amadey | aafec3c88c342370a233018452ada22295bfb65f6856db0223e163bbfb5afcfc

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
21-04-2024 20:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aafec3c88c342370a233018452ada22295bfb65f6856db0223e163bbfb5afcfc.exe
Size

3.0MB
MD5

19833d849cf5e16a70cbd96e899eddfe
SHA1

b06486c8479a0d385d09d1e8d6ffa0e68001d4dc
SHA256

aafec3c88c342370a233018452ada22295bfb65f6856db0223e163bbfb5afcfc
SHA512

928ca5b7d925517d80a7553549715bb5aad59660a64b98330be2b8539fdf849b7ab6e9c6c9af67f5a38e727b7a99370da8053784aeecfbe08515ab13a50dbe64
SSDEEP

49152:ubKRn9WoaaexCmE2kAzkj9hrJbPNYO9dBu8lfda:ubK90HaexCmE2QjXJJYO9dplfda

Score

10^/10

amadey risepro evasion persistence spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.18

http://193.233.132.56

Attributes

install_dir
09fd851a4f
install_file
explorha.exe
strings_key
443351145ece4966ded809641c77cfa8
url_paths
/Pneh2sXQk0/index.php

rc4.plain

Extracted

Family

amadey

Version

4.17

http://193.233.132.167

Attributes

install_dir
4d0ab15804
install_file
chrosha.exe
strings_key
1a9519d7b465e1f4880fa09a6162d768
url_paths
/enigma/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

cf7da7e78d.exeamert.exechrosha.exeexplorha.exeexplorha.exeaafec3c88c342370a233018452ada22295bfb65f6856db0223e163bbfb5afcfc.exeexplorha.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	cf7da7e78d.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	amert.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	chrosha.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorha.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorha.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	aafec3c88c342370a233018452ada22295bfb65f6856db0223e163bbfb5afcfc.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorha.exe

Blocklisted process makes network request 4 IoCs

Processes:

rundll32.exerundll32.exerundll32.exerundll32.exe

flow pid process

23 4512 rundll32.exe
26 5020 rundll32.exe
28 2208 rundll32.exe
29 3012 rundll32.exe
Downloads MZ/PE file

flow	pid	process
23	4512	rundll32.exe
26	5020	rundll32.exe
28	2208	rundll32.exe
29	3012	rundll32.exe

Checks BIOS information in registry 2 TTPs 14 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

explorha.execf7da7e78d.exechrosha.exeexplorha.exeaafec3c88c342370a233018452ada22295bfb65f6856db0223e163bbfb5afcfc.exeexplorha.exeamert.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	cf7da7e78d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	chrosha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	aafec3c88c342370a233018452ada22295bfb65f6856db0223e163bbfb5afcfc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	cf7da7e78d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	aafec3c88c342370a233018452ada22295bfb65f6856db0223e163bbfb5afcfc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	amert.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	amert.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	chrosha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorha.exe

Executes dropped EXE 7 IoCs

Processes:

explorha.exeeb9af177b9.execf7da7e78d.exeamert.exechrosha.exeexplorha.exeexplorha.exe

pid process

1388 explorha.exe
1648 eb9af177b9.exe
2776 cf7da7e78d.exe
1920 amert.exe
4608 chrosha.exe
3412 explorha.exe
1552 explorha.exe

pid	process
1388	explorha.exe
1648	eb9af177b9.exe
2776	cf7da7e78d.exe
1920	amert.exe
4608	chrosha.exe
3412	explorha.exe
1552	explorha.exe

Identifies Wine through registry keys 2 TTPs 7 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

amert.exechrosha.exeexplorha.exeexplorha.exeaafec3c88c342370a233018452ada22295bfb65f6856db0223e163bbfb5afcfc.exeexplorha.execf7da7e78d.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3263309122-2820180308-3568046652-1000\Software\Wine	amert.exe
Key opened	\REGISTRY\USER\S-1-5-21-3263309122-2820180308-3568046652-1000\Software\Wine	chrosha.exe
Key opened	\REGISTRY\USER\S-1-5-21-3263309122-2820180308-3568046652-1000\Software\Wine	explorha.exe
Key opened	\REGISTRY\USER\S-1-5-21-3263309122-2820180308-3568046652-1000\Software\Wine	explorha.exe
Key opened	\REGISTRY\USER\S-1-5-21-3263309122-2820180308-3568046652-1000\Software\Wine	aafec3c88c342370a233018452ada22295bfb65f6856db0223e163bbfb5afcfc.exe
Key opened	\REGISTRY\USER\S-1-5-21-3263309122-2820180308-3568046652-1000\Software\Wine	explorha.exe
Key opened	\REGISTRY\USER\S-1-5-21-3263309122-2820180308-3568046652-1000\Software\Wine	cf7da7e78d.exe

Loads dropped DLL 6 IoCs

Processes:

rundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exe

pid process

4676 rundll32.exe
4512 rundll32.exe
5020 rundll32.exe
1928 rundll32.exe
2208 rundll32.exe
3012 rundll32.exe
Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
4676	rundll32.exe
4512	rundll32.exe
5020	rundll32.exe
1928	rundll32.exe
2208	rundll32.exe
3012	rundll32.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explorha.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3263309122-2820180308-3568046652-1000\Software\Microsoft\Windows\CurrentVersion\Run\eb9af177b9.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000055001\\eb9af177b9.exe"	explorha.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3263309122-2820180308-3568046652-1000\Software\Microsoft\Windows\CurrentVersion\Run\cf7da7e78d.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000056001\\cf7da7e78d.exe"	explorha.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\1000055001\eb9af177b9.exe	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs

