amadey | 1bebb04cd216a1e16df87f944e655ec75593f03bad7c46d2bd078dd805e20811

Analysis

max time kernel
150s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
22-04-2024 15:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1bebb04cd216a1e16df87f944e655ec75593f03bad7c46d2bd078dd805e20811.exe
Size

1.8MB
MD5

f8b5857ea950c83cd3bcb2d58986a489
SHA1

8f3a0a3783755c414abdbff3900823783e996436
SHA256

1bebb04cd216a1e16df87f944e655ec75593f03bad7c46d2bd078dd805e20811
SHA512

4372fb69677ee3d07b93d8e9e8bc642d150a6ced9a94734f1555a0f2989255fd9dd46fa6d0852793d9194b696b210f995065e60ab26c2ec59b9d88bd692141b1
SSDEEP

49152:L3/bnTZGQ+uriNIzU6inU33NdzOzNCV6PZg6SSD:LjnTZGDuriNEU6ifNCwPZg6TD

Score

10^/10

amadey risepro evasion persistence spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.20

http://193.233.132.139

Attributes

install_dir
5454e6f062
install_file
explorta.exe
strings_key
c7a869c5ba1d72480093ec207994e2bf
url_paths
/sev56rkm/index.php

rc4.plain

Extracted

Family

amadey

Version

4.17

http://193.233.132.167

Attributes

install_dir
4d0ab15804
install_file
chrosha.exe
strings_key
1a9519d7b465e1f4880fa09a6162d768
url_paths
/enigma/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

chrosha.exeexplorta.exe1bebb04cd216a1e16df87f944e655ec75593f03bad7c46d2bd078dd805e20811.exeexplorta.exe9c18db7b69.exeexplorta.exeamert.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	chrosha.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorta.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	1bebb04cd216a1e16df87f944e655ec75593f03bad7c46d2bd078dd805e20811.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorta.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	9c18db7b69.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorta.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	amert.exe

Blocklisted process makes network request 2 IoCs

Processes:

rundll32.exerundll32.exe

flow pid process

39 1716 rundll32.exe
45 4236 rundll32.exe
Downloads MZ/PE file

flow	pid	process
39	1716	rundll32.exe
45	4236	rundll32.exe

Checks BIOS information in registry 2 TTPs 14 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

9c18db7b69.exeexplorta.exeamert.exeexplorta.exeexplorta.exechrosha.exe1bebb04cd216a1e16df87f944e655ec75593f03bad7c46d2bd078dd805e20811.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	9c18db7b69.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorta.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorta.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	amert.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	amert.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorta.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorta.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorta.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	chrosha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	1bebb04cd216a1e16df87f944e655ec75593f03bad7c46d2bd078dd805e20811.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorta.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	9c18db7b69.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	chrosha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	1bebb04cd216a1e16df87f944e655ec75593f03bad7c46d2bd078dd805e20811.exe

Executes dropped EXE 7 IoCs

Processes:

explorta.exe2e9698eebd.exe9c18db7b69.exeexplorta.exeamert.exechrosha.exeexplorta.exe

pid process

1072 explorta.exe
2764 2e9698eebd.exe
3632 9c18db7b69.exe
2996 explorta.exe
3580 amert.exe
4128 chrosha.exe
5048 explorta.exe

pid	process
1072	explorta.exe
2764	2e9698eebd.exe
3632	9c18db7b69.exe
2996	explorta.exe
3580	amert.exe
4128	chrosha.exe
5048	explorta.exe

Identifies Wine through registry keys 2 TTPs 7 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

1bebb04cd216a1e16df87f944e655ec75593f03bad7c46d2bd078dd805e20811.exeexplorta.exe9c18db7b69.exeexplorta.exeamert.exechrosha.exeexplorta.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000\Software\Wine	1bebb04cd216a1e16df87f944e655ec75593f03bad7c46d2bd078dd805e20811.exe
Key opened	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000\Software\Wine	explorta.exe
Key opened	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000\Software\Wine	9c18db7b69.exe
Key opened	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000\Software\Wine	explorta.exe
Key opened	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000\Software\Wine	amert.exe
Key opened	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000\Software\Wine	chrosha.exe
Key opened	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000\Software\Wine	explorta.exe

Loads dropped DLL 3 IoCs

Processes:

rundll32.exerundll32.exerundll32.exe

pid process

4788 rundll32.exe
1716 rundll32.exe
4236 rundll32.exe
Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
4788	rundll32.exe
1716	rundll32.exe
4236	rundll32.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explorta.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000\Software\Microsoft\Windows\CurrentVersion\Run\2e9698eebd.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000008001\\2e9698eebd.exe"	explorta.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000\Software\Microsoft\Windows\CurrentVersion\Run\9c18db7b69.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000009001\\9c18db7b69.exe"	explorta.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\1000008001\2e9698eebd.exe	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs

Processes:

1bebb04cd216a1e16df87f944e655ec75593f03bad7c46d2bd078dd805e20811.exeexplorta.exe9c18db7b69.exeexplorta.exeamert.exechrosha.exeexplorta.exe

pid	process
1144	1bebb04cd216a1e16df87f944e655ec75593f03bad7c46d2bd078dd805e20811.exe
1072	explorta.exe
3632	9c18db7b69.exe
2996	explorta.exe
3580	amert.exe
4128	chrosha.exe
5048	explorta.exe

