amadey | b5dc49e48cba0a871975d8e96002b60e67d7e285f7970f4dea4d88561d989aa3

Analysis

max time kernel
147s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
21/04/2024, 12:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b5dc49e48cba0a871975d8e96002b60e67d7e285f7970f4dea4d88561d989aa3.exe
Size 3.1MB
Sample240421-pr8azabe72
SHA256 b5dc49e48cba0a871975d8e96002b60e67d7e285f7970f4dea4d88561d989aa3
MD5 feb8c44cbf9e01446a4a0f585a094905
SHA1 bc71574d5fdd3a4569a90b925a4ac369383cbbd9
SHA512 b0ff33213357ed05da21b3fa5eb5299a6558c87db87bc426f2f09db6e65243a4233f398d86dcf09729e1cdfc349b9f0f77e13c21747655d7f1cb4aa65e760767
SSDEEP 49152:XTFNFCgG89obVRvORIStgLLBr10Z/leIn1nLDRONgivzZq8dEz:XJXCgSJRvOOStgLLBp0Z0In1nPclbEM
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey redline risepro zgrat evasion infostealer persistence rat spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.18

http://193.233.132.56

Attributes

install_dir
09fd851a4f
install_file
explorha.exe
strings_key
443351145ece4966ded809641c77cfa8
url_paths
/Pneh2sXQk0/index.php

rc4.plain

Extracted

Family

amadey

Version

4.17

http://193.233.132.167

Attributes

install_dir
4d0ab15804
install_file
chrosha.exe
strings_key
1a9519d7b465e1f4880fa09a6162d768
url_paths
/enigma/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detect ZGRat V1 1 IoCs

resource	yara_rule
behavioral2/files/0x000300000002aa48-450.dat	family_zgrat_v1

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000200000002aa50-484.dat	family_redline
behavioral2/files/0x000200000002aa51-490.dat	family_redline

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 8 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorha.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	b5dc49e48cba0a871975d8e96002b60e67d7e285f7970f4dea4d88561d989aa3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorha.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorha.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	a6c8c66835.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorha.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	amert.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	chrosha.exe

Blocklisted process makes network request 2 IoCs

flow	pid	Process
27	4712	rundll32.exe
29	584	rundll32.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 16 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	a6c8c66835.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	amert.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	a6c8c66835.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	b5dc49e48cba0a871975d8e96002b60e67d7e285f7970f4dea4d88561d989aa3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	amert.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	chrosha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	chrosha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	b5dc49e48cba0a871975d8e96002b60e67d7e285f7970f4dea4d88561d989aa3.exe

Executes dropped EXE 12 IoCs

pid	Process
2024	explorha.exe
3432	explorha.exe
3280	dc93dd26ad.exe
952	a6c8c66835.exe
4844	explorha.exe
1344	amert.exe
1096	chrosha.exe
4240	explorha.exe
3640	swiiiii.exe
3976	alexxxxxxxx.exe
1984	Traffic.exe
1676	propro.exe

Identifies Wine through registry keys 2 TTPs 8 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000\Software\Wine	chrosha.exe
Key opened	\REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000\Software\Wine	explorha.exe
Key opened	\REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000\Software\Wine	b5dc49e48cba0a871975d8e96002b60e67d7e285f7970f4dea4d88561d989aa3.exe
Key opened	\REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000\Software\Wine	explorha.exe
Key opened	\REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000\Software\Wine	explorha.exe
Key opened	\REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000\Software\Wine	a6c8c66835.exe
Key opened	\REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000\Software\Wine	explorha.exe
Key opened	\REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000\Software\Wine	amert.exe

Loads dropped DLL 3 IoCs

pid	Process
836	rundll32.exe
4712	rundll32.exe
584	rundll32.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000\Software\Microsoft\Windows\CurrentVersion\Run\a6c8c66835.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000056001\\a6c8c66835.exe"	explorha.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000\Software\Microsoft\Windows\CurrentVersion\Run\dc93dd26ad.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000055001\\dc93dd26ad.exe"	explorha.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000100000002aa19-46.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs

pid	Process
2184	b5dc49e48cba0a871975d8e96002b60e67d7e285f7970f4dea4d88561d989aa3.exe
2024	explorha.exe
3432	explorha.exe
952	a6c8c66835.exe
4844	explorha.exe
1344	amert.exe
1096	chrosha.exe
4240	explorha.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3640 set thread context of 868	3640	swiiiii.exe	121
PID 3976 set thread context of 1252	3976	alexxxxxxxx.exe	127

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explorha.job	b5dc49e48cba0a871975d8e96002b60e67d7e285f7970f4dea4d88561d989aa3.exe
File created	C:\Windows\Tasks\chrosha.job	amert.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2468	3640	WerFault.exe	119

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133581765110736196"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2718508534-2116753757-2794822388-1000\{F479D811-F02F-460C-B2E7-1530E1E37666}	chrome.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064	propro.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61	propro.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
2184	b5dc49e48cba0a871975d8e96002b60e67d7e285f7970f4dea4d88561d989aa3.exe
2184	b5dc49e48cba0a871975d8e96002b60e67d7e285f7970f4dea4d88561d989aa3.exe
2024	explorha.exe
2024	explorha.exe
3432	explorha.exe
3432	explorha.exe
1412	chrome.exe
1412	chrome.exe
4712	rundll32.exe
4712	rundll32.exe
4712	rundll32.exe
4712	rundll32.exe
4712	rundll32.exe
4712	rundll32.exe
4712	rundll32.exe
4712	rundll32.exe
4712	rundll32.exe
4712	rundll32.exe
3896	powershell.exe
3896	powershell.exe
3896	powershell.exe
952	a6c8c66835.exe
952	a6c8c66835.exe
4844	explorha.exe
4844	explorha.exe
1412	chrome.exe
1412	chrome.exe
1344	amert.exe
1344	amert.exe
1096	chrosha.exe
1096	chrosha.exe
4240	explorha.exe
4240	explorha.exe
3684	chrome.exe
3684	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeCreatePagefilePrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeCreatePagefilePrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeCreatePagefilePrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeCreatePagefilePrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeCreatePagefilePrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeCreatePagefilePrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeCreatePagefilePrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeCreatePagefilePrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeCreatePagefilePrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeCreatePagefilePrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeCreatePagefilePrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeCreatePagefilePrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeCreatePagefilePrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeCreatePagefilePrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeCreatePagefilePrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeCreatePagefilePrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeCreatePagefilePrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeCreatePagefilePrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeCreatePagefilePrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeCreatePagefilePrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeCreatePagefilePrivilege	1412	chrome.exe
Token: SeDebugPrivilege	3896	powershell.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeCreatePagefilePrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeCreatePagefilePrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeCreatePagefilePrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeCreatePagefilePrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeCreatePagefilePrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeCreatePagefilePrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeCreatePagefilePrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeCreatePagefilePrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeCreatePagefilePrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe
Token: SeCreatePagefilePrivilege	1412	chrome.exe
Token: SeShutdownPrivilege	1412	chrome.exe

