Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
25-04-2024 09:33
Static task
static1
Behavioral task
behavioral1
Sample
85dbc28b7ff04c232303ffa7c137808f5c3b68e66a7468de579af70353308a72.exe
Resource
win10v2004-20240412-en
General
-
Target
85dbc28b7ff04c232303ffa7c137808f5c3b68e66a7468de579af70353308a72.exe
-
Size
1.8MB
-
MD5
bba1c618c48eef2f854048896e25d9c2
-
SHA1
9e3f25949de0c9f0d9e2826b6dbfcc03bad3e952
-
SHA256
85dbc28b7ff04c232303ffa7c137808f5c3b68e66a7468de579af70353308a72
-
SHA512
a967ee74ff57f8a73fa3f615f8ed1e88354c37543eda27b44d588fffddb2310b39db1317bc81c9ba20582e5060c73878022f4afa7db6f2c42fb129ea4bb923ca
-
SSDEEP
49152:w3/bndqglZa1lNVGSjNa6f0VQdQbIF29h94LZ:wjn4OU1rvNa6fTF2N4t
Malware Config
Extracted
amadey
4.20
http://193.233.132.139
-
install_dir
5454e6f062
-
install_file
explorta.exe
-
strings_key
c7a869c5ba1d72480093ec207994e2bf
-
url_paths
/sev56rkm/index.php
Extracted
amadey
4.17
http://193.233.132.167
-
install_dir
4d0ab15804
-
install_file
chrosha.exe
-
strings_key
1a9519d7b465e1f4880fa09a6162d768
-
url_paths
/enigma/index.php
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs
Processes:
85dbc28b7ff04c232303ffa7c137808f5c3b68e66a7468de579af70353308a72.exeexplorta.exeamert.exedea6c2af0f.exeexplorta.exechrosha.exeexplorta.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 85dbc28b7ff04c232303ffa7c137808f5c3b68e66a7468de579af70353308a72.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorta.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ amert.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ dea6c2af0f.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorta.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ chrosha.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorta.exe -
Blocklisted process makes network request 2 IoCs
Processes:
rundll32.exerundll32.exeflow pid process 106 6064 rundll32.exe 120 5000 rundll32.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 14 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
explorta.exeamert.exeexplorta.exeexplorta.exe85dbc28b7ff04c232303ffa7c137808f5c3b68e66a7468de579af70353308a72.exedea6c2af0f.exechrosha.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorta.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorta.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion amert.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion amert.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorta.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorta.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 85dbc28b7ff04c232303ffa7c137808f5c3b68e66a7468de579af70353308a72.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion dea6c2af0f.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorta.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion dea6c2af0f.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion chrosha.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorta.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 85dbc28b7ff04c232303ffa7c137808f5c3b68e66a7468de579af70353308a72.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion chrosha.exe -
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
