Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-04-2024 22:58

General

  • Target

    85c0ca2627afecbe9b4c8758ebe0c3922717dc364993e6f7aad1168b95d41a40.exe

  • Size

    1.8MB

  • MD5

    7f40d98b2ba64348358fd75b5f0bdcfb

  • SHA1

    e9f33ceeac6b2de2f63f9e73902b2926ba61364c

  • SHA256

    85c0ca2627afecbe9b4c8758ebe0c3922717dc364993e6f7aad1168b95d41a40

  • SHA512

    c275ae0f9199f7fc024565e55afdbd952ad46ebcb890018acd22893e6e063a1db0e995fae77fc6e3a2ccb0971666e7ca5b920f4e8fc75b39f830bc0f45799abd

  • SSDEEP

    24576:zbBE9EkzS56PSpOhed47Vm49wmFNaC0GL3bJN7xWiJ3HA7blfGPOo/2GVgUNPJ9D:zbBMETUqpO8deNNPT0HGZ+UNga

Malware Config

Extracted

Family

amadey

Version

4.18

C2

http://193.233.132.56

Attributes
  • install_dir

    09fd851a4f

  • install_file

    explorha.exe

  • strings_key

    443351145ece4966ded809641c77cfa8

  • url_paths

    /Pneh2sXQk0/index.php

rc4.plain

Extracted

Family

amadey

Version

4.17

C2

http://185.215.113.32

Attributes
  • install_dir

    00c07260dc

  • install_file

    explorgu.exe

  • strings_key

    461809bd97c251ba0c0c8450c7055f1d

  • url_paths

    /yandex/index.php

rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

  • Detects executables packed with Themida 10 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs
  • Blocklisted process makes network request 4 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 14 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 7 IoCs
  • Identifies Wine through registry keys 2 TTPs 6 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 6 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 10 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 43 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 63 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\85c0ca2627afecbe9b4c8758ebe0c3922717dc364993e6f7aad1168b95d41a40.exe
    "C:\Users\Admin\AppData\Local\Temp\85c0ca2627afecbe9b4c8758ebe0c3922717dc364993e6f7aad1168b95d41a40.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:3356
    • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
      "C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:404
      • C:\Users\Admin\AppData\Local\Temp\1000042001\f770f38967.exe
        "C:\Users\Admin\AppData\Local\Temp\1000042001\f770f38967.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Checks whether UAC is enabled
        PID:2316
      • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
        "C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"
        3⤵
          PID:852
        • C:\Users\Admin\AppData\Local\Temp\1000049001\amert.exe
          "C:\Users\Admin\AppData\Local\Temp\1000049001\amert.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          PID:1952
        • C:\Windows\SysWOW64\rundll32.exe
          "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
          3⤵
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:2964
          • C:\Windows\system32\rundll32.exe
            "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
            4⤵
            • Blocklisted process makes network request
            • Loads dropped DLL
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:3924
            • C:\Windows\system32\netsh.exe
              netsh wlan show profiles
              5⤵
                PID:4848
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\570491262506_Desktop.zip' -CompressionLevel Optimal
                5⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:1128
          • C:\Users\Admin\AppData\Local\Temp\1000051001\4b00018890.exe
            "C:\Users\Admin\AppData\Local\Temp\1000051001\4b00018890.exe"
            3⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of WriteProcessMemory
            PID:64
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
              4⤵
              • Enumerates system info in registry
              • Modifies data under HKEY_USERS
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of WriteProcessMemory
              PID:4792
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffca1a99758,0x7ffca1a99768,0x7ffca1a99778
                5⤵
                  PID:4500
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1792 --field-trial-handle=1688,i,17406593953982927397,11668463940740309418,131072 /prefetch:2
                  5⤵
                    PID:3208
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=1688,i,17406593953982927397,11668463940740309418,131072 /prefetch:8
                    5⤵
                      PID:1020
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2176 --field-trial-handle=1688,i,17406593953982927397,11668463940740309418,131072 /prefetch:8
                      5⤵
                        PID:2484
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3068 --field-trial-handle=1688,i,17406593953982927397,11668463940740309418,131072 /prefetch:1
                        5⤵
                          PID:4736
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3088 --field-trial-handle=1688,i,17406593953982927397,11668463940740309418,131072 /prefetch:1
                          5⤵
                            PID:916
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4568 --field-trial-handle=1688,i,17406593953982927397,11668463940740309418,131072 /prefetch:1
                            5⤵
                              PID:4152
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4792 --field-trial-handle=1688,i,17406593953982927397,11668463940740309418,131072 /prefetch:8
                              5⤵
                                PID:3152
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4984 --field-trial-handle=1688,i,17406593953982927397,11668463940740309418,131072 /prefetch:8
                                5⤵
                                  PID:4456
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4996 --field-trial-handle=1688,i,17406593953982927397,11668463940740309418,131072 /prefetch:8
                                  5⤵
                                    PID:2972
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3684 --field-trial-handle=1688,i,17406593953982927397,11668463940740309418,131072 /prefetch:2
                                    5⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:3008
                              • C:\Windows\SysWOW64\rundll32.exe
                                "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
                                3⤵
                                • Blocklisted process makes network request
                                • Loads dropped DLL
                                PID:1464
                          • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                            "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                            1⤵
                              PID:1628
                            • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                              C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                              1⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • Suspicious behavior: EnumeratesProcesses
                              PID:2296
                            • C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
                              C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
                              1⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • Suspicious behavior: EnumeratesProcesses
                              PID:4572
                              • C:\Windows\SysWOW64\rundll32.exe
                                "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
                                2⤵
                                • Loads dropped DLL
                                PID:1220
                                • C:\Windows\system32\rundll32.exe
                                  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
                                  3⤵
                                  • Blocklisted process makes network request
                                  • Loads dropped DLL
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:4088
                                  • C:\Windows\system32\netsh.exe
                                    netsh wlan show profiles
                                    4⤵
                                      PID:3252
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\570491262506_Desktop.zip' -CompressionLevel Optimal
                                      4⤵
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:1660
                                • C:\Windows\SysWOW64\rundll32.exe
                                  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
                                  2⤵
                                  • Blocklisted process makes network request
                                  • Loads dropped DLL
                                  PID:568
                              • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                1⤵
                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Identifies Wine through registry keys
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                • Suspicious behavior: EnumeratesProcesses
                                PID:2092