Suspicious use of FindShellTrayWindow 63 IoCs

pid	Process
3280	dc93dd26ad.exe
3280	dc93dd26ad.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
3280	dc93dd26ad.exe
1412	chrome.exe
3280	dc93dd26ad.exe
1412	chrome.exe
3280	dc93dd26ad.exe
3280	dc93dd26ad.exe
3280	dc93dd26ad.exe
3280	dc93dd26ad.exe
3280	dc93dd26ad.exe
3280	dc93dd26ad.exe
3280	dc93dd26ad.exe
3280	dc93dd26ad.exe
3280	dc93dd26ad.exe
3280	dc93dd26ad.exe
3280	dc93dd26ad.exe
3280	dc93dd26ad.exe
3280	dc93dd26ad.exe
3280	dc93dd26ad.exe
3280	dc93dd26ad.exe
3280	dc93dd26ad.exe
3280	dc93dd26ad.exe
3280	dc93dd26ad.exe
3280	dc93dd26ad.exe
3280	dc93dd26ad.exe
3280	dc93dd26ad.exe
3280	dc93dd26ad.exe
3280	dc93dd26ad.exe
3280	dc93dd26ad.exe
3280	dc93dd26ad.exe
3280	dc93dd26ad.exe
3280	dc93dd26ad.exe
3280	dc93dd26ad.exe
3280	dc93dd26ad.exe
3280	dc93dd26ad.exe
3280	dc93dd26ad.exe
3280	dc93dd26ad.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
3280	dc93dd26ad.exe
3280	dc93dd26ad.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
1412	chrome.exe
3280	dc93dd26ad.exe
3280	dc93dd26ad.exe
3280	dc93dd26ad.exe
3280	dc93dd26ad.exe
3280	dc93dd26ad.exe
3280	dc93dd26ad.exe
3280	dc93dd26ad.exe
3280	dc93dd26ad.exe
3280	dc93dd26ad.exe
3280	dc93dd26ad.exe
3280	dc93dd26ad.exe
3280	dc93dd26ad.exe
3280	dc93dd26ad.exe
3280	dc93dd26ad.exe
3280	dc93dd26ad.exe
3280	dc93dd26ad.exe
3280	dc93dd26ad.exe
3280	dc93dd26ad.exe
3280	dc93dd26ad.exe
3280	dc93dd26ad.exe
3280	dc93dd26ad.exe
3280	dc93dd26ad.exe
3280	dc93dd26ad.exe
3280	dc93dd26ad.exe
3280	dc93dd26ad.exe
3280	dc93dd26ad.exe
3280	dc93dd26ad.exe
3280	dc93dd26ad.exe
3280	dc93dd26ad.exe
3280	dc93dd26ad.exe
3280	dc93dd26ad.exe
3280	dc93dd26ad.exe
3280	dc93dd26ad.exe
3280	dc93dd26ad.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2024	2184	b5dc49e48cba0a871975d8e96002b60e67d7e285f7970f4dea4d88561d989aa3.exe	81
PID 2184 wrote to memory of 2024	2184	b5dc49e48cba0a871975d8e96002b60e67d7e285f7970f4dea4d88561d989aa3.exe	81
PID 2184 wrote to memory of 2024	2184	b5dc49e48cba0a871975d8e96002b60e67d7e285f7970f4dea4d88561d989aa3.exe	81
PID 2024 wrote to memory of 3280	2024	explorha.exe	83
PID 2024 wrote to memory of 3280	2024	explorha.exe	83
PID 2024 wrote to memory of 3280	2024	explorha.exe	83
PID 3280 wrote to memory of 1412	3280	dc93dd26ad.exe	84
PID 3280 wrote to memory of 1412	3280	dc93dd26ad.exe	84
PID 1412 wrote to memory of 3724	1412	chrome.exe	87
PID 1412 wrote to memory of 3724	1412	chrome.exe	87
PID 1412 wrote to memory of 1704	1412	chrome.exe	88
PID 1412 wrote to memory of 1704	1412	chrome.exe	88
PID 1412 wrote to memory of 1704	1412	chrome.exe	88
PID 1412 wrote to memory of 1704	1412	chrome.exe	88
PID 1412 wrote to memory of 1704	1412	chrome.exe	88
PID 1412 wrote to memory of 1704	1412	chrome.exe	88
PID 1412 wrote to memory of 1704	1412	chrome.exe	88
PID 1412 wrote to memory of 1704	1412	chrome.exe	88
PID 1412 wrote to memory of 1704	1412	chrome.exe	88
PID 1412 wrote to memory of 1704	1412	chrome.exe	88
PID 1412 wrote to memory of 1704	1412	chrome.exe	88
PID 1412 wrote to memory of 1704	1412	chrome.exe	88
PID 1412 wrote to memory of 1704	1412	chrome.exe	88
PID 1412 wrote to memory of 1704	1412	chrome.exe	88
PID 1412 wrote to memory of 1704	1412	chrome.exe	88
PID 1412 wrote to memory of 1704	1412	chrome.exe	88
PID 1412 wrote to memory of 1704	1412	chrome.exe	88
PID 1412 wrote to memory of 1704	1412	chrome.exe	88
PID 1412 wrote to memory of 1704	1412	chrome.exe	88
PID 1412 wrote to memory of 1704	1412	chrome.exe	88
PID 1412 wrote to memory of 1704	1412	chrome.exe	88
PID 1412 wrote to memory of 1704	1412	chrome.exe	88
PID 1412 wrote to memory of 1704	1412	chrome.exe	88
PID 1412 wrote to memory of 1704	1412	chrome.exe	88
PID 1412 wrote to memory of 1704	1412	chrome.exe	88
PID 1412 wrote to memory of 1704	1412	chrome.exe	88
PID 1412 wrote to memory of 1704	1412	chrome.exe	88
PID 1412 wrote to memory of 1704	1412	chrome.exe	88
PID 1412 wrote to memory of 1704	1412	chrome.exe	88
PID 1412 wrote to memory of 1704	1412	chrome.exe	88
PID 1412 wrote to memory of 1704	1412	chrome.exe	88
PID 1412 wrote to memory of 2980	1412	chrome.exe	89
PID 1412 wrote to memory of 2980	1412	chrome.exe	89
PID 1412 wrote to memory of 4916	1412	chrome.exe	90
PID 1412 wrote to memory of 4916	1412	chrome.exe	90
PID 1412 wrote to memory of 4916	1412	chrome.exe	90
PID 1412 wrote to memory of 4916	1412	chrome.exe	90
PID 1412 wrote to memory of 4916	1412	chrome.exe	90
PID 1412 wrote to memory of 4916	1412	chrome.exe	90
PID 1412 wrote to memory of 4916	1412	chrome.exe	90
PID 1412 wrote to memory of 4916	1412	chrome.exe	90
PID 1412 wrote to memory of 4916	1412	chrome.exe	90
PID 1412 wrote to memory of 4916	1412	chrome.exe	90
PID 1412 wrote to memory of 4916	1412	chrome.exe	90
PID 1412 wrote to memory of 4916	1412	chrome.exe	90
PID 1412 wrote to memory of 4916	1412	chrome.exe	90
PID 1412 wrote to memory of 4916	1412	chrome.exe	90
PID 1412 wrote to memory of 4916	1412	chrome.exe	90
PID 1412 wrote to memory of 4916	1412	chrome.exe	90
PID 1412 wrote to memory of 4916	1412	chrome.exe	90
PID 1412 wrote to memory of 4916	1412	chrome.exe	90
PID 1412 wrote to memory of 4916	1412	chrome.exe	90
PID 1412 wrote to memory of 4916	1412	chrome.exe	90
PID 1412 wrote to memory of 4916	1412	chrome.exe	90