explorta.exe0c53ab4f15.exechrosha.exe85dbc28b7ff04c232303ffa7c137808f5c3b68e66a7468de579af70353308a72.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation explorta.exe Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation 0c53ab4f15.exe Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation chrosha.exe Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation 85dbc28b7ff04c232303ffa7c137808f5c3b68e66a7468de579af70353308a72.exe -
Executes dropped EXE 7 IoCs
Processes:
explorta.exeamert.exe0c53ab4f15.exedea6c2af0f.exeexplorta.exechrosha.exeexplorta.exepid process 3488 explorta.exe 4336 amert.exe 2676 0c53ab4f15.exe 4072 dea6c2af0f.exe 5568 explorta.exe 5548 chrosha.exe 1736 explorta.exe -
Identifies Wine through registry keys 2 TTPs 7 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
85dbc28b7ff04c232303ffa7c137808f5c3b68e66a7468de579af70353308a72.exeexplorta.exeamert.exedea6c2af0f.exeexplorta.exechrosha.exeexplorta.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Software\Wine 85dbc28b7ff04c232303ffa7c137808f5c3b68e66a7468de579af70353308a72.exe Key opened \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Software\Wine explorta.exe Key opened \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Software\Wine amert.exe Key opened \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Software\Wine dea6c2af0f.exe Key opened \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Software\Wine explorta.exe Key opened \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Software\Wine chrosha.exe Key opened \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Software\Wine explorta.exe -
Loads dropped DLL 3 IoCs
Processes:
rundll32.exerundll32.exerundll32.exepid process 2516 rundll32.exe 6064 rundll32.exe 5000 rundll32.exe -
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorta.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\0c53ab4f15.exe = "C:\\Users\\Admin\\1000013002\\0c53ab4f15.exe" explorta.exe Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dea6c2af0f.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000014001\\dea6c2af0f.exe" explorta.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule C:\Users\Admin\1000013002\0c53ab4f15.exe autoit_exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
Processes:
85dbc28b7ff04c232303ffa7c137808f5c3b68e66a7468de579af70353308a72.exeexplorta.exeamert.exedea6c2af0f.exechrosha.exeexplorta.exeexplorta.exepid process 4904 85dbc28b7ff04c232303ffa7c137808f5c3b68e66a7468de579af70353308a72.exe 3488 explorta.exe 4336 amert.exe 4072 dea6c2af0f.exe 5548 chrosha.exe 5568 explorta.exe 1736 explorta.exe -
Drops file in Windows directory 2 IoCs
Processes:
85dbc28b7ff04c232303ffa7c137808f5c3b68e66a7468de579af70353308a72.exeamert.exedescription ioc process File created C:\Windows\Tasks\explorta.job 85dbc28b7ff04c232303ffa7c137808f5c3b68e66a7468de579af70353308a72.exe File created C:\Windows\Tasks\chrosha.job amert.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133585112124174824" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Modifies registry class 1 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4084619521-2220719027-1909462854-1000\{C5A92AAC-A3DE-45B9-92A6-303E0B9499EB} chrome.exe -
Suspicious behavior: EnumeratesProcesses 32 IoCs
Processes:
85dbc28b7ff04c232303ffa7c137808f5c3b68e66a7468de579af70353308a72.exeexplorta.exeamert.exechrome.exedea6c2af0f.exechrosha.exeexplorta.exerundll32.exepowershell.exeexplorta.exechrome.exepid process 4904 85dbc28b7ff04c232303ffa7c137808f5c3b68e66a7468de579af70353308a72.exe 4904 85dbc28b7ff04c232303ffa7c137808f5c3b68e66a7468de579af70353308a72.exe 3488 explorta.exe 3488 explorta.exe 4336 amert.exe 4336 amert.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 4072 dea6c2af0f.exe 4072 dea6c2af0f.exe 5548 chrosha.exe 5548 chrosha.exe 5568 explorta.exe 5568 explorta.exe 6064 rundll32.exe 6064 rundll32.exe 6064 rundll32.exe 6064 rundll32.exe 6064 rundll32.exe 6064 rundll32.exe 6064 rundll32.exe 6064 rundll32.exe 6064 rundll32.exe 6064 rundll32.exe 5232 powershell.exe 5232 powershell.exe 5232 powershell.exe 1736 explorta.exe 1736 explorta.exe 2252 chrome.exe 2252 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
Processes:
chrome.exepid process 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 2556 chrome.exe Token: SeCreatePagefilePrivilege 2556 chrome.exe Token: SeShutdownPrivilege 2556 chrome.exe Token: SeCreatePagefilePrivilege 2556 chrome.exe Token: SeShutdownPrivilege 2556 chrome.exe Token: SeCreatePagefilePrivilege 2556 chrome.exe Token: SeShutdownPrivilege 2556 chrome.exe Token: SeCreatePagefilePrivilege 2556 chrome.exe Token: SeShutdownPrivilege 2556 chrome.exe Token: SeCreatePagefilePrivilege 2556 chrome.exe Token: SeShutdownPrivilege 2556 chrome.exe Token: SeCreatePagefilePrivilege 2556 chrome.exe Token: SeShutdownPrivilege 2556 chrome.exe Token: SeCreatePagefilePrivilege 2556 chrome.exe Token: SeShutdownPrivilege 2556 chrome.exe Token: SeCreatePagefilePrivilege 2556 chrome.exe Token: SeShutdownPrivilege 2556 chrome.exe Token: SeCreatePagefilePrivilege 2556 chrome.exe Token: SeShutdownPrivilege 2556 chrome.exe Token: SeCreatePagefilePrivilege 2556 chrome.exe Token: SeShutdownPrivilege 2556 chrome.exe Token: SeCreatePagefilePrivilege 2556 chrome.exe Token: SeShutdownPrivilege 2556 chrome.exe Token: SeCreatePagefilePrivilege 2556 chrome.exe Token: SeShutdownPrivilege 2556 chrome.exe Token: SeCreatePagefilePrivilege 2556 chrome.exe Token: SeShutdownPrivilege 2556 chrome.exe Token: SeCreatePagefilePrivilege 2556 chrome.exe Token: SeShutdownPrivilege 2556 chrome.exe Token: SeCreatePagefilePrivilege 2556 chrome.exe Token: SeShutdownPrivilege 2556 chrome.exe Token: SeCreatePagefilePrivilege 2556 chrome.exe Token: SeShutdownPrivilege 2556 chrome.exe Token: SeCreatePagefilePrivilege 2556 chrome.exe Token: SeShutdownPrivilege 2556 chrome.exe Token: SeCreatePagefilePrivilege 2556 chrome.exe Token: SeShutdownPrivilege 2556 chrome.exe Token: SeCreatePagefilePrivilege 2556 chrome.exe Token: SeShutdownPrivilege 2556 chrome.exe Token: SeCreatePagefilePrivilege 2556 chrome.exe Token: SeShutdownPrivilege 2556 chrome.exe Token: SeCreatePagefilePrivilege 2556 chrome.exe Token: SeShutdownPrivilege 2556 chrome.exe Token: SeCreatePagefilePrivilege 2556 chrome.exe Token: SeShutdownPrivilege 2556 chrome.exe Token: SeCreatePagefilePrivilege 2556 chrome.exe Token: SeShutdownPrivilege 2556 chrome.exe Token: SeCreatePagefilePrivilege 2556 chrome.exe Token: SeShutdownPrivilege 2556 chrome.exe Token: SeCreatePagefilePrivilege 2556 chrome.exe Token: SeShutdownPrivilege 2556 chrome.exe Token: SeCreatePagefilePrivilege 2556 chrome.exe Token: SeShutdownPrivilege 2556 chrome.exe Token: SeCreatePagefilePrivilege 2556 chrome.exe Token: SeShutdownPrivilege 2556 chrome.exe Token: SeCreatePagefilePrivilege 2556 chrome.exe Token: SeShutdownPrivilege 2556 chrome.exe Token: SeCreatePagefilePrivilege 2556 chrome.exe Token: SeShutdownPrivilege 2556 chrome.exe Token: SeCreatePagefilePrivilege 2556 chrome.exe Token: SeShutdownPrivilege 2556 chrome.exe Token: SeCreatePagefilePrivilege 2556 chrome.exe Token: SeShutdownPrivilege 2556 chrome.exe Token: SeCreatePagefilePrivilege 2556 chrome.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