Drops file in Windows directory 2 IoCs

Processes:

amert.exe1bebb04cd216a1e16df87f944e655ec75593f03bad7c46d2bd078dd805e20811.exe

description	ioc	process
File created	C:\Windows\Tasks\chrosha.job	amert.exe
File created	C:\Windows\Tasks\explorta.job	1bebb04cd216a1e16df87f944e655ec75593f03bad7c46d2bd078dd805e20811.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133582735977217294"	chrome.exe

Modifies registry class 1 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3777591257-2471171023-3629228286-1000\{B21C70EB-A20B-4A3E-BAAD-5831B05C3516}	chrome.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

Processes:

1bebb04cd216a1e16df87f944e655ec75593f03bad7c46d2bd078dd805e20811.exeexplorta.exechrome.exe9c18db7b69.exeexplorta.exeamert.exechrosha.exeexplorta.exechrome.exerundll32.exepowershell.exe

pid	process
1144	1bebb04cd216a1e16df87f944e655ec75593f03bad7c46d2bd078dd805e20811.exe
1144	1bebb04cd216a1e16df87f944e655ec75593f03bad7c46d2bd078dd805e20811.exe
1072	explorta.exe
1072	explorta.exe
2708	chrome.exe
2708	chrome.exe
3632	9c18db7b69.exe
3632	9c18db7b69.exe
2996	explorta.exe
2996	explorta.exe
3580	amert.exe
3580	amert.exe
4128	chrosha.exe
4128	chrosha.exe
5048	explorta.exe
5048	explorta.exe
3580	chrome.exe
3580	chrome.exe
1716	rundll32.exe
1716	rundll32.exe
1716	rundll32.exe
1716	rundll32.exe
1716	rundll32.exe
1716	rundll32.exe
1716	rundll32.exe
1716	rundll32.exe
1716	rundll32.exe
1716	rundll32.exe
248	powershell.exe
248	powershell.exe
248	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

Processes:

chrome.exe

pid process

2708 chrome.exe
2708 chrome.exe
2708 chrome.exe
2708 chrome.exe

pid	process
2708	chrome.exe
2708	chrome.exe
2708	chrome.exe
2708	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	2708	chrome.exe
Token: SeCreatePagefilePrivilege	2708	chrome.exe
Token: SeShutdownPrivilege	2708	chrome.exe
Token: SeCreatePagefilePrivilege	2708	chrome.exe
Token: SeShutdownPrivilege	2708	chrome.exe
Token: SeCreatePagefilePrivilege	2708	chrome.exe
Token: SeShutdownPrivilege	2708	chrome.exe
Token: SeCreatePagefilePrivilege	2708	chrome.exe
Token: SeShutdownPrivilege	2708	chrome.exe
Token: SeCreatePagefilePrivilege	2708	chrome.exe
Token: SeShutdownPrivilege	2708	chrome.exe
Token: SeCreatePagefilePrivilege	2708	chrome.exe
Token: SeShutdownPrivilege	2708	chrome.exe
Token: SeCreatePagefilePrivilege	2708	chrome.exe
Token: SeShutdownPrivilege	2708	chrome.exe
Token: SeCreatePagefilePrivilege	2708	chrome.exe
Token: SeShutdownPrivilege	2708	chrome.exe
Token: SeCreatePagefilePrivilege	2708	chrome.exe
Token: SeShutdownPrivilege	2708	chrome.exe
Token: SeCreatePagefilePrivilege	2708	chrome.exe
Token: SeShutdownPrivilege	2708	chrome.exe
Token: SeCreatePagefilePrivilege	2708	chrome.exe
Token: SeShutdownPrivilege	2708	chrome.exe
Token: SeCreatePagefilePrivilege	2708	chrome.exe
Token: SeShutdownPrivilege	2708	chrome.exe
Token: SeCreatePagefilePrivilege	2708	chrome.exe
Token: SeShutdownPrivilege	2708	chrome.exe
Token: SeCreatePagefilePrivilege	2708	chrome.exe
Token: SeShutdownPrivilege	2708	chrome.exe
Token: SeCreatePagefilePrivilege	2708	chrome.exe
Token: SeShutdownPrivilege	2708	chrome.exe
Token: SeCreatePagefilePrivilege	2708	chrome.exe
Token: SeShutdownPrivilege	2708	chrome.exe
Token: SeCreatePagefilePrivilege	2708	chrome.exe
Token: SeShutdownPrivilege	2708	chrome.exe
Token: SeCreatePagefilePrivilege	2708	chrome.exe
Token: SeShutdownPrivilege	2708	chrome.exe
Token: SeCreatePagefilePrivilege	2708	chrome.exe
Token: SeShutdownPrivilege	2708	chrome.exe
Token: SeCreatePagefilePrivilege	2708	chrome.exe
Token: SeShutdownPrivilege	2708	chrome.exe
Token: SeCreatePagefilePrivilege	2708	chrome.exe
Token: SeShutdownPrivilege	2708	chrome.exe
Token: SeCreatePagefilePrivilege	2708	chrome.exe
Token: SeShutdownPrivilege	2708	chrome.exe
Token: SeCreatePagefilePrivilege	2708	chrome.exe
Token: SeShutdownPrivilege	2708	chrome.exe
Token: SeCreatePagefilePrivilege	2708	chrome.exe
Token: SeShutdownPrivilege	2708	chrome.exe
Token: SeCreatePagefilePrivilege	2708	chrome.exe
Token: SeShutdownPrivilege	2708	chrome.exe
Token: SeCreatePagefilePrivilege	2708	chrome.exe
Token: SeShutdownPrivilege	2708	chrome.exe
Token: SeCreatePagefilePrivilege	2708	chrome.exe
Token: SeShutdownPrivilege	2708	chrome.exe
Token: SeCreatePagefilePrivilege	2708	chrome.exe
Token: SeShutdownPrivilege	2708	chrome.exe
Token: SeCreatePagefilePrivilege	2708	chrome.exe
Token: SeShutdownPrivilege	2708	chrome.exe
Token: SeCreatePagefilePrivilege	2708	chrome.exe
Token: SeShutdownPrivilege	2708	chrome.exe
Token: SeCreatePagefilePrivilege	2708	chrome.exe
Token: SeShutdownPrivilege	2708	chrome.exe
Token: SeCreatePagefilePrivilege	2708	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