C:\Users\Admin\AppData\Local\Temp\b5dc49e48cba0a871975d8e96002b60e67d7e285f7970f4dea4d88561d989aa3.exe
"C:\Users\Admin\AppData\Local\Temp\b5dc49e48cba0a871975d8e96002b60e67d7e285f7970f4dea4d88561d989aa3.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
  "C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2024
- - C:\Users\Admin\AppData\Local\Temp\1000055001\dc93dd26ad.exe
    "C:\Users\Admin\AppData\Local\Temp\1000055001\dc93dd26ad.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:3280
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
      4⤵
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:1412
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb1c4dab58,0x7ffb1c4dab68,0x7ffb1c4dab78
        5⤵
        
        PID:3724
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1652 --field-trial-handle=1860,i,3346924913895311913,11979270821385640652,131072 /prefetch:2
        5⤵
        
        PID:1704
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=1860,i,3346924913895311913,11979270821385640652,131072 /prefetch:8
        5⤵
        
        PID:2980
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2192 --field-trial-handle=1860,i,3346924913895311913,11979270821385640652,131072 /prefetch:8
        5⤵
        
        PID:4916
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3052 --field-trial-handle=1860,i,3346924913895311913,11979270821385640652,131072 /prefetch:1
        5⤵
        
        PID:2120
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3088 --field-trial-handle=1860,i,3346924913895311913,11979270821385640652,131072 /prefetch:1
        5⤵
        
        PID:4888
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4220 --field-trial-handle=1860,i,3346924913895311913,11979270821385640652,131072 /prefetch:1
        5⤵
        
        PID:3836
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4388 --field-trial-handle=1860,i,3346924913895311913,11979270821385640652,131072 /prefetch:1
        5⤵
        
        PID:1548
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4448 --field-trial-handle=1860,i,3346924913895311913,11979270821385640652,131072 /prefetch:8
        5⤵
        
        PID:1336
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4464 --field-trial-handle=1860,i,3346924913895311913,11979270821385640652,131072 /prefetch:8
        5⤵
        Modifies registry class
        
        PID:3116
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4832 --field-trial-handle=1860,i,3346924913895311913,11979270821385640652,131072 /prefetch:8
        5⤵
        
        PID:4260
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4904 --field-trial-handle=1860,i,3346924913895311913,11979270821385640652,131072 /prefetch:8
        5⤵
        
        PID:952
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5020 --field-trial-handle=1860,i,3346924913895311913,11979270821385640652,131072 /prefetch:8
        5⤵
        
        PID:2896
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5004 --field-trial-handle=1860,i,3346924913895311913,11979270821385640652,131072 /prefetch:8
        5⤵
        
        PID:2244
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4992 --field-trial-handle=1860,i,3346924913895311913,11979270821385640652,131072 /prefetch:8
        5⤵
        
        PID:3852
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5292 --field-trial-handle=1860,i,3346924913895311913,11979270821385640652,131072 /prefetch:8
        5⤵
        
        PID:404
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5264 --field-trial-handle=1860,i,3346924913895311913,11979270821385640652,131072 /prefetch:2
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3684
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
    3⤵
    - Loads dropped DLL
    PID:836
  - - C:\Windows\system32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
      4⤵
      Blocklisted process makes network request
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:4712
    - - C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        5⤵
        
        PID:4512
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\718508534211_Desktop.zip' -CompressionLevel Optimal
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3896
- - C:\Users\Admin\AppData\Local\Temp\1000056001\a6c8c66835.exe
    "C:\Users\Admin\AppData\Local\Temp\1000056001\a6c8c66835.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    PID:952
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    PID:584
- - C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
    "C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"
    3⤵
    PID:2780
- - C:\Users\Admin\AppData\Local\Temp\1000059001\amert.exe
    "C:\Users\Admin\AppData\Local\Temp\1000059001\amert.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    PID:1344