                              Network

                              MITRE ATT&CK Enterprise v15

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                Filesize

                                216B

                                MD5

                                6ae2a7f0135ddef904b4bda062991b5b

                                SHA1

                                f3d0e883e85a37717d07ed5ef25d7616cec0ea73

                                SHA256

                                ef7c181e99c865c7aca6b5e9e439995de24cb791a98c84eebdfc4c2cdbd4fd63

                                SHA512

                                89bbb0d88ed525d2c05537f9350b33d2172dd1aa42652bd5fd437b488efe1257ea7d0dcb388e241ea8db407d47d17b1260dc7c9c13a154222c792f41129b0ba6

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                Filesize

                                2KB

                                MD5

                                8ed3c31edfd7ab2d46c77b80b9af14f9

                                SHA1

                                aa9d089353a3b9450919e005aa3b4cfa8a5d4b98

                                SHA256

                                76e07ba8fedd8bf7df7913073dd277f96032b3869d1b1fb4ccba8d4b6f13b61c

                                SHA512

                                3bf0851a4148f982d8d6adad0736cd48a1a524652c8d5c318ef92516b4c8c27ee24f63284356fe7c73921f47dbc0150404c15ad584d553ea9da5282473463caa

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                Filesize

                                537B

                                MD5

                                33aada6c6f59645f079dd0925cac6ce9

                                SHA1

                                72b05c6bd56fceb0f92db0f7c2dee8f94fbab711

                                SHA256

                                a35a86c2a80d0a28306c26fc1df1cf1da7053871cde9e5fb2e3ef4909242ccf4

                                SHA512

                                1e4df3a6c3a434a9cfb043535b048045e90481d16f55387c6cb0db047726562c67dbfb686a89d3c283f49cee47ecd1e9cb79c51850e6e993af93cf13804b1f90

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                Filesize

                                6KB

                                MD5

                                09f30f42c9eb5bcf0e045ef3ce4641b3

                                SHA1

                                66e75241dfd077fd9ddad8f49c7989e2d33761d5

                                SHA256

                                515ff91fe45be54a7fa66882765980f56b78e2eb7dcf8362a5954d36d842a997

                                SHA512

                                8fd33482322f7ef01ff7482751a788bc83164aa26c22f808b3a88df44df0721503252dcedfea3df250774238fb95bad96a97999fb492d45f4d9b325ab5582de4