1bebb04cd216a1e16df87f944e655ec75593f03bad7c46d2bd078dd805e20811.exe2e9698eebd.exechrome.exe

pid	process
1144	1bebb04cd216a1e16df87f944e655ec75593f03bad7c46d2bd078dd805e20811.exe
2764	2e9698eebd.exe
2764	2e9698eebd.exe
2764	2e9698eebd.exe
2708	chrome.exe
2708	chrome.exe
2708	chrome.exe
2708	chrome.exe
2708	chrome.exe
2708	chrome.exe
2708	chrome.exe
2708	chrome.exe
2708	chrome.exe
2708	chrome.exe
2708	chrome.exe
2708	chrome.exe
2708	chrome.exe
2708	chrome.exe
2708	chrome.exe
2708	chrome.exe
2708	chrome.exe
2708	chrome.exe
2708	chrome.exe
2708	chrome.exe
2708	chrome.exe
2708	chrome.exe
2708	chrome.exe
2708	chrome.exe
2708	chrome.exe
2708	chrome.exe
2764	2e9698eebd.exe
2708	chrome.exe
2764	2e9698eebd.exe
2764	2e9698eebd.exe
2764	2e9698eebd.exe
2764	2e9698eebd.exe
2764	2e9698eebd.exe
2764	2e9698eebd.exe
2764	2e9698eebd.exe
2764	2e9698eebd.exe
2764	2e9698eebd.exe
2764	2e9698eebd.exe
2764	2e9698eebd.exe
2764	2e9698eebd.exe
2764	2e9698eebd.exe
2764	2e9698eebd.exe
2764	2e9698eebd.exe
2764	2e9698eebd.exe
2764	2e9698eebd.exe
2764	2e9698eebd.exe
2764	2e9698eebd.exe
2764	2e9698eebd.exe
2764	2e9698eebd.exe
2764	2e9698eebd.exe
2764	2e9698eebd.exe
2764	2e9698eebd.exe
2764	2e9698eebd.exe
2764	2e9698eebd.exe
2764	2e9698eebd.exe
2764	2e9698eebd.exe
2764	2e9698eebd.exe
2764	2e9698eebd.exe
2764	2e9698eebd.exe
2764	2e9698eebd.exe

Suspicious use of SendNotifyMessage 48 IoCs

Processes:

2e9698eebd.exechrome.exe

pid	process
2764	2e9698eebd.exe
2764	2e9698eebd.exe
2764	2e9698eebd.exe
2708	chrome.exe
2708	chrome.exe
2708	chrome.exe
2708	chrome.exe
2708	chrome.exe
2708	chrome.exe
2708	chrome.exe
2708	chrome.exe
2708	chrome.exe
2708	chrome.exe
2708	chrome.exe
2708	chrome.exe
2764	2e9698eebd.exe
2764	2e9698eebd.exe
2764	2e9698eebd.exe
2764	2e9698eebd.exe
2764	2e9698eebd.exe
2764	2e9698eebd.exe
2764	2e9698eebd.exe
2764	2e9698eebd.exe
2764	2e9698eebd.exe
2764	2e9698eebd.exe
2764	2e9698eebd.exe
2764	2e9698eebd.exe
2764	2e9698eebd.exe
2764	2e9698eebd.exe
2764	2e9698eebd.exe
2764	2e9698eebd.exe
2764	2e9698eebd.exe
2764	2e9698eebd.exe
2764	2e9698eebd.exe
2764	2e9698eebd.exe
2764	2e9698eebd.exe
2764	2e9698eebd.exe
2764	2e9698eebd.exe
2764	2e9698eebd.exe
2764	2e9698eebd.exe
2764	2e9698eebd.exe
2764	2e9698eebd.exe
2764	2e9698eebd.exe
2764	2e9698eebd.exe
2764	2e9698eebd.exe
2764	2e9698eebd.exe
2764	2e9698eebd.exe
2764	2e9698eebd.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