Processes:

aafec3c88c342370a233018452ada22295bfb65f6856db0223e163bbfb5afcfc.exeexplorha.execf7da7e78d.exeamert.exechrosha.exeexplorha.exeexplorha.exe

pid	process
2060	aafec3c88c342370a233018452ada22295bfb65f6856db0223e163bbfb5afcfc.exe
1388	explorha.exe
2776	cf7da7e78d.exe
1920	amert.exe
4608	chrosha.exe
3412	explorha.exe
1552	explorha.exe

Drops file in Windows directory 2 IoCs

Processes:

aafec3c88c342370a233018452ada22295bfb65f6856db0223e163bbfb5afcfc.exeamert.exe

description	ioc	process
File created	C:\Windows\Tasks\explorha.job	aafec3c88c342370a233018452ada22295bfb65f6856db0223e163bbfb5afcfc.exe
File created	C:\Windows\Tasks\chrosha.job	amert.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133582061185534140"	chrome.exe

Modifies registry class 1 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3263309122-2820180308-3568046652-1000\{A04E9A0C-2595-4D0E-9B81-27B5113A17C0}	chrome.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

Processes:

aafec3c88c342370a233018452ada22295bfb65f6856db0223e163bbfb5afcfc.exeexplorha.exechrome.execf7da7e78d.exerundll32.exepowershell.exeamert.exechrosha.exeexplorha.exerundll32.exepowershell.exeexplorha.exechrome.exe

pid	process
2060	aafec3c88c342370a233018452ada22295bfb65f6856db0223e163bbfb5afcfc.exe
2060	aafec3c88c342370a233018452ada22295bfb65f6856db0223e163bbfb5afcfc.exe
1388	explorha.exe
1388	explorha.exe
4948	chrome.exe
4948	chrome.exe
2776	cf7da7e78d.exe
2776	cf7da7e78d.exe
4512	rundll32.exe
4512	rundll32.exe
4512	rundll32.exe
4512	rundll32.exe
4512	rundll32.exe
4512	rundll32.exe
4512	rundll32.exe
4512	rundll32.exe
4512	rundll32.exe
4512	rundll32.exe
4560	powershell.exe
4560	powershell.exe
4560	powershell.exe
1920	amert.exe
1920	amert.exe
4608	chrosha.exe
4608	chrosha.exe
3412	explorha.exe
3412	explorha.exe
2208	rundll32.exe
2208	rundll32.exe
2208	rundll32.exe
2208	rundll32.exe
2208	rundll32.exe
2208	rundll32.exe
2208	rundll32.exe
2208	rundll32.exe
2208	rundll32.exe
2208	rundll32.exe
1172	powershell.exe
1172	powershell.exe
1172	powershell.exe
1552	explorha.exe
1552	explorha.exe
1092	chrome.exe
1092	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

Processes:

chrome.exe

pid process

4948 chrome.exe
4948 chrome.exe
4948 chrome.exe
4948 chrome.exe

pid	process
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exepowershell.exe

description	pid	process
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeDebugPrivilege	4560	powershell.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe
Token: SeCreatePagefilePrivilege	4948	chrome.exe
Token: SeShutdownPrivilege	4948	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

aafec3c88c342370a233018452ada22295bfb65f6856db0223e163bbfb5afcfc.exeeb9af177b9.exechrome.exe

pid	process
2060	aafec3c88c342370a233018452ada22295bfb65f6856db0223e163bbfb5afcfc.exe
1648	eb9af177b9.exe
1648	eb9af177b9.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
1648	eb9af177b9.exe
1648	eb9af177b9.exe
4948	chrome.exe
1648	eb9af177b9.exe
1648	eb9af177b9.exe
1648	eb9af177b9.exe
1648	eb9af177b9.exe
1648	eb9af177b9.exe
1648	eb9af177b9.exe
1648	eb9af177b9.exe
1648	eb9af177b9.exe
1648	eb9af177b9.exe
1648	eb9af177b9.exe
1648	eb9af177b9.exe
1648	eb9af177b9.exe
1648	eb9af177b9.exe
1648	eb9af177b9.exe
1648	eb9af177b9.exe
1648	eb9af177b9.exe
1648	eb9af177b9.exe
1648	eb9af177b9.exe
1648	eb9af177b9.exe
1648	eb9af177b9.exe
1648	eb9af177b9.exe
1648	eb9af177b9.exe
1648	eb9af177b9.exe
1648	eb9af177b9.exe
1648	eb9af177b9.exe
1648	eb9af177b9.exe
1648	eb9af177b9.exe
1648	eb9af177b9.exe
1648	eb9af177b9.exe
1648	eb9af177b9.exe
1648	eb9af177b9.exe
1648	eb9af177b9.exe