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                Filesize

                                15KB

                                MD5

                                c67882d297cb0fac720b6cd6c8b094a0

                                SHA1

                                b10574302365bda05866543f2fba6c6f2907dcc5

                                SHA256

                                3c422e04d9a5c6d368ac8ed8b307ffdde3eb43f3acdeb8eed2c56ca99930fe77

                                SHA512

                                d2ba15b4b27557cd2e4642ac44cbcdd4ce8c6a6d4fa506a5717564f2fc91e900c7b53e66f099c913df88512eb76e39c06fe1b302ae26a84fa0b1ea8fadd69160

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                Filesize

                                260KB

                                MD5

                                6f7447e9663564f4abef83916133ccbc

                                SHA1

                                14e2a5ec0219d06daee44f3293644117d0f32cf9

                                SHA256

                                09bfdaee3bb0e0aac4b48f3bce015a664b2da240fa62b6d265693c9bf8defb8d

                                SHA512

                                24f8c4abf410a28b96126e5edd5b21eb2682702b3a746538dd67f78e5644984ec6993a20880dc05bbff0e81075a664f2e3406362bebad8b2c71f79deec915ad0

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                                Filesize

                                2B

                                MD5

                                99914b932bd37a50b983c5e7c90ae93b

                                SHA1

                                bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                SHA256

                                44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                SHA512

                                27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                Filesize

                                3KB

                                MD5

                                fe3aab3ae544a134b68e881b82b70169

                                SHA1

                                926e9b4e527ae1bd9b3b25726e1f59d5a34d36a6

                                SHA256

                                bda499e3f69d8fe0227e734bbb935dc5bf0050d37adf03bc41356dfcb5bcca0b

                                SHA512

                                3fbd3499d98280b6c79c67b0ee183b27692dbc31acf103b4f8ca4dcdf392afff2b3aad500037f4288581ed37e85f45c3bbb5dcde11cddf3ef0609f44b2ecb280

                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                Filesize

                                1KB

                                MD5

                                7f5130f8643f9c281b6384704d27b900

                                SHA1

                                c384737918a1e492e8742800a251d31de1842de2

                                SHA256

                                e5a21b6e080bd51ab39ae0aa91aa0573951a52aafd2f021263141d0755e1cf8f

                                SHA512

                                ff471d00db8f4ec88cd0d52894e4f1a91ad32473cb173b7a5d431def9717cbe106c2ae431869651a3a9fc1801f9997a9d35d22a85cdb605ed98731e6dc129161

                              • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe

                                Filesize

                                1.8MB

                                MD5

                                7f40d98b2ba64348358fd75b5f0bdcfb

                                SHA1

                                e9f33ceeac6b2de2f63f9e73902b2926ba61364c

                                SHA256

                                85c0ca2627afecbe9b4c8758ebe0c3922717dc364993e6f7aad1168b95d41a40

                                SHA512

                                c275ae0f9199f7fc024565e55afdbd952ad46ebcb890018acd22893e6e063a1db0e995fae77fc6e3a2ccb0971666e7ca5b920f4e8fc75b39f830bc0f45799abd

                              • C:\Users\Admin\AppData\Local\Temp\1000042001\f770f38967.exe

                                Filesize

                                3.0MB

                                MD5

                                3edac80b993a482f7112524ab56c8ab0

                                SHA1

                                e9aca74db0ddbbc6eccf8039a7c7a892fe3f746c

                                SHA256

                                5af1635dd01cd83fc6c9bb03f52f066ff9fd2c8e6e5a9260f71288fba4fe438d

                                SHA512

                                e7afb65176dcc69c8af46da866a4ba762ee1fe039a94089a1ed6f61d6ee4845c1fdd32f9cfbf343399db3cffc8bbb5a5ef81d0f78face4d1262e5e736c64b45b