1bebb04cd216a1e16df87f944e655ec75593f03bad7c46d2bd078dd805e20811.exeexplorta.exe2e9698eebd.exechrome.exe

description	pid	process	target process
PID 1144 wrote to memory of 1072	1144	1bebb04cd216a1e16df87f944e655ec75593f03bad7c46d2bd078dd805e20811.exe	explorta.exe
PID 1144 wrote to memory of 1072	1144	1bebb04cd216a1e16df87f944e655ec75593f03bad7c46d2bd078dd805e20811.exe	explorta.exe
PID 1144 wrote to memory of 1072	1144	1bebb04cd216a1e16df87f944e655ec75593f03bad7c46d2bd078dd805e20811.exe	explorta.exe
PID 1072 wrote to memory of 2764	1072	explorta.exe	2e9698eebd.exe
PID 1072 wrote to memory of 2764	1072	explorta.exe	2e9698eebd.exe
PID 1072 wrote to memory of 2764	1072	explorta.exe	2e9698eebd.exe
PID 2764 wrote to memory of 2708	2764	2e9698eebd.exe	chrome.exe
PID 2764 wrote to memory of 2708	2764	2e9698eebd.exe	chrome.exe
PID 2708 wrote to memory of 4780	2708	chrome.exe	chrome.exe
PID 2708 wrote to memory of 4780	2708	chrome.exe	chrome.exe
PID 2708 wrote to memory of 3488	2708	chrome.exe	chrome.exe
PID 2708 wrote to memory of 3488	2708	chrome.exe	chrome.exe
PID 2708 wrote to memory of 3488	2708	chrome.exe	chrome.exe
PID 2708 wrote to memory of 3488	2708	chrome.exe	chrome.exe
PID 2708 wrote to memory of 3488	2708	chrome.exe	chrome.exe
PID 2708 wrote to memory of 3488	2708	chrome.exe	chrome.exe
PID 2708 wrote to memory of 3488	2708	chrome.exe	chrome.exe
PID 2708 wrote to memory of 3488	2708	chrome.exe	chrome.exe
PID 2708 wrote to memory of 3488	2708	chrome.exe	chrome.exe
PID 2708 wrote to memory of 3488	2708	chrome.exe	chrome.exe
PID 2708 wrote to memory of 3488	2708	chrome.exe	chrome.exe
PID 2708 wrote to memory of 3488	2708	chrome.exe	chrome.exe
PID 2708 wrote to memory of 3488	2708	chrome.exe	chrome.exe
PID 2708 wrote to memory of 3488	2708	chrome.exe	chrome.exe
PID 2708 wrote to memory of 3488	2708	chrome.exe	chrome.exe
PID 2708 wrote to memory of 3488	2708	chrome.exe	chrome.exe
PID 2708 wrote to memory of 3488	2708	chrome.exe	chrome.exe
PID 2708 wrote to memory of 3488	2708	chrome.exe	chrome.exe
PID 2708 wrote to memory of 3488	2708	chrome.exe	chrome.exe
PID 2708 wrote to memory of 3488	2708	chrome.exe	chrome.exe
PID 2708 wrote to memory of 3488	2708	chrome.exe	chrome.exe
PID 2708 wrote to memory of 3488	2708	chrome.exe	chrome.exe
PID 2708 wrote to memory of 3488	2708	chrome.exe	chrome.exe
PID 2708 wrote to memory of 3488	2708	chrome.exe	chrome.exe
PID 2708 wrote to memory of 3488	2708	chrome.exe	chrome.exe
PID 2708 wrote to memory of 3488	2708	chrome.exe	chrome.exe
PID 2708 wrote to memory of 3488	2708	chrome.exe	chrome.exe
PID 2708 wrote to memory of 3488	2708	chrome.exe	chrome.exe
PID 2708 wrote to memory of 3488	2708	chrome.exe	chrome.exe
PID 2708 wrote to memory of 3488	2708	chrome.exe	chrome.exe
PID 2708 wrote to memory of 3488	2708	chrome.exe	chrome.exe
PID 2708 wrote to memory of 4592	2708	chrome.exe	chrome.exe
PID 2708 wrote to memory of 4592	2708	chrome.exe	chrome.exe
PID 2708 wrote to memory of 1284	2708	chrome.exe	chrome.exe
PID 2708 wrote to memory of 1284	2708	chrome.exe	chrome.exe
PID 2708 wrote to memory of 1284	2708	chrome.exe	chrome.exe
PID 2708 wrote to memory of 1284	2708	chrome.exe	chrome.exe
PID 2708 wrote to memory of 1284	2708	chrome.exe	chrome.exe
PID 2708 wrote to memory of 1284	2708	chrome.exe	chrome.exe
PID 2708 wrote to memory of 1284	2708	chrome.exe	chrome.exe
PID 2708 wrote to memory of 1284	2708	chrome.exe	chrome.exe
PID 2708 wrote to memory of 1284	2708	chrome.exe	chrome.exe
PID 2708 wrote to memory of 1284	2708	chrome.exe	chrome.exe
PID 2708 wrote to memory of 1284	2708	chrome.exe	chrome.exe
PID 2708 wrote to memory of 1284	2708	chrome.exe	chrome.exe
PID 2708 wrote to memory of 1284	2708	chrome.exe	chrome.exe
PID 2708 wrote to memory of 1284	2708	chrome.exe	chrome.exe
PID 2708 wrote to memory of 1284	2708	chrome.exe	chrome.exe
PID 2708 wrote to memory of 1284	2708	chrome.exe	chrome.exe
PID 2708 wrote to memory of 1284	2708	chrome.exe	chrome.exe
PID 2708 wrote to memory of 1284	2708	chrome.exe	chrome.exe
PID 2708 wrote to memory of 1284	2708	chrome.exe	chrome.exe
PID 2708 wrote to memory of 1284	2708	chrome.exe	chrome.exe
PID 2708 wrote to memory of 1284	2708	chrome.exe	chrome.exe

C:\Users\Admin\AppData\Local\Temp\1bebb04cd216a1e16df87f944e655ec75593f03bad7c46d2bd078dd805e20811.exe
"C:\Users\Admin\AppData\Local\Temp\1bebb04cd216a1e16df87f944e655ec75593f03bad7c46d2bd078dd805e20811.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1144