Suspicious use of SendNotifyMessage 48 IoCs

Processes:

eb9af177b9.exechrome.exe

pid	process
1648	eb9af177b9.exe
1648	eb9af177b9.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
4948	chrome.exe
1648	eb9af177b9.exe
1648	eb9af177b9.exe
1648	eb9af177b9.exe
1648	eb9af177b9.exe
1648	eb9af177b9.exe
1648	eb9af177b9.exe
1648	eb9af177b9.exe
1648	eb9af177b9.exe
1648	eb9af177b9.exe
1648	eb9af177b9.exe
1648	eb9af177b9.exe
1648	eb9af177b9.exe
1648	eb9af177b9.exe
1648	eb9af177b9.exe
1648	eb9af177b9.exe
1648	eb9af177b9.exe
1648	eb9af177b9.exe
1648	eb9af177b9.exe
1648	eb9af177b9.exe
1648	eb9af177b9.exe
1648	eb9af177b9.exe
1648	eb9af177b9.exe
1648	eb9af177b9.exe
1648	eb9af177b9.exe
1648	eb9af177b9.exe
1648	eb9af177b9.exe
1648	eb9af177b9.exe
1648	eb9af177b9.exe
1648	eb9af177b9.exe
1648	eb9af177b9.exe
1648	eb9af177b9.exe
1648	eb9af177b9.exe
1648	eb9af177b9.exe
1648	eb9af177b9.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

aafec3c88c342370a233018452ada22295bfb65f6856db0223e163bbfb5afcfc.exeexplorha.exeeb9af177b9.exechrome.exe

description	pid	process	target process
PID 2060 wrote to memory of 1388	2060	aafec3c88c342370a233018452ada22295bfb65f6856db0223e163bbfb5afcfc.exe	explorha.exe
PID 2060 wrote to memory of 1388	2060	aafec3c88c342370a233018452ada22295bfb65f6856db0223e163bbfb5afcfc.exe	explorha.exe
PID 2060 wrote to memory of 1388	2060	aafec3c88c342370a233018452ada22295bfb65f6856db0223e163bbfb5afcfc.exe	explorha.exe
PID 1388 wrote to memory of 1648	1388	explorha.exe	eb9af177b9.exe
PID 1388 wrote to memory of 1648	1388	explorha.exe	eb9af177b9.exe
PID 1388 wrote to memory of 1648	1388	explorha.exe	eb9af177b9.exe
PID 1648 wrote to memory of 4948	1648	eb9af177b9.exe	chrome.exe
PID 1648 wrote to memory of 4948	1648	eb9af177b9.exe	chrome.exe
PID 4948 wrote to memory of 1752	4948	chrome.exe	chrome.exe
PID 4948 wrote to memory of 1752	4948	chrome.exe	chrome.exe
PID 4948 wrote to memory of 2008	4948	chrome.exe	chrome.exe
PID 4948 wrote to memory of 2008	4948	chrome.exe	chrome.exe
PID 4948 wrote to memory of 2008	4948	chrome.exe	chrome.exe
PID 4948 wrote to memory of 2008	4948	chrome.exe	chrome.exe
PID 4948 wrote to memory of 2008	4948	chrome.exe	chrome.exe
PID 4948 wrote to memory of 2008	4948	chrome.exe	chrome.exe
PID 4948 wrote to memory of 2008	4948	chrome.exe	chrome.exe
PID 4948 wrote to memory of 2008	4948	chrome.exe	chrome.exe
PID 4948 wrote to memory of 2008	4948	chrome.exe	chrome.exe
PID 4948 wrote to memory of 2008	4948	chrome.exe	chrome.exe
PID 4948 wrote to memory of 2008	4948	chrome.exe	chrome.exe
PID 4948 wrote to memory of 2008	4948	chrome.exe	chrome.exe
PID 4948 wrote to memory of 2008	4948	chrome.exe	chrome.exe
PID 4948 wrote to memory of 2008	4948	chrome.exe	chrome.exe
PID 4948 wrote to memory of 2008	4948	chrome.exe	chrome.exe
PID 4948 wrote to memory of 2008	4948	chrome.exe	chrome.exe
PID 4948 wrote to memory of 2008	4948	chrome.exe	chrome.exe
PID 4948 wrote to memory of 2008	4948	chrome.exe	chrome.exe
PID 4948 wrote to memory of 2008	4948	chrome.exe	chrome.exe
PID 4948 wrote to memory of 2008	4948	chrome.exe	chrome.exe
PID 4948 wrote to memory of 2008	4948	chrome.exe	chrome.exe
PID 4948 wrote to memory of 2008	4948	chrome.exe	chrome.exe
PID 4948 wrote to memory of 2008	4948	chrome.exe	chrome.exe
PID 4948 wrote to memory of 2008	4948	chrome.exe	chrome.exe
PID 4948 wrote to memory of 2008	4948	chrome.exe	chrome.exe
PID 4948 wrote to memory of 2008	4948	chrome.exe	chrome.exe
PID 4948 wrote to memory of 2008	4948	chrome.exe	chrome.exe
PID 4948 wrote to memory of 2008	4948	chrome.exe	chrome.exe
PID 4948 wrote to memory of 2008	4948	chrome.exe	chrome.exe
PID 4948 wrote to memory of 2008	4948	chrome.exe	chrome.exe
PID 4948 wrote to memory of 2008	4948	chrome.exe	chrome.exe
PID 4948 wrote to memory of 4524	4948	chrome.exe	chrome.exe
PID 4948 wrote to memory of 4524	4948	chrome.exe	chrome.exe
PID 4948 wrote to memory of 4616	4948	chrome.exe	chrome.exe
PID 4948 wrote to memory of 4616	4948	chrome.exe	chrome.exe
PID 4948 wrote to memory of 4616	4948	chrome.exe	chrome.exe
PID 4948 wrote to memory of 4616	4948	chrome.exe	chrome.exe
PID 4948 wrote to memory of 4616	4948	chrome.exe	chrome.exe
PID 4948 wrote to memory of 4616	4948	chrome.exe	chrome.exe
PID 4948 wrote to memory of 4616	4948	chrome.exe	chrome.exe
PID 4948 wrote to memory of 4616	4948	chrome.exe	chrome.exe
PID 4948 wrote to memory of 4616	4948	chrome.exe	chrome.exe
PID 4948 wrote to memory of 4616	4948	chrome.exe	chrome.exe
PID 4948 wrote to memory of 4616	4948	chrome.exe	chrome.exe
PID 4948 wrote to memory of 4616	4948	chrome.exe	chrome.exe
PID 4948 wrote to memory of 4616	4948	chrome.exe	chrome.exe
PID 4948 wrote to memory of 4616	4948	chrome.exe	chrome.exe
PID 4948 wrote to memory of 4616	4948	chrome.exe	chrome.exe
PID 4948 wrote to memory of 4616	4948	chrome.exe	chrome.exe
PID 4948 wrote to memory of 4616	4948	chrome.exe	chrome.exe
PID 4948 wrote to memory of 4616	4948	chrome.exe	chrome.exe
PID 4948 wrote to memory of 4616	4948	chrome.exe	chrome.exe
PID 4948 wrote to memory of 4616	4948	chrome.exe	chrome.exe
PID 4948 wrote to memory of 4616	4948	chrome.exe	chrome.exe