                              • C:\Users\Admin\AppData\Local\Temp\1000049001\amert.exe

                                Filesize

                                1.8MB

                                MD5

                                5c1591069b7d16c4e1c354e8589e3e29

                                SHA1

                                0822e58e1d4674a3ae29351a4eea38012616efd4

                                SHA256

                                fe04a0fbd786f1f69cb8716383383149a910de26bfed62ea9611f2ff357cb869

                                SHA512

                                82bd3a6343ab833702b327652f45cbd92b53f41e9e4caa25b1b589041f6c9963057e378ff5cf48880e6f63c3c588379d693da57dff858abe822ce8bf034e1253

                              • C:\Users\Admin\AppData\Local\Temp\1000051001\4b00018890.exe

                                Filesize

                                1.1MB

                                MD5

                                c1a04495bca429962b8b3344fa8684a2

                                SHA1

                                b6f77a13ad98d5cdd56152fe0ff1fca62aeb286c

                                SHA256

                                4896377dfe62c7180cc960702291f7467ec7a2209b207cbfd63ccf27f29af524

                                SHA512

                                1cbb5fa5a027898dff3bf12c7c2428f56243b21b5f99101f235ae0dc2283a8421f68667f95e7ab1b6c8ec32d62f2f5d41a2f736dcbf5b0bce087ae317406afd4

                              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4u1yiijc.j5q.ps1

                                Filesize

                                60B

                                MD5

                                d17fe0a3f47be24a6453e9ef58c94641

                                SHA1

                                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                SHA256

                                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                SHA512

                                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                                Filesize

                                109KB

                                MD5

                                2afdbe3b99a4736083066a13e4b5d11a

                                SHA1

                                4d4856cf02b3123ac16e63d4a448cdbcb1633546

                                SHA256

                                8d31b39170909595b518b1a03e9ec950540fabd545ed14817cac5c84b91599ee

                                SHA512

                                d89b3c46854153e60e3fa825b394344eee33936d7dbf186af9d95c9adae54428609e3bf21a18d38fce3d96f3e0b8e4e0ed25cb5004fbe288de3aef3a85b1d93f

                              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

                                Filesize

                                1.2MB

                                MD5

                                92fbdfccf6a63acef2743631d16652a7

                                SHA1

                                971968b1378dd89d59d7f84bf92f16fc68664506

                                SHA256

                                b4588feacc183cd5a089f9bb950827b75df04bd5a6e67c95ff258e4a34aa0d72

                                SHA512

                                b8ea216d4a59d8858fd4128abb555f8dcf3acca9138e663b488f09dc5200db6dc11ecc235a355e801145bbbb44d7beac6147949d75d78b32fe9cfd2fa200d117

                              • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

                                Filesize

                                109KB

                                MD5

                                726cd06231883a159ec1ce28dd538699

                                SHA1

                                404897e6a133d255ad5a9c26ac6414d7134285a2

                                SHA256

                                12fef2d5995d671ec0e91bdbdc91e2b0d3c90ed3a8b2b13ddaa8ad64727dcd46

                                SHA512

                                9ea82e7cb6c6a58446bd5033855947c3e2d475d2910f2b941235e0b96aa08eec822d2dd17cc86b2d3fce930f78b799291992408e309a6c63e3011266810ea83e

                              • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

                                Filesize

                                1.2MB

                                MD5

                                15a42d3e4579da615a384c717ab2109b

                                SHA1

                                22aeedeb2307b1370cdab70d6a6b6d2c13ad2301

                                SHA256

                                3c97bb410e49b11af8116feb7240b7101e1967cae7538418c45c3d2e072e8103

                                SHA512

                                1eb7f126dccc88a2479e3818c36120f5af3caa0d632b9ea803485ee6531d6e2a1fd0805b1c4364983d280df23ea5ca3ad4a5fca558ac436efae36af9b795c444

                              • \??\pipe\crashpad_4792_LLAYFPZRAOBVLUVL

                                MD5

                                d41d8cd98f00b204e9800998ecf8427e

                                SHA1

                                da39a3ee5e6b4b0d3255bfef95601890afd80709

                                SHA256

                                e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                SHA512

                                cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                              • memory/404-32-0x0000000004BD0000-0x0000000004BD1000-memory.dmp