C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3432

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:4596

C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4844

C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1096
- C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe
  "C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:3640
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:868
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3640 -s 884
    3⤵
    - Program crash
    PID:2468
- C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe
  "C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:3976
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:1252
  - - C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe
      "C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe"
      4⤵
      Executes dropped EXE
      PID:1984
  - - C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe
      "C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe"
      4⤵
      Executes dropped EXE
      Modifies system certificate store
      PID:1676
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
  2⤵
  PID:2584
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
    3⤵
    PID:3028
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      PID:2648
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\718508534211_Desktop.zip' -CompressionLevel Optimal
      4⤵
      PID:948

C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3640 -ip 3640
1⤵
PID:3912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0e40f04b-c8b4-4027-bb04-14930836b514.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\0e40f04b-c8b4-4027-bb04-14930836b514.tmp
Size 16KB
SHA256 ab29e594c0c75a1f14dfa9459d1ea9854b1f3f83b4460f9e787681b10fdbcb8f
MD5 3d2eb5e4ab16eb6fdabe0ed032adc075
SHA1 c32030b59608266acdc9afe29647b0b620b1abda
SHA512 ef6657129966525f51b7626d074520cadc987c9c92a60d0d3af48faeb66ceb0eb3ee1234f7cc6befcd2eab5ab9fa107de8f5175fd1db3f5d2167e99086b4be6b
SSDEEP 384:B1NkLPLeEcXo41kXqKf/pUZNCgVLH2Hf9JsrUMFHG1Jt77:BjkLPL1Oo41kXqKf/pUZNCgVLH2Hfvsy
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 360B
SHA256 2bec5a2d9c149e06fa4889d414c0a1cd41ec68c7ab29b18b6187c11cd8e3fa0e
MD5 df45b875e15ea959535f490d4c27075e
SHA1 f92ed145c84d7fb423ef5d889664fcebf73d6215
SHA512 163239866ac7073ecc75352522ff0d6737d9856abee6266ad7d3ea9429ce82fde8eae0db15dfc8b447de2d9fec120e881b5bb400a9df392bf4109e968b7c976b
MD5 SHA1 SHA512

Submit Download

483fca36-d2ee-4bdf-ab9c-da64796bb325.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\483fca36-d2ee-4bdf-ab9c-da64796bb325.tmp
Size 524B
SHA256 695c032e1e4bf7b2196aea7744ef46fa46bb6a7724f1c55da325264525a12924
MD5 8d6fd57c2f9a60bb10950429f80fcecb
SHA1 0528ec2e58310d3a1f58304aadecf2d9a6dab665
SHA512 cf6f902ebda211fa415eeff3bc606a7c524eec242c1cb7fe01048ce7a90f970b9d2ab84d7ed43961f0399b02585f51616cba43cb3db215e4ddf8688de19c1077
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 769c6637d74bb03dce83ef6f05dc6cfdf3b3350dde120dd074aaac429696e66a
MD5 7c6ef3849f9c5c0bba9957d806ebe144
SHA1 c8dfd1a3d090e4a8d3284d4c2440c6d13219dc0f
SHA512 939411b179550c024851727d5bee13d6bd49b8ad105f21c553748175be64f2cfe9e67ed175e947b8ee9faad4379e78ef87ec9d82c45af4d99f5c596a60caedcb
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 a50e5cde4dd81573296670f9dde1cdf6365de18777aae3649cd899b921b4e220
MD5 472c55230bb136c66b1ba31bf8635323
SHA1 45c436c53ff4fed3db595cb52560ecccd6dc62ed
SHA512 5094afc48094900afcd4940bce08cc03b0408d1c1a258d840f6eb06399c97d383131f15daafb056861f2647182284cb2fc7647cb061aceeb8c455b7c1d3ed0ba
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 524B
SHA256 f31d72bc15e5cc3ab79161f6253f16a8a1ed63f3967a246e1f627d138855596e
MD5 b442f78845ba79a02202afaf6ce7001d
SHA1 05ed72782ea71f99aa5b7475b24722711d559a55
SHA512 8da9828e89b7c6160cbc71618e3fa78fd0e446c2f0062240e0b57ffd8eac94018288e610f2fbbc2d602565583804811ebe99d47bbf6d22f14419988fbf75a9b6
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 524B
SHA256 0fabb133c41c1c8c63069bb978e5bef2dcf784f4ca076b3144284ad10f30d2d6
MD5 993fb389c01cd1ba0b20ebfcdf3c5495
SHA1 1fc5d2090f33a203801c41037ee176bc1331fe26
SHA512 91a88d4dbfc9d32b27f8cb773d8a8017a23fd43dc46b6b2c14dfb812c3ac50292250c65ea1159be57804b518e109d27f3af63f1983bbb8d33a08890966154bc0
MD5 SHA1 SHA512