85dbc28b7ff04c232303ffa7c137808f5c3b68e66a7468de579af70353308a72.exe0c53ab4f15.exechrome.exepid process 4904 85dbc28b7ff04c232303ffa7c137808f5c3b68e66a7468de579af70353308a72.exe 2676 0c53ab4f15.exe 2676 0c53ab4f15.exe 2676 0c53ab4f15.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2676 0c53ab4f15.exe 2676 0c53ab4f15.exe 2556 chrome.exe 2676 0c53ab4f15.exe 2676 0c53ab4f15.exe 2676 0c53ab4f15.exe 2676 0c53ab4f15.exe 2676 0c53ab4f15.exe 2676 0c53ab4f15.exe 2676 0c53ab4f15.exe 2676 0c53ab4f15.exe 2676 0c53ab4f15.exe 2676 0c53ab4f15.exe 2676 0c53ab4f15.exe 2676 0c53ab4f15.exe 2676 0c53ab4f15.exe 2676 0c53ab4f15.exe 2676 0c53ab4f15.exe 2676 0c53ab4f15.exe 2676 0c53ab4f15.exe 2676 0c53ab4f15.exe 2676 0c53ab4f15.exe 2676 0c53ab4f15.exe 2676 0c53ab4f15.exe 2676 0c53ab4f15.exe 2676 0c53ab4f15.exe 2676 0c53ab4f15.exe 2676 0c53ab4f15.exe 2676 0c53ab4f15.exe 2676 0c53ab4f15.exe 2676 0c53ab4f15.exe 2676 0c53ab4f15.exe 2676 0c53ab4f15.exe 2676 0c53ab4f15.exe -
Suspicious use of SendNotifyMessage 60 IoCs
Processes:
0c53ab4f15.exechrome.exepid process 2676 0c53ab4f15.exe 2676 0c53ab4f15.exe 2676 0c53ab4f15.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2676 0c53ab4f15.exe 2676 0c53ab4f15.exe 2676 0c53ab4f15.exe 2676 0c53ab4f15.exe 2676 0c53ab4f15.exe 2676 0c53ab4f15.exe 2676 0c53ab4f15.exe 2676 0c53ab4f15.exe 2676 0c53ab4f15.exe 2676 0c53ab4f15.exe 2676 0c53ab4f15.exe 2676 0c53ab4f15.exe 2676 0c53ab4f15.exe 2676 0c53ab4f15.exe 2676 0c53ab4f15.exe 2676 0c53ab4f15.exe 2676 0c53ab4f15.exe 2676 0c53ab4f15.exe 2676 0c53ab4f15.exe 2676 0c53ab4f15.exe 2676 0c53ab4f15.exe 2676 0c53ab4f15.exe 2676 0c53ab4f15.exe 2676 0c53ab4f15.exe 2676 0c53ab4f15.exe 2676 0c53ab4f15.exe 2676 0c53ab4f15.exe 2676 0c53ab4f15.exe 2676 0c53ab4f15.exe 2676 0c53ab4f15.exe 2676 0c53ab4f15.exe 2676 0c53ab4f15.exe 2676 0c53ab4f15.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
85dbc28b7ff04c232303ffa7c137808f5c3b68e66a7468de579af70353308a72.exeexplorta.exe0c53ab4f15.exechrome.exedescription pid process target process PID 4904 wrote to memory of 3488 4904 85dbc28b7ff04c232303ffa7c137808f5c3b68e66a7468de579af70353308a72.exe explorta.exe PID 4904 wrote to memory of 3488 4904 85dbc28b7ff04c232303ffa7c137808f5c3b68e66a7468de579af70353308a72.exe explorta.exe PID 4904 wrote to memory of 3488 4904 85dbc28b7ff04c232303ffa7c137808f5c3b68e66a7468de579af70353308a72.exe explorta.exe PID 3488 wrote to memory of 2224 3488 explorta.exe explorta.exe PID 3488 wrote to memory of 2224 3488 explorta.exe explorta.exe PID 3488 wrote to memory of 2224 3488 explorta.exe explorta.exe PID 3488 wrote to memory of 4336 3488 explorta.exe amert.exe PID 3488 wrote to memory of 4336 3488 explorta.exe amert.exe PID 3488 wrote to memory of 4336 3488 explorta.exe amert.exe PID 3488 wrote to memory of 2676 3488 explorta.exe 0c53ab4f15.exe PID 3488 wrote to memory of 2676 3488 explorta.exe 0c53ab4f15.exe PID 3488 wrote to memory of 2676 3488 explorta.exe 