C:\Users\Admin\AppData\Local\Temp\aafec3c88c342370a233018452ada22295bfb65f6856db0223e163bbfb5afcfc.exe
"C:\Users\Admin\AppData\Local\Temp\aafec3c88c342370a233018452ada22295bfb65f6856db0223e163bbfb5afcfc.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2060

C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
"C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1388

C:\Users\Admin\AppData\Local\Temp\1000055001\eb9af177b9.exe
"C:\Users\Admin\AppData\Local\Temp\1000055001\eb9af177b9.exe"
3⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1648

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
4⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4948

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffde49bab58,0x7ffde49bab68,0x7ffde49bab78
5⤵
PID:1752

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1660 --field-trial-handle=1844,i,1461855970736801932,3271045160981901569,131072 /prefetch:2
5⤵
PID:2008

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=1844,i,1461855970736801932,3271045160981901569,131072 /prefetch:8
5⤵
PID:4524

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2164 --field-trial-handle=1844,i,1461855970736801932,3271045160981901569,131072 /prefetch:8
5⤵
PID:4616

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3052 --field-trial-handle=1844,i,1461855970736801932,3271045160981901569,131072 /prefetch:1
5⤵
PID:4800

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3060 --field-trial-handle=1844,i,1461855970736801932,3271045160981901569,131072 /prefetch:1
5⤵
PID:2296

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4132 --field-trial-handle=1844,i,1461855970736801932,3271045160981901569,131072 /prefetch:1
5⤵
PID:3724

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4436 --field-trial-handle=1844,i,1461855970736801932,3271045160981901569,131072 /prefetch:1
5⤵
PID:2432

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3300 --field-trial-handle=1844,i,1461855970736801932,3271045160981901569,131072 /prefetch:8
5⤵
PID:2472

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3260 --field-trial-handle=1844,i,1461855970736801932,3271045160981901569,131072 /prefetch:8
5⤵
- Modifies registry class
PID:4888

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5048 --field-trial-handle=1844,i,1461855970736801932,3271045160981901569,131072 /prefetch:8
5⤵
PID:3624

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4876 --field-trial-handle=1844,i,1461855970736801932,3271045160981901569,131072 /prefetch:8
5⤵
PID:3760

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4168 --field-trial-handle=1844,i,1461855970736801932,3271045160981901569,131072 /prefetch:8
5⤵
PID:2000

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1624 --field-trial-handle=1844,i,1461855970736801932,3271045160981901569,131072 /prefetch:2
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:1092

C:\Users\Admin\AppData\Local\Temp\1000056001\cf7da7e78d.exe
"C:\Users\Admin\AppData\Local\Temp\1000056001\cf7da7e78d.exe"
3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2776

C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
"C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"
3⤵
PID:3380

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
3⤵
- Loads dropped DLL
PID:4676

C:\Windows\system32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
4⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4512

C:\Windows\system32\netsh.exe
netsh wlan show profiles
5⤵
PID:1844

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\263309122282_Desktop.zip' -CompressionLevel Optimal
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4560

C:\Users\Admin\AppData\Local\Temp\1000059001\amert.exe
"C:\Users\Admin\AppData\Local\Temp\1000059001\amert.exe"
3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:1920

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
3⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:5020

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:3760

C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4608

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
2⤵
- Loads dropped DLL
PID:1928

C:\Windows\system32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2208

C:\Windows\system32\netsh.exe
netsh wlan show profiles
4⤵
PID:3420

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\263309122282_Desktop.zip' -CompressionLevel Optimal
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:1172

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main
2⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:3012

C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3412

C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1552

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
360B

MD5
786af2dfebf776be4d0319cfd62ac7cb

SHA1
bd8d6b7d4fb2bf693816c873a9ff788d8171e478

SHA256
0c424bc8441e63fb49b7e3ead63cc67377f19acc6708eb6fbe5785c095d8309b

SHA512
d325b88d1174950f6e3b30a46eb2650c07fb791a08ff2e90cc49c51d60f876ab840ef621500299d30e0b5d5b49363e17ac5457b4ff4c915b85270d43bb462097