                                Filesize

                                4KB

                              • memory/404-23-0x0000000000F70000-0x000000000142F000-memory.dmp

                                Filesize

                                4.7MB

                              • memory/404-31-0x0000000004BC0000-0x0000000004BC1000-memory.dmp

                                Filesize

                                4KB

                              • memory/404-124-0x0000000000F70000-0x000000000142F000-memory.dmp

                                Filesize

                                4.7MB

                              • memory/404-29-0x0000000004B40000-0x0000000004B41000-memory.dmp

                                Filesize

                                4KB

                              • memory/404-308-0x0000000000F70000-0x000000000142F000-memory.dmp

                                Filesize

                                4.7MB

                              • memory/404-26-0x0000000004B80000-0x0000000004B81000-memory.dmp

                                Filesize

                                4KB

                              • memory/404-27-0x0000000004B60000-0x0000000004B61000-memory.dmp

                                Filesize

                                4KB

                              • memory/404-28-0x0000000004BA0000-0x0000000004BA1000-memory.dmp

                                Filesize

                                4KB

                              • memory/404-25-0x0000000004B70000-0x0000000004B71000-memory.dmp

                                Filesize

                                4KB

                              • memory/404-24-0x0000000000F70000-0x000000000142F000-memory.dmp

                                Filesize

                                4.7MB

                              • memory/404-261-0x0000000000F70000-0x000000000142F000-memory.dmp

                                Filesize

                                4.7MB

                              • memory/404-211-0x0000000000F70000-0x000000000142F000-memory.dmp

                                Filesize

                                4.7MB

                              • memory/404-30-0x0000000004B50000-0x0000000004B51000-memory.dmp

                                Filesize

                                4KB

                              • memory/404-75-0x0000000000F70000-0x000000000142F000-memory.dmp

                                Filesize

                                4.7MB

                              • memory/404-322-0x0000000000F70000-0x000000000142F000-memory.dmp

                                Filesize

                                4.7MB

                              • memory/404-326-0x0000000000F70000-0x000000000142F000-memory.dmp

                                Filesize

                                4.7MB

                              • memory/404-343-0x0000000000F70000-0x000000000142F000-memory.dmp

                                Filesize

                                4.7MB

                              • memory/404-347-0x0000000000F70000-0x000000000142F000-memory.dmp

                                Filesize

                                4.7MB

                              • memory/404-233-0x0000000000F70000-0x000000000142F000-memory.dmp

                                Filesize

                                4.7MB

                              • memory/404-174-0x0000000000F70000-0x000000000142F000-memory.dmp

                                Filesize

                                4.7MB

                              • memory/404-146-0x0000000000F70000-0x000000000142F000-memory.dmp

                                Filesize

                                4.7MB

                              • memory/404-360-0x0000000000F70000-0x000000000142F000-memory.dmp

                                Filesize

                                4.7MB

                              • memory/404-363-0x0000000000F70000-0x000000000142F000-memory.dmp

                                Filesize

                                4.7MB

                              • memory/404-366-0x0000000000F70000-0x000000000142F000-memory.dmp

                                Filesize

                                4.7MB

                              • memory/404-374-0x0000000000F70000-0x000000000142F000-memory.dmp

                                Filesize

                                4.7MB

                              • memory/1128-158-0x0000019E49590000-0x0000019E495A2000-memory.dmp

                                Filesize

                                72KB

                              • memory/1128-144-0x0000019E487E0000-0x0000019E487F0000-memory.dmp

                                Filesize

                                64KB

                              • memory/1128-173-0x00007FFCA0E70000-0x00007FFCA1931000-memory.dmp

                                Filesize

                                10.8MB

                              • memory/1128-131-0x0000019E49310000-0x0000019E49332000-memory.dmp

                                Filesize

                                136KB

                              • memory/1128-166-0x0000019E49580000-0x0000019E4958A000-memory.dmp

                                Filesize

                                40KB

                              • memory/1128-142-0x00007FFCA0E70000-0x00007FFCA1931000-memory.dmp

                                Filesize

                                10.8MB

                              • memory/1128-145-0x0000019E487E0000-0x0000019E487F0000-memory.dmp

                                Filesize

                                64KB

                              • memory/1660-297-0x00007FFCA06C0000-0x00007FFCA1181000-memory.dmp

                                Filesize