Submit Download

ec888319-cb9f-4fc3-b418-1c869e7238ec.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\ec888319-cb9f-4fc3-b418-1c869e7238ec.tmp
Size 7KB
SHA256 76cdd5bd0dc81460b5252ade07b103272b92a798c9340be89e6070acf63d71e3
MD5 98a344dc2921f5178416cd32a58b2bee
SHA1 ac0647cca0fbc3bfeaa9d3ed8aea35c451021965
SHA512 af8ce2e5a1d19ac3bd6f2b432bd00d703820fbe99aa6a01f1321980de87597642dc6acbc5b6c6c1ac587e9f4d8c61c53ee212beb222e886d30169165aec3fcd3
SSDEEP 192:yFXd83LhqcaJbZ8Hyh+FlIkut8iP5tjEsXtScR:yFXdihqV+yquk48etIsXtScR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 128KB
SHA256 8a041526cdfc02cab65c562c6542d426433c264ff76264c565df83c99471a573
MD5 da67c6740335fce1eb9661baa7ac6c3e
SHA1 b5e0dde5a68d5827977983f129c7078fa82250bd
SHA512 e581c1586cef72facd096f5a1072530dad6d186e0b12fc5c7b35768f92c20d7a64be13bcf36ffeb9182ba53044577cee65a090a68d1ed73d7febef80ff7e4416
SSDEEP 3072:Lix3mgzxLR8t35zIV4nZqBixhjVtEWC1Yr3MaK2EWE07mOr:Li78RbxBVtEPY4aI1Or
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 254KB
SHA256 1299201f2e447334a75678bcb8e73a2e1fcc8aa5a5552049655c0b16338e46c1
MD5 a57b6b67f6b929efbbc45e542de8921a
SHA1 09e49035a4a49e51468dd7d4df9d16f2b0e2b411
SHA512 55b9d1e57503d662dddbd0db4a9f90e28125e30ab5d1071f073086f33b07256d64f0703de4801499c95836e208c79060e6ec12a75aec249d5980fbfeb170a114
SSDEEP 6144:1UTYLW30xFT+LOH5HIkNe+u78RbxBVtEPY4aI1OT:tW3GRI0Nu78fBfpAOT
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 274KB
SHA256 136495292d9d2b60ea1d276b51de843ebf7c191a2aadddb0f4827c9fb0938a6f
MD5 eb52c229d48a305434443aeaf18c1c19
SHA1 6cdb67ee45cfb67a030b3e9aaccffdcf6af73b07
SHA512 c08e2fa8e4f0d0d6030d8d883bda69f8a5f88d8ece8d9659ed76babf949824b623c61575ddb0aee61575e47e807a18f9f9134ff1d4820d5fdf05fdb350cbbe5c
SSDEEP 6144:iKofFslTYLW30xFT+LOH5HIkNe+u78RbxBVtEPY4aI1OT:8JW3GRI0Nu78fBfpAOT
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 254KB
SHA256 43970aef69505780bcee48f22b64a9a3a21465024adbaeb61c03c9473cd3c774
MD5 f42e50072f4764fde73e3498fd6cd5be
SHA1 bea75d552a006b3cc87154a05280f4c022ee6951
SHA512 a6c646216ccc6dd84a8ee552a0c44650e8ad1201bcffed350783ebdb22614173415eafdbe64fa91627fad83dffd0179eba22ac69a44012867e10a8192a3fd1ef
SSDEEP 6144:CKTYLW30xFT+LOH5HIkNe+u78RbxBVtEPY4aI1OT:CxW3GRI0Nu78fBfpAOT
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Size 89KB
SHA256 c74f38c395ffb78c17116775e91c3108a5c76b5d5668f394e9eef3a62acd6fe1
MD5 ae73fa3cc0295c6197b19f3b3f97289b
SHA1 6fd128bde43c6097b6ad1c6a170dd204a1bb7b4a
SHA512 7cf02c80c997ca0489e35c4631e561a7667757c39c2e38c4e2c3044ceab64a86c5803e20f6771580301a6d350c55a817ecc7de7a284b5fe2a0125257b3517a99
SSDEEP 384:TGR+xEQ8Ow4l5NmsADTf9AB0nJ0760uz8IvEo73EkI8IGWMOoLpNAhL3ToXNCdTj:LiQ50//cEpevRqbQKq17
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache~RFe57f78f.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe57f78f.TMP
Size 86KB
SHA256 f87eaf2b8a6bfeabf9dc96cc2ad08a6e065e1f862684fcaec0f4d2387a81831d
MD5 4041710b9e5ae5952391c6bedcbb1b71
SHA1 cb7ab11e292f473b1defae40288639792bbcd28b
SHA512 adb4b171af4559e12624b6c4e5e11ba8eb8ca7e2a470d902cae4028ef58c9a9d7d7da30b6412581af971325aa8cb025c6542c2e25c886ee0eaa5f166a87799c1
SSDEEP 384:0aGR+xEQ8Ow4l5NmsADTf9AB0nJ0760uz8kEo73EkI8IGWMOoLpNfL3ToXNCdTzC:0uiQ50//EEoevRqbQKq12
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 52cc3f3028fab0d347a4a3fffef570b42f85748176d81a3344996d42fd1de32a
MD5 ae626d9a72417b14570daa8fcd5d34a4
SHA1 c103ebaf4d760df722d620df87e6f07c0486439f
SHA512 a0690bda318bdf43d6f292f88d4ea2ebeec83b95e9ebca80083dbb08e7ddcdb9735cc58b89d369a34f10acf8a114d4a207ed8d0f070c5baf87c5798e9f35bc14
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 5ec78d385402d5f2a7c1ac938e4c04de905d8dee859a9a6ea06090baa0a18aa4
MD5 03ac48d2210562c20ae8435a45e1898e
SHA1 92d2d25fb92fdd67ed3f7b186844082337b34ba4
SHA512 bbaab33901d7b36022a76e3c27195d71bd20dbb238355156a79404ca9bd6556a03c8c1f1557ede4811e48a7c547b243c1b82be534fb6ab9e30bb08af36f5730e
MD5 SHA1 SHA512

Submit Download

explorha.exe

Path C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
Size 3.1MB
SHA256 b5dc49e48cba0a871975d8e96002b60e67d7e285f7970f4dea4d88561d989aa3
MD5 feb8c44cbf9e01446a4a0f585a094905
SHA1 bc71574d5fdd3a4569a90b925a4ac369383cbbd9
SHA512 b0ff33213357ed05da21b3fa5eb5299a6558c87db87bc426f2f09db6e65243a4233f398d86dcf09729e1cdfc349b9f0f77e13c21747655d7f1cb4aa65e760767
SSDEEP 49152:XTFNFCgG89obVRvORIStgLLBr10Z/leIn1nLDRONgivzZq8dEz:XJXCgSJRvOOStgLLBp0Z0In1nPclbEM
MD5 SHA1 SHA512 SSDEEP