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
2KB

MD5
f26062d86c651649d1e6b821aeb2bc70

SHA1
a1a521b790633de4e696aa62f9047bc7762d2aca

SHA256
498ee2804adf59b400b288eb8aa191ecc30d2b012ac3b7d822638497145047f5

SHA512
2f9dd5c42544065618b85e14bbde2b0f316db0d46ae04898cd11130f299ed00dc4d11ba35a34c485c49ab562055f3d169d6db6d4635b04915ac1dc3298ae717a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
2KB

MD5
1210908fb189744feea8647644bbb4c5

SHA1
c106e31d3572aedfd5bdccd0a715531fdb9f3dc0

SHA256
c49c2dfe89b8fe99b4a50cfbc10533450e6d1390285484218891d911e0fa2f79

SHA512
b20302a09410e6a4e92ab1cf1493657b02693d045c5eb2544484cecf32e7da5875a3b354e9921c333d3edc2b182a98ddbb06f8c45d82be3fa8b688d5759dd8bb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
524B

MD5
bb475c70f420f8d8e55fc116be9cdca3

SHA1
2fb3c26b2d7f6589c9dc72642c6c28e4cd84b542

SHA256
0ea3acd275e408c7a2a7076ce0d14b4df092ae4ca2409780e437a353003cbe5e

SHA512
cf16dbb10d74d7b9f229d83ce2aa0713f3db5707597f8346d09d600b1903f11aaf397088b16abb3a59b8cefbe6debf5f1474114f2d1ba000c35402c40333698a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
524B

MD5
c2a8447acda81ddcbb126b48aeb112e2

SHA1
29b4de26cf1eec9da2284215c6b6783edd175619

SHA256
ba35872f3fd26e979c704dee710e4b5795264ce4fa7740316b195bacb6d51d79

SHA512
c8b5059857e6829f683d32906f925c44565c93fbe48276f72990bcf6816e0992553f688a5823301cd9720c9e07e902068bdf1cd50307436a79dcc8251d42606e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
524B

MD5
835c6b4969b8b3d1d6943017c68e1756

SHA1
3434d96ad32451c1c1d0c4ca43b65abd25b0d76a

SHA256
4f4ab326ffa6290b3ec8673d5cb34a408d6a2e26687d7f4656339668eea3e33d

SHA512
1422e65c2759fc9573cfd90b1afaa880603eec46ded3e9869d764ae7317519361a8d0c9561cee47589f71bd6768f91af65d451b03ac7332f307331f27fa6bb5c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
3724f68c59944c6a08926135c0619686

SHA1
0eacb1b2a9ad9551af00c68f5feeeec709d04bd0

SHA256
4fd3d7a7671a0ce20e6e0450926e2914c65066babb711623877b468745cfed8d

SHA512
eed36308bf46ca323a9c7435292c8ff063fc431d22fd6eb225afd8a0dd951fddc5b79a8dfd8a5c08459deb9bab7c7a8aa810a7abbec1e93da5f173929da87ff6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Filesize
16KB

MD5
5a5850c9345a46e17f528a5f6afa1a42

SHA1
bde948baa0d0f7e2852e95192cbc052310345642

SHA256
5e950caced053328adbd5b99368cb1c13274e327d34259e354538b4f9ed8c8f7

SHA512
dc14421fe0d57fbfd6c6d9dfc0a8e912b1ed9ed939bc159ef904b9611c8875a1324e3730077bb657f7566a4f1467814d6a695ae89eeaae2fe3b0eea0717c7717

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
252KB

MD5
46e303c9c76cff1ced2746ae7aa43f3d

SHA1
a8cd2b5ff46fcad273a95083e8ac51f5f8e3c6f7

SHA256
15b69c349a9e4a6fcfd6d0e94100aa40f70cc6503e3186c0a3b48da82125a4d2

SHA512
618ace0a29b3c6e247ecb7a5a2e239e8d7731cbaa737718f87bf97b255b7e0560f7c4f537b17f3fea48e1065ec51f7b31dd35e19f62d052dc4e9942d4c498cc8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
3KB

MD5
ae626d9a72417b14570daa8fcd5d34a4

SHA1
c103ebaf4d760df722d620df87e6f07c0486439f

SHA256
52cc3f3028fab0d347a4a3fffef570b42f85748176d81a3344996d42fd1de32a

SHA512
a0690bda318bdf43d6f292f88d4ea2ebeec83b95e9ebca80083dbb08e7ddcdb9735cc58b89d369a34f10acf8a114d4a207ed8d0f070c5baf87c5798e9f35bc14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
b3a83d0196afc480a90a1e7444210036

SHA1
6376ef283df20976769287b3bdc6bcd5d5ce371f

SHA256
3ac4190b1c447f3b5365b056150575ec779ffba10b82d940c93009e2f6809a07

SHA512
dfff8f23370ae8ab390b8a3dd675dd71ca6a8d0fac0f0c9a8b43453763ba5fa96a79a4b5a8891bcac86996471b912ca51dfc6b877d647391d14e355191d77370

Download Submit
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
Filesize
3.0MB

MD5
19833d849cf5e16a70cbd96e899eddfe

SHA1
b06486c8479a0d385d09d1e8d6ffa0e68001d4dc

SHA256
aafec3c88c342370a233018452ada22295bfb65f6856db0223e163bbfb5afcfc

SHA512
928ca5b7d925517d80a7553549715bb5aad59660a64b98330be2b8539fdf849b7ab6e9c6c9af67f5a38e727b7a99370da8053784aeecfbe08515ab13a50dbe64

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000055001\eb9af177b9.exe
Filesize
1.1MB

