Filesize

                            5.9MB

                            Download

                          • memory/3900-60-0x0000000000400000-0x00000000009DF000-memory.dmp

                            Filesize

                            5.9MB

                            Download

                          • memory/3900-33-0x0000000000400000-0x00000000009DF000-memory.dmp

                            Filesize

                            5.9MB

                            Download

                          • memory/3900-35-0x0000000000400000-0x00000000009DF000-memory.dmp

                            Filesize

                            5.9MB

                            Download

                          • memory/3900-39-0x0000000000400000-0x00000000009DF000-memory.dmp

                            Filesize

                            5.9MB

                            Download

                          • memory/3900-34-0x0000000000400000-0x00000000009DF000-memory.dmp

                            Filesize

                            5.9MB

                            Download

                          • memory/3900-36-0x0000000000400000-0x00000000009DF000-memory.dmp

                            Filesize

                            5.9MB

                            Download

                          • memory/3900-43-0x0000000000400000-0x00000000009DF000-memory.dmp

                            Filesize

                            5.9MB

                            Download

                          • memory/3900-41-0x0000000000400000-0x00000000009DF000-memory.dmp

                            Filesize

                            5.9MB

                            Download

                          • memory/3900-45-0x0000000000400000-0x00000000009DF000-memory.dmp

                            Filesize

                            5.9MB

                            Download

                          • memory/3900-42-0x0000000000400000-0x00000000009DF000-memory.dmp

                            Filesize

                            5.9MB

                            Download

                          • memory/3900-58-0x0000000000400000-0x00000000009DF000-memory.dmp

                            Filesize

                            5.9MB

                            Download

                          • memory/3900-46-0x0000000000400000-0x00000000009DF000-memory.dmp

                            Filesize

                            5.9MB

                            Download

                          • memory/3900-47-0x0000000000400000-0x00000000009DF000-memory.dmp

                            Filesize

                            5.9MB

                            Download

                          • memory/3900-56-0x0000000000400000-0x00000000009DF000-memory.dmp

                            Filesize

                            5.9MB

                            Download

                          • memory/3900-48-0x0000000000400000-0x00000000009DF000-memory.dmp

                            Filesize

                            5.9MB

                            Download

                          • memory/3900-50-0x0000000000400000-0x00000000009DF000-memory.dmp

                            Filesize

                            5.9MB

                            Download

                          • memory/3900-49-0x0000000000400000-0x00000000009DF000-memory.dmp

                            Filesize

                            5.9MB

                            Download

                          • memory/3900-51-0x0000000000400000-0x00000000009DF000-memory.dmp

                            Filesize

                            5.9MB

                            Download

                          • memory/3900-53-0x0000000000400000-0x00000000009DF000-memory.dmp

                            Filesize

                            5.9MB

                            Download

                          • memory/3900-54-0x0000000000400000-0x00000000009DF000-memory.dmp

                            Filesize

                            5.9MB

                            Download

                          • memory/4572-342-0x0000000000910000-0x0000000000DF3000-memory.dmp

                            Filesize

                            4.9MB

                            Download

                          • memory/4572-355-0x0000000000910000-0x0000000000DF3000-memory.dmp

                            Filesize

                            4.9MB

                            Download

                          • memory/4876-282-0x0000000000910000-0x0000000000DF3000-memory.dmp

                            Filesize

                            4.9MB

                            Download

                          • memory/4876-269-0x0000000000910000-0x0000000000DF3000-memory.dmp

                            Filesize

                            4.9MB

                            Download

                          • memory/4948-404-0x0000000000910000-0x0000000000DF3000-memory.dmp

                            Filesize

                            4.9MB

                            Download

                          • memory/4948-391-0x0000000000910000-0x0000000000DF3000-memory.dmp

                            Filesize

                            4.9MB

                            Download

                          • memory/4964-88-0x0000000000B40000-0x0000000001023000-memory.dmp

                            Filesize

                            4.9MB

                            Download

                          • memory/4964-98-0x0000000000B40000-0x0000000001023000-memory.dmp

                            Filesize

                            4.9MB

                            Download

                          • memory/4996-70-0x00000000011F0000-0x000000000173E000-memory.dmp

                            Filesize

                            5.3MB

                            Download

                          • memory/4996-68-0x00000000011F0000-0x000000000173E000-memory.dmp

                            Filesize

                            5.3MB

                            Download

                          • memory/4996-71-0x00000000011F0000-0x000000000173E000-memory.dmp

                            Filesize

                            5.3MB

                            Download

                          • memory/4996-65-0x00000000011F0000-0x000000000173E000-memory.dmp

                            Filesize

                            5.3MB

                            Download

                          • memory/4996-69-0x00000000011F0000-0x000000000173E000-memory.dmp

                            Filesize

                            5.3MB

                            Download

                          • memory/4996-66-0x00000000011F0000-0x000000000173E000-memory.dmp

                            Filesize

                            5.3MB

                            Download

                          • memory/4996-72-0x00000000011F0000-0x000000000173E000-memory.dmp

                            Filesize

                            5.3MB

                            Download

                          • memory/4996-67-0x00000000011F0000-0x000000000173E000-memory.dmp

                            Filesize

                            5.3MB

                            Download

                          • memory/4996-64-0x00000000011F0000-0x000000000173E000-memory.dmp

                            Filesize

                            5.3MB

                            Download