Submit Download

dc93dd26ad.exe

Path C:\Users\Admin\AppData\Local\Temp\1000055001\dc93dd26ad.exe
Size 1.1MB
SHA256 92d2daf07e82edd83e505638858c7a468b18a37dc9b432e5ec03f2fcef61a7e9
MD5 670235fb7b37d4e3779ca165d6b22075
SHA1 1e19f711bf1fa5c86099b38446608c9828e97bcd
SHA512 042e6342b474c62822e815b8a3c080fa80e71584ffe38a1450c26040e29223dd62d121efaafa747350123e8aebec8052004f980e4832e103af94e11e70aa373f
SSDEEP 24576:LqDEvCTbMWu7rQYlBQcBiT6rprG8aug2+b+HdiJUX:LTvC/MTQYxsWR7aug2+b+HoJU
MD5 SHA1 SHA512 SSDEEP

Submit Download

a6c8c66835.exe

Path C:\Users\Admin\AppData\Local\Temp\1000056001\a6c8c66835.exe
Size 2.3MB
SHA256 87c4920c0756c735ebb7dd88ae4ef8ae7a394702d9d5289da19de168ba851cbd
MD5 36d19f9c30601c31babbd85a5bd70623
SHA1 651e431aeaa63c63235d5f6fd1fe4e800c626536
SHA512 a9427e7e71a6103635358ce3aaa5dd632c636d9d717eec27723886241c6b5e276eed02749e0fdbe62981e088b75dd1fc61881b8b6d89384957b76ff97d838045
SSDEEP 49152:6u5nhf8IKN3alYEEed87auhsVfY8hzSqkVn2oCHtchpJO:9vsqGEL87aPJz7kVvpJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

amert.exe

Path C:\Users\Admin\AppData\Local\Temp\1000059001\amert.exe
Size 1.8MB
SHA256 1609f52b8c157735048cf19be722172aceffad5d336e249d92eca8518a11e280
MD5 8e65dfc026f983f04d33976e97137e0f
SHA1 d12a4e7fd6393e822b04ec4d278047d7b1e6cc24
SHA512 f0606c18849a3dbd22e3791ed81c6c890f3673d3320df2a7c296e759db900e68aafe820c1de8e3ae310aeeed6768814a0de02a2e5207744e79b49fbd5052e3ec
SSDEEP 49152:DFa5gm5GvNjUbvtoD1rqb+AlC0pa5vrYyCRt:xlm8etKrlRWRt
MD5 SHA1 SHA512 SSDEEP

Submit Download

swiiiii.exe

Path C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe
Size 321KB
SHA256 e9e09c5e5d03d21fca820bd9b0a0ea7b86ab9e85cdc9996f8f1dc822b0cc801c
MD5 1c7d0f34bb1d85b5d2c01367cc8f62ef
SHA1 33aedadb5361f1646cffd68791d72ba5f1424114
SHA512 53bf85d2b004f69bbbf7b6dc78e5f021aba71b6f814101c55d3bf76e6d058a973bc58270b6b621b2100c6e02d382f568d1e96024464e8ea81e6db8ccd948679d
SSDEEP 6144:DFZcMaQk5oqtag00+wX3bSJxuI2Hc8PlsLNuPhRF1Ym:DFZg5Ztj00+03mJxmc8PfPwm
MD5 SHA1 SHA512 SSDEEP

Submit Download

alexxxxxxxx.exe

Path C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe
Size 1.7MB
SHA256 3a2006bc835a8ffe91b9ee9206f630b3172f42e090f4e8d90be620e540f5ef6b
MD5 85a15f080b09acace350ab30460c8996
SHA1 3fc515e60e4cfa5b3321f04a96c7fb463e4b9d02
SHA512 ade5e3531dfa1a01e6c2a69deb2962cbf619e766da3d6e8e3453f70ff55ccbcbe21381c7b97a53d67e1ca88975f4409b1a42a759e18f806171d29e4c3f250e9f
SSDEEP 49152:L/eYUVc8uWw3Sg6s8Zep6UXIEgf7WD4GTF:L/eYUW8bwUaPXVgzWMG
MD5 SHA1 SHA512 SSDEEP

Submit Download

718508534211_Desktop.zip

Path C:\Users\Admin\AppData\Local\Temp\718508534211_Desktop.zip
Size 137KB
SHA256 b0774f4a9bcd0ceec507b4e7fffab78f0f410f264264d26b2f73c5a3d128f945
MD5 2dc409217886231ff141dfb2d91e383f
SHA1 17e05ec5a76905c991415ee539c5a8fc4c07a04c
SHA512 c15352611d6f8250503e0a20f9ae8fe1db2d233266d07ce2690a8a62e56fe43f0d44f2eaf2b54d6b43a99cc0a23e1b2f7eabc0ff41e1070461fe27524c746621
SSDEEP 3072:w+CAPCjevtxUZc4ickOU1RAr5Ms+TR0v7hwKLmCY:J6awcHpkr5Ms+uG/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tmp745B.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp745B.tmp
Size 2KB
SHA256 f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
MD5 1420d30f964eac2c85b2ccfe968eebce
SHA1 bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA512 6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8
MD5 SHA1 SHA512

Submit Download

AddGrant.txt

Path C:\Users\Admin\AppData\Local\Temp\_Files_\AddGrant.txt
Size 137KB
SHA256 400a005645b48f981d20086aaeec1bd8da817c189f321efdfa88d4cb17eb5257
MD5 26966f67c588561ee123ceb4839232ac
SHA1 6b5a442f624f9848312915f6704979abe867df05
SHA512 a05b85f00f7f4c702d2672986855d2987eb238cb3b6ae907d88040aeb52d273127240f96ac6d369d1ba1b14c81a301387434ab188bafa7a664c7ab7c33291498
SSDEEP 3072:o+CAPCbevtpUpc4icGOU1nArHMs+TR0v1hwKL9CY:B6CecHFurHMs+Gdz
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_adpd0rfc.oor.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_adpd0rfc.oor.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

clip64.dll

Path C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Size 109KB
SHA256 12fef2d5995d671ec0e91bdbdc91e2b0d3c90ed3a8b2b13ddaa8ad64727dcd46
MD5 726cd06231883a159ec1ce28dd538699
SHA1 404897e6a133d255ad5a9c26ac6414d7134285a2
SHA512 9ea82e7cb6c6a58446bd5033855947c3e2d475d2910f2b941235e0b96aa08eec822d2dd17cc86b2d3fce930f78b799291992408e309a6c63e3011266810ea83e
SSDEEP 3072:Q3uSD+ZwruS0bGcuZRt2sSZV/Q3IegRQod4l:AuTiabHuZRAFtlD4l
MD5 SHA1 SHA512 SSDEEP