MD5
1d38d119897d791acf7a76a460b8010d

SHA1
7872d3e5fa15017d590cb00fc2a4f74e2388a7dc

SHA256
49ffe50ccb8df0b1d2de4985b86970ec1fb564e757d48b007105e72badfb594d

SHA512
47cd9d256c65f537b3b3df9a4f3b40f9912b8eb8dfdc6c4b3e11855bcd2e4d791ccbc8fb0e5c5643d41bca2ffd766bbabd969cf27ddbb51ae490db373064f21a

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000056001\cf7da7e78d.exe
Filesize
2.3MB

MD5
fd749c8fb61e95089f5ae48e25e6755f

SHA1
a9c457a4e404d8f16fe399e4e9c92991b840dd64

SHA256
9893b06d9716b043134116ee41eb03103e1b7dc69649641c96e241e6cac15d85

SHA512
c047530479fa55f6817c551c4e88bc4ffde38e5da5ef46ea9c7d7708c25bb3708f3c2a5fb708ae12d9c3f49ed7d22375589ee46b695595a0a07b58c53ad824b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000059001\amert.exe
Filesize
1.8MB

MD5
f77620e37fb87bdebb3cf5f6f2c47f40

SHA1
363d14e2a03d08b8a47b0b2c432e08389acc7a38

SHA256
e3aaad13eb435fef8caceaa49a50e35d638da30ab706a9bcc785eda2217a5c15

SHA512
e851fb606f7fd8b983ace7b4e6edb7e37d6850aea89575d5e18db8dbb59c63ab4838c2a60d587d1cb58ebd3fabff419b2163f66847dd830debfbe0139737fa26

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nxb1pcvc.r5m.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
109KB

MD5
726cd06231883a159ec1ce28dd538699

SHA1
404897e6a133d255ad5a9c26ac6414d7134285a2

SHA256
12fef2d5995d671ec0e91bdbdc91e2b0d3c90ed3a8b2b13ddaa8ad64727dcd46

SHA512
9ea82e7cb6c6a58446bd5033855947c3e2d475d2910f2b941235e0b96aa08eec822d2dd17cc86b2d3fce930f78b799291992408e309a6c63e3011266810ea83e

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
Filesize
1.2MB

MD5
15a42d3e4579da615a384c717ab2109b

SHA1
22aeedeb2307b1370cdab70d6a6b6d2c13ad2301

SHA256
3c97bb410e49b11af8116feb7240b7101e1967cae7538418c45c3d2e072e8103

SHA512
1eb7f126dccc88a2479e3818c36120f5af3caa0d632b9ea803485ee6531d6e2a1fd0805b1c4364983d280df23ea5ca3ad4a5fca558ac436efae36af9b795c444

Download Submit
C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll
Filesize
109KB

MD5
154c3f1334dd435f562672f2664fea6b

SHA1
51dd25e2ba98b8546de163b8f26e2972a90c2c79

SHA256
5f431129f97f3d56929f1e5584819e091bd6c854d7e18503074737fc6d79e33f

SHA512
1bca69bbcdb7ecd418769e9d4befc458f9f8e3cee81feb7316bb61e189e2904f4431e4cc7d291e179a5dec441b959d428d8e433f579036f763bbad6460222841

Download Submit
C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll
Filesize
1.2MB

MD5
f35b671fda2603ec30ace10946f11a90

SHA1
059ad6b06559d4db581b1879e709f32f80850872

SHA256
83e3df5bec15d5333935bea8b719a6d677e2fb3dc1cf9e18e7b82fd0438285c7

SHA512
b5fa27d08c64727cef7fdda5e68054a4359cd697df50d70d1d90da583195959a139066a6214531bbc5f20cd4f9bc1ca3e4244396547381291a6a1d2df9cf8705

Download Submit
\??\pipe\crashpad_4948_AMIWQSNKDBOWVERC
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1388-29-0x00000000057F0000-0x00000000057F1000-memory.dmp