                                10.8MB

                              • memory/1660-299-0x000002322D9B0000-0x000002322D9C0000-memory.dmp

                                Filesize

                                64KB

                              • memory/1952-82-0x0000000004A60000-0x0000000004A61000-memory.dmp

                                Filesize

                                4KB

                              • memory/1952-77-0x0000000000980000-0x0000000000E49000-memory.dmp

                                Filesize

                                4.8MB

                              • memory/1952-83-0x0000000004A00000-0x0000000004A01000-memory.dmp

                                Filesize

                                4KB

                              • memory/1952-121-0x0000000000980000-0x0000000000E49000-memory.dmp

                                Filesize

                                4.8MB

                              • memory/1952-84-0x0000000004A10000-0x0000000004A11000-memory.dmp

                                Filesize

                                4KB

                              • memory/1952-85-0x0000000004A50000-0x0000000004A51000-memory.dmp

                                Filesize

                                4KB

                              • memory/1952-104-0x0000000004A70000-0x0000000004A71000-memory.dmp

                                Filesize

                                4KB

                              • memory/1952-81-0x0000000004A20000-0x0000000004A21000-memory.dmp

                                Filesize

                                4KB

                              • memory/1952-79-0x0000000004A30000-0x0000000004A31000-memory.dmp

                                Filesize

                                4KB

                              • memory/1952-80-0x0000000004A40000-0x0000000004A41000-memory.dmp

                                Filesize

                                4KB

                              • memory/1952-78-0x0000000000980000-0x0000000000E49000-memory.dmp

                                Filesize

                                4.8MB

                              • memory/1952-103-0x0000000004A80000-0x0000000004A81000-memory.dmp

                                Filesize

                                4KB

                              • memory/2092-358-0x0000000000F70000-0x000000000142F000-memory.dmp

                                Filesize

                                4.7MB

                              • memory/2296-253-0x0000000000F70000-0x000000000142F000-memory.dmp

                                Filesize

                                4.7MB

                              • memory/2296-244-0x0000000004AC0000-0x0000000004AC1000-memory.dmp

                                Filesize

                                4KB

                              • memory/2296-243-0x0000000004AB0000-0x0000000004AB1000-memory.dmp

                                Filesize

                                4KB

                              • memory/2296-236-0x0000000000F70000-0x000000000142F000-memory.dmp

                                Filesize

                                4.7MB

                              • memory/2296-241-0x0000000004AD0000-0x0000000004AD1000-memory.dmp

                                Filesize

                                4KB

                              • memory/2296-238-0x0000000000F70000-0x000000000142F000-memory.dmp

                                Filesize

                                4.7MB

                              • memory/2296-239-0x0000000004AE0000-0x0000000004AE1000-memory.dmp

                                Filesize

                                4KB

                              • memory/2296-240-0x0000000004AF0000-0x0000000004AF1000-memory.dmp

                                Filesize

                                4KB

                              • memory/2296-242-0x0000000004B10000-0x0000000004B11000-memory.dmp

                                Filesize

                                4KB

                              • memory/2316-56-0x00000000004B0000-0x0000000000C51000-memory.dmp

                                Filesize

                                7.6MB

                              • memory/2316-52-0x00000000004B0000-0x0000000000C51000-memory.dmp

                                Filesize

                                7.6MB

                              • memory/2316-143-0x00000000004B0000-0x0000000000C51000-memory.dmp

                                Filesize

                                7.6MB

                              • memory/2316-51-0x00000000004B0000-0x0000000000C51000-memory.dmp

                                Filesize

                                7.6MB

                              • memory/2316-53-0x00000000004B0000-0x0000000000C51000-memory.dmp

                                Filesize

                                7.6MB

                              • memory/2316-54-0x00000000004B0000-0x0000000000C51000-memory.dmp

                                Filesize

                                7.6MB

                              • memory/2316-55-0x00000000004B0000-0x0000000000C51000-memory.dmp

                                Filesize

                                7.6MB

                              • memory/2316-57-0x00000000004B0000-0x0000000000C51000-memory.dmp

                                Filesize

                                7.6MB

                              • memory/2316-58-0x00000000004B0000-0x0000000000C51000-memory.dmp

                                Filesize

                                7.6MB

                              • memory/3356-21-0x0000000000920000-0x0000000000DDF000-memory.dmp

                                Filesize