0c53ab4f15.exe PID 2676 wrote to memory of 2556 2676 0c53ab4f15.exe chrome.exe PID 2676 wrote to memory of 2556 2676 0c53ab4f15.exe chrome.exe PID 2556 wrote to memory of 3144 2556 chrome.exe chrome.exe PID 2556 wrote to memory of 3144 2556 chrome.exe chrome.exe PID 2556 wrote to memory of 3032 2556 chrome.exe chrome.exe PID 2556 wrote to memory of 3032 2556 chrome.exe chrome.exe PID 2556 wrote to memory of 3032 2556 chrome.exe chrome.exe PID 2556 wrote to memory of 3032 2556 chrome.exe chrome.exe PID 2556 wrote to memory of 3032 2556 chrome.exe chrome.exe PID 2556 wrote to memory of 3032 2556 chrome.exe chrome.exe PID 2556 wrote to memory of 3032 2556 chrome.exe chrome.exe PID 2556 wrote to memory of 3032 2556 chrome.exe chrome.exe PID 2556 wrote to memory of 3032 2556 chrome.exe chrome.exe PID 2556 wrote to memory of 3032 2556 chrome.exe chrome.exe PID 2556 wrote to memory of 3032 2556 chrome.exe chrome.exe PID 2556 wrote to memory of 3032 2556 chrome.exe chrome.exe PID 2556 wrote to memory of 3032 2556 chrome.exe chrome.exe PID 2556 wrote to memory of 3032 2556 chrome.exe chrome.exe PID 2556 wrote to memory of 3032 2556 chrome.exe chrome.exe PID 2556 wrote to memory of 3032 2556 chrome.exe chrome.exe PID 2556 wrote to memory of 3032 2556 chrome.exe chrome.exe PID 2556 wrote to memory of 3032 2556 chrome.exe chrome.exe PID 2556 wrote to memory of 3032 2556 chrome.exe chrome.exe PID 2556 wrote to memory of 3032 2556 chrome.exe chrome.exe PID 2556 wrote to memory of 3032 2556 chrome.exe chrome.exe PID 2556 wrote to memory of 3032 2556 chrome.exe chrome.exe PID 2556 wrote to memory of 3032 2556 chrome.exe chrome.exe PID 2556 wrote to memory of 3032 2556 chrome.exe chrome.exe PID 2556 wrote to memory of 3032 2556 chrome.exe chrome.exe PID 2556 wrote to memory of 3032 2556 chrome.exe chrome.exe PID 2556 wrote to memory of 3032 2556 chrome.exe chrome.exe PID 2556 wrote to memory of 3032 2556 chrome.exe chrome.exe PID 2556 wrote to memory of 3032 2556 chrome.exe chrome.exe PID 2556 wrote to memory of 3032 2556 chrome.exe chrome.exe PID 2556 wrote to memory of 3032 2556 chrome.exe chrome.exe PID 2556 wrote to memory of 1016 2556 chrome.exe chrome.exe PID 2556 wrote to memory of 1016 2556 chrome.exe chrome.exe PID 2556 wrote to memory of 4124 2556 chrome.exe chrome.exe PID 2556 wrote to memory of 4124 2556 chrome.exe chrome.exe PID 2556 wrote to memory of 4124 2556 chrome.exe chrome.exe PID 2556 wrote to memory of 4124 2556 chrome.exe chrome.exe PID 2556 wrote to memory of 4124 2556 chrome.exe chrome.exe PID 2556 wrote to memory of 4124 2556 chrome.exe chrome.exe PID 2556 wrote to memory of 4124 2556 chrome.exe chrome.exe PID 2556 wrote to memory of 4124 2556 chrome.exe chrome.exe PID 2556 wrote to memory of 4124 2556 chrome.exe chrome.exe PID 2556 wrote to memory of 4124 2556 chrome.exe chrome.exe PID 2556 wrote to memory of 4124 2556 chrome.exe chrome.exe PID 2556 wrote to memory of 4124 2556 chrome.exe chrome.exe PID 2556 wrote to memory of 4124 2556 chrome.exe chrome.exe PID 2556 wrote to memory of 4124 2556 chrome.exe chrome.exe PID 2556 wrote to memory of 4124 2556 chrome.exe chrome.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\85dbc28b7ff04c232303ffa7c137808f5c3b68e66a7468de579af70353308a72.exe"C:\Users\Admin\AppData\Local\Temp\85dbc28b7ff04c232303ffa7c137808f5c3b68e66a7468de579af70353308a72.