Submit Download

cred64.dll

Path C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
Size 1.2MB
SHA256 3c97bb410e49b11af8116feb7240b7101e1967cae7538418c45c3d2e072e8103
MD5 15a42d3e4579da615a384c717ab2109b
SHA1 22aeedeb2307b1370cdab70d6a6b6d2c13ad2301
SHA512 1eb7f126dccc88a2479e3818c36120f5af3caa0d632b9ea803485ee6531d6e2a1fd0805b1c4364983d280df23ea5ca3ad4a5fca558ac436efae36af9b795c444
SSDEEP 24576:IvkQL6YY4wMPSYZofkf0Gh6Pi41+a9uyP5dggky+yC7:IsMPSYcS5wPi095Pbg9y
MD5 SHA1 SHA512 SSDEEP

Submit Download

cred64.dll

Path C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll
Size 1.2MB
SHA256 83e3df5bec15d5333935bea8b719a6d677e2fb3dc1cf9e18e7b82fd0438285c7
MD5 f35b671fda2603ec30ace10946f11a90
SHA1 059ad6b06559d4db581b1879e709f32f80850872
SHA512 b5fa27d08c64727cef7fdda5e68054a4359cd697df50d70d1d90da583195959a139066a6214531bbc5f20cd4f9bc1ca3e4244396547381291a6a1d2df9cf8705
SSDEEP 24576:2vkQL6YY4wMPSYZofkf0Gh6Pi41+a9uyP5dggv4+yC7:2sMPSYcS5wPi095PbgS4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Traffic.exe

Path C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe
Size 541KB
SHA256 f38c27ecbeed9721f0885d3b2f2f767d60a5d1c0a5c98433357f570987da3e50
MD5 1fc4b9014855e9238a361046cfbf6d66
SHA1 c17f18c8246026c9979ab595392a14fe65cc5e9f
SHA512 2af234cac24ec4a508693d9affa7f759d4b29bb3c9ddffd9e6350959fd4da26501553399d2b02a8eeae8dace6bfe9b2ce50462ce3c6547497f5b0ea6ed226b12
SSDEEP 12288:TAaw1dGg1Bz5TvcN3CNIb88WsNMP5F1k:TOzNW3CNIb88WsNMhF
MD5 SHA1 SHA512 SSDEEP

Submit Download

propro.exe

Path C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe
Size 304KB
SHA256 bd73ee49a23901f9fb235f8a5b29adc72cc637ad4b62a9760c306900cb1678b7
MD5 cc90e3326d7b20a33f8037b9aab238e4
SHA1 236d173a6ac462d85de4e866439634db3b9eeba3
SHA512 b5d197a05a267bf66509b6d976924cd6f5963532a9f9f22d1763701d4fba3dfa971e0058388249409884bc29216fb33a51846562a5650f81d99ce14554861521
SSDEEP 3072:nq6EgY6iwrUjL849wPzoGrjLSTAytAS3alcZqf7D34teqiOLibBO7:qqY6i/wPHfLSTAuAzlcZqf7DIXL
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/868-423-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/868-426-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/952-213-0x0000000004D20000-0x0000000004D21000-memory.dmp