C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
"C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe"
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1072

C:\Users\Admin\AppData\Local\Temp\1000008001\2e9698eebd.exe
"C:\Users\Admin\AppData\Local\Temp\1000008001\2e9698eebd.exe"
3⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2764

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
4⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2708

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff81625ab58,0x7ff81625ab68,0x7ff81625ab78
5⤵
PID:4780

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1560 --field-trial-handle=1788,i,10095353011881279262,10968094552804840699,131072 /prefetch:2
5⤵
PID:3488

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1788,i,10095353011881279262,10968094552804840699,131072 /prefetch:8
5⤵
PID:4592

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2180 --field-trial-handle=1788,i,10095353011881279262,10968094552804840699,131072 /prefetch:8
5⤵
PID:1284

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2948 --field-trial-handle=1788,i,10095353011881279262,10968094552804840699,131072 /prefetch:1
5⤵
PID:4076

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3180 --field-trial-handle=1788,i,10095353011881279262,10968094552804840699,131072 /prefetch:1
5⤵
PID:1988

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4088 --field-trial-handle=1788,i,10095353011881279262,10968094552804840699,131072 /prefetch:1
5⤵
PID:4536

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3304 --field-trial-handle=1788,i,10095353011881279262,10968094552804840699,131072 /prefetch:1
5⤵
PID:3528

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4296 --field-trial-handle=1788,i,10095353011881279262,10968094552804840699,131072 /prefetch:8
5⤵
PID:4356

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4360 --field-trial-handle=1788,i,10095353011881279262,10968094552804840699,131072 /prefetch:8
5⤵
- Modifies registry class
PID:4972

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4416 --field-trial-handle=1788,i,10095353011881279262,10968094552804840699,131072 /prefetch:8
5⤵
PID:2772

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4984 --field-trial-handle=1788,i,10095353011881279262,10968094552804840699,131072 /prefetch:8
5⤵
PID:2604

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5076 --field-trial-handle=1788,i,10095353011881279262,10968094552804840699,131072 /prefetch:8
5⤵
PID:2212

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4808 --field-trial-handle=1788,i,10095353011881279262,10968094552804840699,131072 /prefetch:2
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:3580

C:\Users\Admin\AppData\Local\Temp\1000009001\9c18db7b69.exe
"C:\Users\Admin\AppData\Local\Temp\1000009001\9c18db7b69.exe"
3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3632

C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
"C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe"
3⤵
PID:4512

C:\Users\Admin\AppData\Local\Temp\1000012001\amert.exe
"C:\Users\Admin\AppData\Local\Temp\1000012001\amert.exe"
3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:3580

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:4072

C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2996

C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4128

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
2⤵
- Loads dropped DLL
PID:4788

C:\Windows\system32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1716

C:\Windows\system32\netsh.exe
netsh wlan show profiles
4⤵
PID:228

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\777591257247_Desktop.zip' -CompressionLevel Optimal
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:248

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main
2⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:4236

C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5048

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
360B

MD5
3eb8703c404ccb8fc7b0e889f30f9075

SHA1
e63aee3ec1f0f514d7ef53c3d611b11d091683a2

SHA256
935a1eefdf6b387249647e702e64d76171341f0dd8b3d3a813a5d30db833a36d

SHA512
b0c425e62040f0173775b3cb5552e28536f24703fb9b204ad737f7736a11968d53d80ca9c2a294abbdb7d6947a6529513636de229582fa228cf158fbf79baca9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
3KB

MD5
db3bf5a846d2905831d3628fbf9edca0

SHA1
5c0e70550ec811f31f0cf6062055cac7524c8f20

SHA256
dbb9cb2681b7eae28c8ae21e271928bf7348046f3ac2e83e2421dc4b74789cc9

SHA512
dc0a5e9e446c3a5a928be24997c7abba1f9d0e65d24bca0396bb5e073d91a6eea141b80cc565794fb607c2ebc6d15cc48d49c8b1937e0d77c4fc2664c15b81ca

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
2KB

MD5
a570a9a3b23555d24ccee998ba0af1c9

SHA1
a231c1848bc3cf535fd5a695a47ea0eb7e4059eb

SHA256
ff7aaa0188e4c9edfa3655fd9db1d3c557e8bcbe9e25087b35ca39c8d010d76c

SHA512
18ccea694b8225d7d416eb229da95eebb4c8861e8b36137cabc1584d7ac517a1809aa7a58debaea5fe63ae7ef1c950486386dca5f7bae4d128a4c18a2b38daa2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
524B

MD5
01b4eff81a2203410022cc9333a71ff8

SHA1
ef81208ffa154b70698d72aed35fc3e8b8e401ff

SHA256
c37c0a683fd9d1536fb1e26f54ca9efd2185122385344a1250381e3634f5c65f

SHA512
6e98f5706f417322c797d779fef3f9a2b946e39f894a625cff645b087c1677e08f3a985288c19ed0beb0966f27200b3b05b2138fa2341ec971d0970ea285fc6c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
518B

MD5
17020e0a1b999bd8fb79350577376cf4

SHA1
bd8e56795658e49364ea0e8c6ed0c528bab00b29

SHA256
0e57b7ff5d5544484fed12942dee61fd29bc97c5e5220e5b82f6fbc043559f4f

SHA512
0acccd6511c14dcb2c8cd106d71b93a51a306407573223a0343473a91f4f09aff11413db7d730ad02d29f55fb6b52796103eede2acccf0f5437014d3a7356084