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe"C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe"C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\1000012001\amert.exe"C:\Users\Admin\AppData\Local\Temp\1000012001\amert.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\1000013002\0c53ab4f15.exe"C:\Users\Admin\1000013002\0c53ab4f15.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account4⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9b83bab58,0x7ff9b83bab68,0x7ff9b83bab785⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1668 --field-trial-handle=1796,i,14118716387547340888,10565851076614920971,131072 /prefetch:25⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 --field-trial-handle=1796,i,14118716387547340888,10565851076614920971,131072 /prefetch:85⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2236 --field-trial-handle=1796,i,14118716387547340888,10565851076614920971,131072 /prefetch:85⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3088 --field-trial-handle=1796,i,14118716387547340888,10565851076614920971,131072 /prefetch:15⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3112 --field-trial-handle=1796,i,14118716387547340888,10565851076614920971,131072 /prefetch:15⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4320 --field-trial-handle=1796,i,14118716387547340888,10565851076614920971,131072 /prefetch:15⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3112 --field-trial-handle=1796,i,14118716387547340888,10565851076614920971,131072 /prefetch:15⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4500 --field-trial-handle=1796,i,14118716387547340888,10565851076614920971,131072 /prefetch:85⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4516 --field-trial-handle=1796,i,14118716387547340888,10565851076614920971,131072 /prefetch:85⤵
- Modifies registry class
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4884 --field-trial-handle=1796,i,14118716387547340888,10565851076614920971,131072 /prefetch:85⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5016 --field-trial-handle=1796,i,14118716387547340888,10565851076614920971,131072 /prefetch:85⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 --field-trial-handle=1796,i,14118716387547340888,10565851076614920971,131072 /prefetch:85⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1148 --field-trial-handle=1796,i,14118716387547340888,10565851076614920971,131072 /prefetch:25⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1000014001\dea6c2af0f.exe"C:\Users\Admin\AppData\Local\Temp\1000014001\dea6c2af0f.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exeC:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main2⤵
- Loads dropped DLL
-
C:\Windows\system32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\netsh.exenetsh wlan show profiles4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\084619521222_Desktop.zip' -CompressionLevel Optimal4⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main2⤵
- Blocklisted process makes network request
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exeC:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exeC:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Unsecured Credentials
3Credentials In Files
2Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\1000013002\0c53ab4f15.exeFilesize