Download

memory/952-317-0x0000000000140000-0x0000000000733000-memory.dmp

Download

memory/952-547-0x0000000000140000-0x0000000000733000-memory.dmp

Download

memory/952-211-0x0000000004D30000-0x0000000004D31000-memory.dmp

Download

memory/952-214-0x0000000004D10000-0x0000000004D11000-memory.dmp

Download

memory/952-435-0x0000000000140000-0x0000000000733000-memory.dmp

Download

memory/952-215-0x0000000004D70000-0x0000000004D71000-memory.dmp

Download

memory/952-394-0x0000000000140000-0x0000000000733000-memory.dmp

Download

memory/952-370-0x0000000000140000-0x0000000000733000-memory.dmp

Download

memory/952-368-0x0000000000140000-0x0000000000733000-memory.dmp

Download

memory/952-357-0x0000000000140000-0x0000000000733000-memory.dmp

Download

memory/952-216-0x0000000004D90000-0x0000000004D91000-memory.dmp

Download

memory/952-217-0x0000000004DC0000-0x0000000004DC1000-memory.dmp

Download

memory/952-218-0x0000000004D50000-0x0000000004D51000-memory.dmp

Download

memory/952-219-0x0000000004DB0000-0x0000000004DB1000-memory.dmp

Download

memory/952-212-0x0000000004DA0000-0x0000000004DA1000-memory.dmp

Download

memory/952-283-0x0000000000140000-0x0000000000733000-memory.dmp

Download

memory/952-275-0x0000000000140000-0x0000000000733000-memory.dmp

Download

memory/952-260-0x0000000000140000-0x0000000000733000-memory.dmp

Download

memory/952-259-0x0000000000140000-0x0000000000733000-memory.dmp

Download

memory/952-239-0x0000000000140000-0x0000000000733000-memory.dmp

Download

memory/952-221-0x0000000004DE0000-0x0000000004DE2000-memory.dmp

Download

memory/952-210-0x0000000004D60000-0x0000000004D61000-memory.dmp

Download

memory/952-209-0x0000000000140000-0x0000000000733000-memory.dmp

Download

memory/952-220-0x0000000004D00000-0x0000000004D01000-memory.dmp

Download

memory/1096-433-0x00000000009A0000-0x0000000000E71000-memory.dmp

Download

memory/1096-446-0x00000000009A0000-0x0000000000E71000-memory.dmp

Download

memory/1252-471-0x0000000000400000-0x0000000000592000-memory.dmp

Download

memory/1344-333-0x0000000000AC0000-0x0000000000F91000-memory.dmp

Download

memory/1344-334-0x0000000000AC0000-0x0000000000F91000-memory.dmp

Download

memory/1344-335-0x0000000005570000-0x0000000005571000-memory.dmp

Download

memory/1344-346-0x0000000000AC0000-0x0000000000F91000-memory.dmp

Download

memory/2024-26-0x0000000004D80000-0x0000000004D81000-memory.dmp

Download

memory/2024-432-0x0000000000930000-0x0000000000C45000-memory.dmp

Download

memory/2024-22-0x0000000000930000-0x0000000000C45000-memory.dmp

Download

memory/2024-190-0x0000000000930000-0x0000000000C45000-memory.dmp

Download

memory/2024-226-0x0000000000930000-0x0000000000C45000-memory.dmp

Download

memory/2024-31-0x0000000004DA0000-0x0000000004DA1000-memory.dmp

Download

memory/2024-371-0x0000000000930000-0x0000000000C45000-memory.dmp

Download

memory/2024-30-0x0000000004DB0000-0x0000000004DB1000-memory.dmp

Download

memory/2024-23-0x0000000000930000-0x0000000000C45000-memory.dmp

Download

memory/2024-258-0x0000000000930000-0x0000000000C45000-memory.dmp

Download

memory/2024-369-0x0000000000930000-0x0000000000C45000-memory.dmp

Download

memory/2024-117-0x0000000000930000-0x0000000000C45000-memory.dmp

Download

memory/2024-261-0x0000000000930000-0x0000000000C45000-memory.dmp

Download

memory/2024-121-0x0000000000930000-0x0000000000C45000-memory.dmp

Download

memory/2024-358-0x0000000000930000-0x0000000000C45000-memory.dmp

Download

memory/2024-356-0x0000000000930000-0x0000000000C45000-memory.dmp

Download

memory/2024-29-0x0000000004D60000-0x0000000004D61000-memory.dmp

Download

memory/2024-143-0x0000000000930000-0x0000000000C45000-memory.dmp

Download

memory/2024-28-0x0000000004D30000-0x0000000004D31000-memory.dmp

Download

memory/2024-116-0x0000000000930000-0x0000000000C45000-memory.dmp

Download

memory/2024-27-0x0000000004D20000-0x0000000004D21000-memory.dmp

Download

memory/2024-307-0x0000000000930000-0x0000000000C45000-memory.dmp

Download

memory/2024-445-0x0000000000930000-0x0000000000C45000-memory.dmp

Download

memory/2024-25-0x0000000004D40000-0x0000000004D41000-memory.dmp

Download

memory/2024-282-0x0000000000930000-0x0000000000C45000-memory.dmp

Download

memory/2024-24-0x0000000004D50000-0x0000000004D51000-memory.dmp

Download

memory/2184-7-0x0000000004990000-0x0000000004991000-memory.dmp

Download

memory/2184-2-0x0000000000C60000-0x0000000000F75000-memory.dmp

Download

memory/2184-20-0x0000000000C60000-0x0000000000F75000-memory.dmp

Download

memory/2184-3-0x00000000049B0000-0x00000000049B1000-memory.dmp

Download

memory/2184-1-0x0000000077A96000-0x0000000077A98000-memory.dmp

Download

memory/2184-5-0x00000000049E0000-0x00000000049E1000-memory.dmp

Download

memory/2184-6-0x0000000004980000-0x0000000004981000-memory.dmp

Download

memory/2184-0-0x0000000000C60000-0x0000000000F75000-memory.dmp

Download

memory/2184-8-0x0000000004A00000-0x0000000004A01000-memory.dmp

Download

memory/2184-9-0x00000000049F0000-0x00000000049F1000-memory.dmp

Download

memory/2184-4-0x00000000049A0000-0x00000000049A1000-memory.dmp

Download

memory/3432-38-0x0000000004BE0000-0x0000000004BE1000-memory.dmp

Download

memory/3432-39-0x0000000004BF0000-0x0000000004BF1000-memory.dmp

Download

memory/3432-36-0x0000000004C00000-0x0000000004C01000-memory.dmp

Download

memory/3432-35-0x0000000004C10000-0x0000000004C11000-memory.dmp

Download

memory/3432-41-0x0000000000930000-0x0000000000C45000-memory.dmp

Download

memory/3432-40-0x0000000004C20000-0x0000000004C21000-memory.dmp

Download

memory/3432-37-0x0000000004C40000-0x0000000004C41000-memory.dmp

Download

memory/3432-34-0x0000000000930000-0x0000000000C45000-memory.dmp

Download

memory/3432-33-0x0000000000930000-0x0000000000C45000-memory.dmp

Download

memory/3896-175-0x0000015FD6490000-0x0000015FD64A0000-memory.dmp

Download

memory/3896-164-0x0000015FD6440000-0x0000015FD6462000-memory.dmp

Download

memory/3896-173-0x00007FFB18E30000-0x00007FFB198F2000-memory.dmp

Download

memory/3896-174-0x0000015FD6490000-0x0000015FD64A0000-memory.dmp

Download

memory/3896-176-0x0000015FD6490000-0x0000015FD64A0000-memory.dmp

Download

memory/3896-178-0x0000015FD6480000-0x0000015FD648A000-memory.dmp

Download

memory/3896-177-0x0000015FD66A0000-0x0000015FD66B2000-memory.dmp

Download

memory/3896-183-0x00007FFB18E30000-0x00007FFB198F2000-memory.dmp

Download

memory/4240-393-0x0000000000930000-0x0000000000C45000-memory.dmp

Download

memory/4844-266-0x0000000005280000-0x0000000005281000-memory.dmp

Download

memory/4844-265-0x0000000005270000-0x0000000005271000-memory.dmp

Download

memory/4844-267-0x0000000005260000-0x0000000005261000-memory.dmp

Download

memory/4844-268-0x00000000052A0000-0x00000000052A1000-memory.dmp

Download

memory/4844-269-0x0000000005240000-0x0000000005241000-memory.dmp

Download

memory/4844-270-0x0000000005250000-0x0000000005251000-memory.dmp

Download

memory/4844-271-0x0000000005290000-0x0000000005291000-memory.dmp

Download

memory/4844-264-0x0000000000930000-0x0000000000C45000-memory.dmp

Download

memory/4844-263-0x0000000000930000-0x0000000000C45000-memory.dmp

Download

memory/4844-272-0x0000000000930000-0x0000000000C45000-memory.dmp

Download