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
565b40a03f20def0505472f74de3bf2f

SHA1
c0ba7b111fba67aac41bf5ffd5234b55a9cd355a

SHA256
1f5fcccd77a7c259c77e1098a9369fa2255e0da8bbd79ef827d890ceb11f3618

SHA512
69b295db11d7b2de9f30cf78262baffa7ea485458d4ca6e4af53a63d8d08657c94db119081a4b7cb3f87e81b474a4d019598f0175b3311b24ae19869fc3c0697

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Filesize
16KB

MD5
c8759cdfdf8a36702de7cdf963764043

SHA1
fd5b3038f5d20fd79cd068f86e44f5a92f2793d9

SHA256
b3f9fba60a786734c43de4b30a35d764de76dd09fe08afbd1161f1e8e4b6986a

SHA512
49bd8a43cec8b4063995b2f2b36a57345aa8e2e60ebbb196eb2088f22ec5212c4a9f785a555695cb7514150f634e6c2d4bcde403427a2e643f349bb9f562b5cb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
252KB

MD5
8e11774fbfbdd05304cecd711caad408

SHA1
2508bc69bf1630905ae35b0a14105ae7dd492de6

SHA256
f3cf9fea094bdf2b7845ec0aa6008f771b14c19ab50bde654e943406298f8857

SHA512
2fb0059609b08f3ef8df6a0a1b482d71bd6436058b9f0b3def399a1614e1f38567926a1b098e54b29514e81efc61a52ba7ee52b136da5da6bb66f1818dc072ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000008001\2e9698eebd.exe
Filesize
1.1MB

MD5
857b7975dd9a0f76ad6fe9e3dc8be9af

SHA1
36a05855893916cc30c58dd4ddd6c768e4ba0c4c

SHA256
9a67ddcda5312fec555fcdb4bbd1b07ccf9216edce67666a137fe9976344f047

SHA512
d760afb7d491e82be1642a558e15107fb862b8aa3909c1612f7cddeab6a3e64fc705171ea767a02689f92f43d60b5cfa7ebf43552ad061bb7d1c1992ad377719

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000009001\9c18db7b69.exe
Filesize
2.3MB

MD5
eb0fef05fee1b8fa16139cd98d4fdba5

SHA1
c9017f9d7ae7c561e600ba65831ecfe4e187d729

SHA256
d6d06a32bf675c9b3077110afe5c4a4b2ad7c75c3ef7301cf3a498d5991684ad

SHA512
b66a38929dd191901d4cc5ac1530501612eef12c9c121c1d44cc9e20747c1649255c76b7c5853783aaac800d3c2b3acdaa2b2df328bceee2bfb6c585f66f0f3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000012001\amert.exe
Filesize
1.8MB

MD5
6f7acbf1b71aa4d9e4b12eda9fafad28

SHA1
659ddf3dcdf0fedaa9eb5bbd533f2d28ad9ab821

SHA256
13eda7140f4c70a33b6ad32b127a9c9765981cc02642fe032e910d99479a0bfc

SHA512
88f76cd5cbdd821a330bc801b89bddc0de329ea2a4763cbebcfcf3b9f6fd33d24446cc0c8ad0224e0ada2b58dc84c58b501249bd5b229d40bc88e74bb2422029

Download Submit
C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
Filesize
1.8MB

MD5
f8b5857ea950c83cd3bcb2d58986a489

SHA1
8f3a0a3783755c414abdbff3900823783e996436

SHA256
1bebb04cd216a1e16df87f944e655ec75593f03bad7c46d2bd078dd805e20811

SHA512
4372fb69677ee3d07b93d8e9e8bc642d150a6ced9a94734f1555a0f2989255fd9dd46fa6d0852793d9194b696b210f995065e60ab26c2ec59b9d88bd692141b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3wk4rkca.q5l.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll
Filesize
109KB

MD5
154c3f1334dd435f562672f2664fea6b

SHA1
51dd25e2ba98b8546de163b8f26e2972a90c2c79

SHA256
5f431129f97f3d56929f1e5584819e091bd6c854d7e18503074737fc6d79e33f

SHA512
1bca69bbcdb7ecd418769e9d4befc458f9f8e3cee81feb7316bb61e189e2904f4431e4cc7d291e179a5dec441b959d428d8e433f579036f763bbad6460222841

Download Submit
C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll
Filesize
1.2MB

MD5
f35b671fda2603ec30ace10946f11a90

SHA1
059ad6b06559d4db581b1879e709f32f80850872

SHA256
83e3df5bec15d5333935bea8b719a6d677e2fb3dc1cf9e18e7b82fd0438285c7

SHA512
b5fa27d08c64727cef7fdda5e68054a4359cd697df50d70d1d90da583195959a139066a6214531bbc5f20cd4f9bc1ca3e4244396547381291a6a1d2df9cf8705

Download Submit
\??\pipe\crashpad_2708_CKCOTIILCNAXVJNX
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1072-251-0x0000000000850000-0x0000000000CF8000-memory.dmp