                                4.7MB

                              • memory/3356-1-0x0000000077D64000-0x0000000077D66000-memory.dmp

                                Filesize

                                8KB

                              • memory/3356-2-0x0000000000920000-0x0000000000DDF000-memory.dmp

                                Filesize

                                4.7MB

                              • memory/3356-4-0x0000000005160000-0x0000000005161000-memory.dmp

                                Filesize

                                4KB

                              • memory/3356-3-0x0000000005150000-0x0000000005151000-memory.dmp

                                Filesize

                                4KB

                              • memory/3356-5-0x0000000005140000-0x0000000005141000-memory.dmp

                                Filesize

                                4KB

                              • memory/3356-7-0x0000000005120000-0x0000000005121000-memory.dmp

                                Filesize

                                4KB

                              • memory/3356-0-0x0000000000920000-0x0000000000DDF000-memory.dmp

                                Filesize

                                4.7MB

                              • memory/3356-6-0x0000000005180000-0x0000000005181000-memory.dmp

                                Filesize

                                4KB

                              • memory/3356-8-0x0000000005130000-0x0000000005131000-memory.dmp

                                Filesize

                                4KB

                              • memory/3356-10-0x00000000051A0000-0x00000000051A1000-memory.dmp

                                Filesize

                                4KB

                              • memory/3356-9-0x00000000051B0000-0x00000000051B1000-memory.dmp

                                Filesize

                                4KB

                              • memory/4572-286-0x0000000000A20000-0x0000000000EE9000-memory.dmp

                                Filesize

                                4.8MB

                              • memory/4572-262-0x0000000000A20000-0x0000000000EE9000-memory.dmp

                                Filesize

                                4.8MB

                              • memory/4572-309-0x0000000000A20000-0x0000000000EE9000-memory.dmp

                                Filesize

                                4.8MB

                              • memory/4572-237-0x0000000000A20000-0x0000000000EE9000-memory.dmp

                                Filesize

                                4.8MB

                              • memory/4572-245-0x0000000004FB0000-0x0000000004FB1000-memory.dmp

                                Filesize

                                4KB

                              • memory/4572-323-0x0000000000A20000-0x0000000000EE9000-memory.dmp

                                Filesize

                                4.8MB

                              • memory/4572-247-0x0000000004FA0000-0x0000000004FA1000-memory.dmp

                                Filesize

                                4KB

                              • memory/4572-327-0x0000000000A20000-0x0000000000EE9000-memory.dmp

                                Filesize

                                4.8MB

                              • memory/4572-248-0x0000000004FF0000-0x0000000004FF1000-memory.dmp

                                Filesize

                                4KB

                              • memory/4572-251-0x0000000004FE0000-0x0000000004FE1000-memory.dmp

                                Filesize

                                4KB

                              • memory/4572-344-0x0000000000A20000-0x0000000000EE9000-memory.dmp

                                Filesize

                                4.8MB

                              • memory/4572-246-0x0000000004FC0000-0x0000000004FC1000-memory.dmp

                                Filesize

                                4KB

                              • memory/4572-348-0x0000000000A20000-0x0000000000EE9000-memory.dmp

                                Filesize

                                4.8MB

                              • memory/4572-249-0x0000000004F80000-0x0000000004F81000-memory.dmp

                                Filesize

                                4KB

                              • memory/4572-255-0x0000000005000000-0x0000000005001000-memory.dmp

                                Filesize

                                4KB

                              • memory/4572-361-0x0000000000A20000-0x0000000000EE9000-memory.dmp

                                Filesize

                                4.8MB

                              • memory/4572-254-0x0000000005010000-0x0000000005011000-memory.dmp

                                Filesize

                                4KB

                              • memory/4572-364-0x0000000000A20000-0x0000000000EE9000-memory.dmp

                                Filesize

                                4.8MB

                              • memory/4572-250-0x0000000004F90000-0x0000000004F91000-memory.dmp

                                Filesize

                                4KB

                              • memory/4572-367-0x0000000000A20000-0x0000000000EE9000-memory.dmp

                                Filesize

                                4.8MB

                              • memory/4572-252-0x0000000000A20000-0x0000000000EE9000-memory.dmp

                                Filesize

                                4.8MB

                              • memory/4572-375-0x0000000000A20000-0x0000000000EE9000-memory.dmp

                                Filesize

                                4.8MB