Filesize
4KB

Download
memory/1388-326-0x0000000000F70000-0x000000000127A000-memory.dmp

Filesize
3.0MB

Download
memory/1388-34-0x0000000005800000-0x0000000005801000-memory.dmp

Filesize
4KB

Download
memory/1388-32-0x00000000057E0000-0x00000000057E1000-memory.dmp

Filesize
4KB

Download
memory/1388-31-0x0000000005790000-0x0000000005791000-memory.dmp

Filesize
4KB

Download
memory/1388-30-0x0000000005780000-0x0000000005781000-memory.dmp

Filesize
4KB

Download
memory/1388-28-0x00000000057A0000-0x00000000057A1000-memory.dmp

Filesize
4KB

Download
memory/1388-412-0x0000000000F70000-0x000000000127A000-memory.dmp

Filesize
3.0MB

Download
memory/1388-27-0x00000000057C0000-0x00000000057C1000-memory.dmp

Filesize
4KB

Download
memory/1388-400-0x0000000000F70000-0x000000000127A000-memory.dmp

Filesize
3.0MB

Download
memory/1388-231-0x0000000000F70000-0x000000000127A000-memory.dmp

Filesize
3.0MB

Download
memory/1388-392-0x0000000000F70000-0x000000000127A000-memory.dmp

Filesize
3.0MB

Download
memory/1388-389-0x0000000000F70000-0x000000000127A000-memory.dmp

Filesize
3.0MB

Download
memory/1388-386-0x0000000000F70000-0x000000000127A000-memory.dmp

Filesize
3.0MB

Download
memory/1388-248-0x0000000000F70000-0x000000000127A000-memory.dmp

Filesize
3.0MB

Download
memory/1388-373-0x0000000000F70000-0x000000000127A000-memory.dmp

Filesize
3.0MB

Download
memory/1388-370-0x0000000000F70000-0x000000000127A000-memory.dmp

Filesize
3.0MB

Download
memory/1388-26-0x00000000057B0000-0x00000000057B1000-memory.dmp

Filesize
4KB

Download
memory/1388-25-0x0000000000F70000-0x000000000127A000-memory.dmp

Filesize
3.0MB

Download
memory/1388-344-0x0000000000F70000-0x000000000127A000-memory.dmp

Filesize
3.0MB

Download
memory/1388-140-0x0000000000F70000-0x000000000127A000-memory.dmp

Filesize
3.0MB

Download
memory/1388-141-0x0000000000F70000-0x000000000127A000-memory.dmp

Filesize
3.0MB

Download
memory/1388-281-0x0000000000F70000-0x000000000127A000-memory.dmp

Filesize
3.0MB

Download
memory/1388-23-0x0000000000F70000-0x000000000127A000-memory.dmp

Filesize
3.0MB

Download
memory/1388-340-0x0000000000F70000-0x000000000127A000-memory.dmp

Filesize
3.0MB

Download
memory/1388-164-0x0000000000F70000-0x000000000127A000-memory.dmp

Filesize
3.0MB

Download
memory/1388-33-0x0000000005810000-0x0000000005811000-memory.dmp

Filesize
4KB

Download
memory/1552-384-0x0000000000F70000-0x000000000127A000-memory.dmp

Filesize
3.0MB

Download
memory/1920-212-0x00000000051F0000-0x00000000051F1000-memory.dmp

Filesize
4KB

Download
memory/1920-213-0x0000000005190000-0x0000000005191000-memory.dmp

Filesize
4KB

Download
memory/1920-207-0x00000000007E0000-0x0000000000C93000-memory.dmp

Filesize
4.7MB

Download
memory/1920-219-0x0000000005210000-0x0000000005211000-memory.dmp

Filesize
4KB

Download
memory/1920-218-0x0000000005220000-0x0000000005221000-memory.dmp

Filesize
4KB

Download
memory/1920-211-0x00000000051B0000-0x00000000051B1000-memory.dmp

Filesize
4KB

Download
memory/1920-214-0x00000000051A0000-0x00000000051A1000-memory.dmp

Filesize
4KB

Download
memory/1920-208-0x00000000007E0000-0x0000000000C93000-memory.dmp

Filesize
4.7MB

Download
memory/1920-210-0x00000000051D0000-0x00000000051D1000-memory.dmp

Filesize
4KB

Download
memory/1920-209-0x00000000051C0000-0x00000000051C1000-memory.dmp

Filesize
4KB

Download
memory/1920-223-0x00000000007E0000-0x0000000000C93000-memory.dmp

Filesize
4.7MB

Download
memory/2060-9-0x0000000004940000-0x0000000004941000-memory.dmp

Filesize
4KB

Download
memory/2060-10-0x0000000004970000-0x0000000004971000-memory.dmp

Filesize
4KB

Download
memory/2060-3-0x0000000004910000-0x0000000004911000-memory.dmp

Filesize
4KB

Download
memory/2060-4-0x0000000004920000-0x0000000004921000-memory.dmp

Filesize
4KB

Download
memory/2060-24-0x0000000000040000-0x000000000034A000-memory.dmp

Filesize
3.0MB

Download
memory/2060-0-0x0000000000040000-0x000000000034A000-memory.dmp

Filesize
3.0MB

Download
memory/2060-11-0x0000000004960000-0x0000000004961000-memory.dmp

Filesize
4KB

Download
memory/2060-6-0x0000000004950000-0x0000000004951000-memory.dmp

Filesize
4KB

Download
memory/2060-7-0x00000000048E0000-0x00000000048E1000-memory.dmp

Filesize
4KB

Download
memory/2060-5-0x0000000004900000-0x0000000004901000-memory.dmp

Filesize
4KB

Download
memory/2060-8-0x00000000048F0000-0x00000000048F1000-memory.dmp

Filesize
4KB

Download
memory/2060-1-0x00000000771E6000-0x00000000771E8000-memory.dmp

Filesize
8KB

Download
memory/2060-2-0x0000000000040000-0x000000000034A000-memory.dmp

Filesize
3.0MB

Download
memory/2776-120-0x0000000005010000-0x0000000005011000-memory.dmp

Filesize
4KB

Download
memory/2776-388-0x0000000000580000-0x0000000000B51000-memory.dmp

Filesize
5.8MB

Download