Filesize
4.7MB

Download
memory/1072-168-0x0000000000850000-0x0000000000CF8000-memory.dmp

Filesize
4.7MB

Download
memory/1072-29-0x0000000005350000-0x0000000005351000-memory.dmp

Filesize
4KB

Download
memory/1072-26-0x00000000052F0000-0x00000000052F1000-memory.dmp

Filesize
4KB

Download
memory/1072-193-0x0000000000850000-0x0000000000CF8000-memory.dmp

Filesize
4.7MB

Download
memory/1072-27-0x0000000005320000-0x0000000005321000-memory.dmp

Filesize
4KB

Download
memory/1072-24-0x0000000005340000-0x0000000005341000-memory.dmp

Filesize
4KB

Download
memory/1072-320-0x0000000000850000-0x0000000000CF8000-memory.dmp

Filesize
4.7MB

Download
memory/1072-23-0x0000000005300000-0x0000000005301000-memory.dmp

Filesize
4KB

Download
memory/1072-28-0x0000000005360000-0x0000000005361000-memory.dmp

Filesize
4KB

Download
memory/1072-114-0x0000000000850000-0x0000000000CF8000-memory.dmp

Filesize
4.7MB

Download
memory/1072-249-0x0000000000850000-0x0000000000CF8000-memory.dmp

Filesize
4.7MB

Download
memory/1072-20-0x0000000000850000-0x0000000000CF8000-memory.dmp

Filesize
4.7MB

Download
memory/1072-129-0x0000000000850000-0x0000000000CF8000-memory.dmp

Filesize
4.7MB

Download
memory/1072-166-0x0000000000850000-0x0000000000CF8000-memory.dmp

Filesize
4.7MB

Download
memory/1072-224-0x0000000000850000-0x0000000000CF8000-memory.dmp

Filesize
4.7MB

Download
memory/1072-50-0x0000000000850000-0x0000000000CF8000-memory.dmp

Filesize
4.7MB

Download
memory/1072-101-0x0000000000850000-0x0000000000CF8000-memory.dmp

Filesize
4.7MB

Download
memory/1072-22-0x0000000005310000-0x0000000005311000-memory.dmp

Filesize
4KB

Download
memory/1072-184-0x0000000000850000-0x0000000000CF8000-memory.dmp

Filesize
4.7MB

Download
memory/1072-278-0x0000000000850000-0x0000000000CF8000-memory.dmp

Filesize
4.7MB

Download
memory/1072-266-0x0000000000850000-0x0000000000CF8000-memory.dmp

Filesize
4.7MB

Download
memory/1072-253-0x0000000000850000-0x0000000000CF8000-memory.dmp

Filesize
4.7MB

Download
memory/1072-25-0x00000000052E0000-0x00000000052E1000-memory.dmp

Filesize
4KB

Download
memory/1144-5-0x0000000004E20000-0x0000000004E21000-memory.dmp

Filesize
4KB

Download
memory/1144-4-0x0000000004E80000-0x0000000004E81000-memory.dmp

Filesize
4KB

Download
memory/1144-2-0x0000000004E50000-0x0000000004E51000-memory.dmp

Filesize
4KB

Download
memory/1144-7-0x0000000004EB0000-0x0000000004EB1000-memory.dmp

Filesize
4KB

Download
memory/1144-3-0x0000000004E40000-0x0000000004E41000-memory.dmp

Filesize
4KB

Download
memory/1144-8-0x0000000004EA0000-0x0000000004EA1000-memory.dmp

Filesize
4KB

Download
memory/1144-1-0x00000000777B6000-0x00000000777B8000-memory.dmp

Filesize
8KB

Download
memory/1144-21-0x0000000000B50000-0x0000000000FF8000-memory.dmp

Filesize
4.7MB

Download
memory/1144-6-0x0000000004E30000-0x0000000004E31000-memory.dmp

Filesize
4KB

Download
memory/1144-0-0x0000000000B50000-0x0000000000FF8000-memory.dmp

Filesize
4.7MB

Download
memory/2996-189-0x0000000004C00000-0x0000000004C01000-memory.dmp

Filesize
4KB

Download
memory/2996-190-0x0000000000850000-0x0000000000CF8000-memory.dmp

Filesize
4.7MB

Download
memory/2996-186-0x0000000004C10000-0x0000000004C11000-memory.dmp

Filesize
4KB

Download
memory/2996-185-0x0000000004C20000-0x0000000004C21000-memory.dmp

Filesize
4KB

Download
memory/2996-187-0x0000000004C50000-0x0000000004C51000-memory.dmp

Filesize
4KB

Download
memory/2996-183-0x0000000000850000-0x0000000000CF8000-memory.dmp

Filesize
4.7MB

Download
memory/2996-188-0x0000000004BF0000-0x0000000004BF1000-memory.dmp

Filesize
4KB

Download
memory/3580-219-0x0000000004EB0000-0x0000000004EB1000-memory.dmp

Filesize
4KB

Download
memory/3580-223-0x0000000000660000-0x0000000000B1C000-memory.dmp

Filesize
4.7MB

Download
memory/3580-214-0x0000000004E50000-0x0000000004E51000-memory.dmp

Filesize
4KB

Download
memory/3580-217-0x0000000004E40000-0x0000000004E41000-memory.dmp

Filesize
4KB

Download
memory/3580-208-0x0000000000660000-0x0000000000B1C000-memory.dmp

Filesize
4.7MB

Download
memory/3580-216-0x0000000004E30000-0x0000000004E31000-memory.dmp

Filesize
4KB

Download
memory/3580-211-0x0000000000660000-0x0000000000B1C000-memory.dmp

Filesize
4.7MB

Download
memory/3580-213-0x0000000004E70000-0x0000000004E71000-memory.dmp

Filesize
4KB

Download
memory/3580-215-0x0000000004E90000-0x0000000004E91000-memory.dmp

Filesize
4KB

Download
memory/3580-212-0x0000000004E60000-0x0000000004E61000-memory.dmp

Filesize
4KB

Download
memory/3632-254-0x0000000000AA0000-0x0000000001090000-memory.dmp

Filesize
5.9MB

Download
memory/3632-156-0x00000000050A0000-0x00000000050A1000-memory.dmp

Filesize
4KB

Download
memory/3632-167-0x0000000000AA0000-0x0000000001090000-memory.dmp

Filesize
5.9MB

Download
memory/3632-169-0x0000000000AA0000-0x0000000001090000-memory.dmp

Filesize
5.9MB

Download
memory/3632-191-0x0000000000AA0000-0x0000000001090000-memory.dmp

Filesize
5.9MB

Download
memory/3632-160-0x00000000050C0000-0x00000000050C2000-memory.dmp

Filesize
8KB

Download
memory/3632-159-0x0000000004FE0000-0x0000000004FE1000-memory.dmp

Filesize
4KB

Download
memory/3632-239-0x0000000000AA0000-0x0000000001090000-memory.dmp

Filesize
5.9MB

Download
memory/3632-157-0x0000000005030000-0x0000000005031000-memory.dmp

Filesize
4KB

Download
memory/3632-158-0x0000000005090000-0x0000000005091000-memory.dmp

Filesize
4KB

Download
memory/3632-250-0x0000000000AA0000-0x0000000001090000-memory.dmp

Filesize
5.9MB

Download
memory/3632-155-0x0000000005080000-0x0000000005081000-memory.dmp

Filesize
4KB

Download
memory/3632-252-0x0000000000AA0000-0x0000000001090000-memory.dmp

Filesize
5.9MB

Download
memory/3632-277-0x0000000000AA0000-0x0000000001090000-memory.dmp

Filesize
5.9MB

Download
memory/3632-179-0x0000000000AA0000-0x0000000001090000-memory.dmp

Filesize
5.9MB

Download
memory/3632-342-0x0000000000AA0000-0x0000000001090000-memory.dmp

Filesize
5.9MB

Download
memory/3632-148-0x0000000000AA0000-0x0000000001090000-memory.dmp

Filesize
5.9MB

Download
memory/3632-150-0x0000000005010000-0x0000000005011000-memory.dmp

Filesize
4KB

Download
memory/3632-149-0x0000000005040000-0x0000000005041000-memory.dmp

Filesize
4KB

Download
memory/3632-152-0x0000000005000000-0x0000000005001000-memory.dmp

Filesize
4KB

Download
memory/3632-298-0x0000000000AA0000-0x0000000001090000-memory.dmp

Filesize
5.9MB

Download
memory/3632-210-0x0000000000AA0000-0x0000000001090000-memory.dmp

Filesize
5.9MB

Download
memory/3632-151-0x0000000005070000-0x0000000005071000-memory.dmp

Filesize
4KB

Download
memory/3632-153-0x0000000004FF0000-0x0000000004FF1000-memory.dmp

Filesize
4KB

Download
memory/3632-154-0x0000000005050000-0x0000000005051000-memory.dmp

Filesize
4KB

Download
memory/4128-263-0x0000000005090000-0x0000000005091000-memory.dmp

Filesize
4KB

Download
memory/4128-262-0x00000000050F0000-0x00000000050F1000-memory.dmp

Filesize
4KB

Download
memory/4128-257-0x0000000000630000-0x0000000000AEC000-memory.dmp

Filesize
4.7MB

Download
memory/4128-258-0x0000000000630000-0x0000000000AEC000-memory.dmp

Filesize
4.7MB

Download
memory/4128-260-0x00000000050D0000-0x00000000050D1000-memory.dmp

Filesize
4KB

Download
memory/4128-269-0x0000000005110000-0x0000000005111000-memory.dmp

Filesize
4KB

Download
memory/4128-321-0x0000000000630000-0x0000000000AEC000-memory.dmp

Filesize
4.7MB

Download
memory/4128-261-0x00000000050B0000-0x00000000050B1000-memory.dmp

Filesize
4KB

Download
memory/4128-268-0x0000000005120000-0x0000000005121000-memory.dmp

Filesize
4KB

Download
memory/4128-259-0x00000000050C0000-0x00000000050C1000-memory.dmp

Filesize
4KB

Download
memory/4128-279-0x0000000000630000-0x0000000000AEC000-memory.dmp

Filesize
4.7MB

Download
memory/4128-264-0x00000000050A0000-0x00000000050A1000-memory.dmp

Filesize
4KB

Download
memory/5048-273-0x0000000004C00000-0x0000000004C01000-memory.dmp

Filesize
4KB

Download
memory/5048-267-0x0000000000850000-0x0000000000CF8000-memory.dmp

Filesize
4.7MB

Download
memory/5048-276-0x0000000000850000-0x0000000000CF8000-memory.dmp

Filesize
4.7MB

Download
memory/5048-274-0x0000000004BA0000-0x0000000004BA1000-memory.dmp

Filesize
4KB

Download
memory/5048-272-0x0000000004BC0000-0x0000000004BC1000-memory.dmp

Filesize
4KB

Download
memory/5048-271-0x0000000004BE0000-0x0000000004BE1000-memory.dmp

Filesize
4KB

Download
memory/5048-270-0x0000000004BD0000-0x0000000004BD1000-memory.dmp

Filesize
4KB

Download