memory/2776-247-0x0000000000580000-0x0000000000B51000-memory.dmp

Filesize
5.8MB

Download
memory/2776-205-0x0000000000580000-0x0000000000B51000-memory.dmp

Filesize
5.8MB

Download
memory/2776-414-0x0000000000580000-0x0000000000B51000-memory.dmp

Filesize
5.8MB

Download
memory/2776-118-0x0000000000580000-0x0000000000B51000-memory.dmp

Filesize
5.8MB

Download
memory/2776-411-0x0000000000580000-0x0000000000B51000-memory.dmp

Filesize
5.8MB

Download
memory/2776-119-0x0000000005040000-0x0000000005041000-memory.dmp

Filesize
4KB

Download
memory/2776-121-0x0000000005070000-0x0000000005071000-memory.dmp

Filesize
4KB

Download
memory/2776-399-0x0000000000580000-0x0000000000B51000-memory.dmp

Filesize
5.8MB

Download
memory/2776-122-0x0000000005000000-0x0000000005001000-memory.dmp

Filesize
4KB

Download
memory/2776-391-0x0000000000580000-0x0000000000B51000-memory.dmp

Filesize
5.8MB

Download
memory/2776-123-0x0000000004FF0000-0x0000000004FF1000-memory.dmp

Filesize
4KB

Download
memory/2776-280-0x0000000000580000-0x0000000000B51000-memory.dmp

Filesize
5.8MB

Download
memory/2776-206-0x0000000000580000-0x0000000000B51000-memory.dmp

Filesize
5.8MB

Download
memory/2776-124-0x0000000005050000-0x0000000005051000-memory.dmp

Filesize
4KB

Download
memory/2776-385-0x0000000000580000-0x0000000000B51000-memory.dmp

Filesize
5.8MB

Download
memory/2776-125-0x0000000005080000-0x0000000005081000-memory.dmp

Filesize
4KB

Download
memory/2776-126-0x00000000050A0000-0x00000000050A1000-memory.dmp

Filesize
4KB

Download
memory/2776-325-0x0000000000580000-0x0000000000B51000-memory.dmp

Filesize
5.8MB

Download
memory/2776-372-0x0000000000580000-0x0000000000B51000-memory.dmp

Filesize
5.8MB

Download
memory/2776-127-0x0000000005030000-0x0000000005031000-memory.dmp

Filesize
4KB

Download
memory/2776-128-0x0000000005090000-0x0000000005091000-memory.dmp

Filesize
4KB

Download
memory/2776-339-0x0000000000580000-0x0000000000B51000-memory.dmp

Filesize
5.8MB

Download
memory/2776-360-0x0000000000580000-0x0000000000B51000-memory.dmp

Filesize
5.8MB

Download
memory/2776-129-0x0000000004FE0000-0x0000000004FE1000-memory.dmp

Filesize
4KB

Download
memory/2776-343-0x0000000000580000-0x0000000000B51000-memory.dmp

Filesize
5.8MB

Download
memory/2776-130-0x00000000050D0000-0x00000000050D2000-memory.dmp

Filesize
8KB

Download
memory/3412-262-0x0000000000F70000-0x000000000127A000-memory.dmp

Filesize
3.0MB

Download
memory/3412-279-0x0000000000F70000-0x000000000127A000-memory.dmp

Filesize
3.0MB

Download
memory/4560-182-0x000001B257B90000-0x000001B257BA2000-memory.dmp

Filesize
72KB

Download
memory/4560-189-0x00007FFDE1D30000-0x00007FFDE27F2000-memory.dmp

Filesize
10.8MB

Download
memory/4560-162-0x00007FFDE1D30000-0x00007FFDE27F2000-memory.dmp

Filesize
10.8MB

Download
memory/4560-161-0x000001B257B00000-0x000001B257B22000-memory.dmp

Filesize
136KB

Download
memory/4560-163-0x000001B23DC10000-0x000001B23DC20000-memory.dmp

Filesize
64KB

Download
memory/4560-165-0x000001B23DC10000-0x000001B23DC20000-memory.dmp

Filesize
64KB

Download
memory/4560-183-0x000001B257B80000-0x000001B257B8A000-memory.dmp

Filesize
40KB

Download
memory/4560-166-0x000001B23DC10000-0x000001B23DC20000-memory.dmp

Filesize
64KB

Download
memory/4608-387-0x0000000000DA0000-0x0000000001253000-memory.dmp

Filesize
4.7MB

Download
memory/4608-265-0x00000000056A0000-0x00000000056A1000-memory.dmp

Filesize
4KB

Download
memory/4608-345-0x0000000000DA0000-0x0000000001253000-memory.dmp

Filesize
4.7MB

Download
memory/4608-374-0x0000000000DA0000-0x0000000001253000-memory.dmp

Filesize
4.7MB

Download
memory/4608-371-0x0000000000DA0000-0x0000000001253000-memory.dmp

Filesize
4.7MB

Download
memory/4608-390-0x0000000000DA0000-0x0000000001253000-memory.dmp

Filesize
4.7MB

Download
memory/4608-267-0x00000000056C0000-0x00000000056C1000-memory.dmp

Filesize
4KB

Download
memory/4608-266-0x0000000005680000-0x0000000005681000-memory.dmp

Filesize
4KB

Download
memory/4608-393-0x0000000000DA0000-0x0000000001253000-memory.dmp

Filesize
4.7MB

Download
memory/4608-282-0x0000000000DA0000-0x0000000001253000-memory.dmp

Filesize
4.7MB

Download
memory/4608-264-0x0000000005690000-0x0000000005691000-memory.dmp

Filesize
4KB

Download
memory/4608-401-0x0000000000DA0000-0x0000000001253000-memory.dmp

Filesize
4.7MB

Download
memory/4608-263-0x0000000000DA0000-0x0000000001253000-memory.dmp

Filesize
4.7MB

Download
memory/4608-327-0x0000000000DA0000-0x0000000001253000-memory.dmp

Filesize
4.7MB

Download
memory/4608-341-0x0000000000DA0000-0x0000000001253000-memory.dmp

Filesize
4.7MB

Download
memory/4608-413-0x0000000000DA0000-0x0000000001253000-memory.dmp

Filesize
4.7MB

Download
memory/4608-251-0x0000000000DA0000-0x0000000001253000-memory.dmp

Filesize
4.7MB

Download