1.1MB
MD5b389fc390a9823fcd7616ca5a1b1d69a
SHA1ad3370064a99e05a0eb9f003372c369806aaf4e8
SHA256e917990d683c2612de30e73634c2a99075aa0b95ddbc77653167b86df44adf49
SHA512c2599a05fa6fa476058ad6e3f043bc478f65d9c837961f61e8ffa6366637900b9bfb42fba2e0100583f69989689d55ed19a155cea6a474255e17d84e0dbdcb32
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
336B
MD57d7b7e2753ae599b6e6a51d3347913b4
SHA135d484e626a6b01c1450f2f88df1538de24d48a8
SHA25677efd8041f632180c31becf35f9ca657ff88941f13945a9317773bbf8639684b
SHA51239def291ad6306a7eb34bab873bd763cef77924dfedaa4ab6b4efc47124fd73ee64867ca9872270fe0b91b8167f1d4c88f42a8169524f23527e711f17fb0ddf6
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
2KB
MD596a6ed290a1bebb8f7ee4f5007116869
SHA1e6c173a08d090c14afca01c48b003350a9c66c91
SHA256b74c3f63a4ccd0954734ab418051a56ab12a48c09b264016ff0e93b84bad3ddb
SHA5129bc77b8a2233bd496181929b21d115b815a69889926f61ea5286d195c3df05992e67f330d3ec12f7e059dec9f5a4471e1545558deb74ea225ea363e6bcbeb618
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
2KB
MD513d6d291995cfc29275455730c6a9438
SHA13d06eeab9d3a7f9f77ee27eb4db861a413c56080
SHA2560cf82cd60d73fe6e1ca3d3c5218185014c0326d56f18f93f391480c43e5529d8
SHA51249f2d1ba25d2e6a437205a42412e8ef9c8c53de09032626981dba61f40c4af2edbc9d29d5f3d9991244f04319fdf2a5506ef8c986cac1ceb5e272aea33ffcfcf
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending ReportsFilesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
524B
MD5e165da09378990050ac01ef7b78bed09
SHA1e9f292ca90bcb4cc6828efd6b150f84a50ae4170
SHA25626ae56464e19390c80b53155b600fb355db0c67d0128fcd3929671b8143ee905
SHA51293ea446609f10e1eb779d6109cf88c98fe9e5256d807c479d607b1ec3e886028bc7658039d5b47183c0e77950c947f1badfd810b92652e8ebb52706c6c4065d9
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
524B
MD5ff8585bdf6d09f6b4072537f8a1fa991
SHA1553708afdbb6589e3bc9f393800609816ca8464a
SHA256d92464077b71a062aedd4186a6317eb44daae212355e02d4dd634fe914beb139
SHA512abb1cc789cdb9e22d18406ac6161385da745cf204ef0edc03d9a995bcdacbd07807d99c7dc7461a4e16c8981e5eb48f6cfc3f0f9538b82a81961b52dde0369a1
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
7KB
MD5d7fc95d0b1c624f2fd06ee2f6b717b54
SHA17e685f419cbae7d37f09031be67d63ba46c530e7
SHA25686cb115de4f225b4c1fe661cfa02e80522f4939cd5f52e0563e3ba3bc600fd7d
SHA512a96cd31db665cc21ff62899d83cc6b812f7f777417339acfc438ad282bd6866906740b0bcb031e9fe170d2df0a7e97262cf117cbeb668c999a7621ea1884d105
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure PreferencesFilesize
16KB
MD548c63cef9f717838c90d7a2ce00402ee
SHA19bde58f519f6508efdf61a7b925a767d008dc19f
SHA2563d144e0bd5ede0b07cf0ee8391c56e9e5c643c7a753654fe90558978d5e3473d
SHA5127216fa73ac7acb8d67c39abda8a2da06240ddfc1650c2519c7d0e17819bd4f04c7e01cf3515ee95740c0cba032932300803baa3336bcc273f84b5c2e3aa67274
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
253KB
MD5098df8170d66ef8a98ee5b5bb6041f3e
SHA120099330945f8fd64dce9543b4d5165646fbe3a2
SHA2560222186ed0e90fbfd340bcb058d2beaf5526c2244a76a9cbbf0f75348fab36d8
SHA512e6cae175b9682e07ef69aaba89e9513bc9b13ccbaff4d91d456cdb821b4a510e993fb30acad81ae954649bc1f72eba6e8b42473c6a10e0e1146d6fde1b42afa8
-
C:\Users\Admin\AppData\Local\Temp\1000012001\amert.exeFilesize
1.8MB
MD548092fd8d9aa612805c3e4e1234030aa
SHA19fa41c8d302730f4e0c2188c9b87166949ce42d2
SHA2568b9067a4e5774c54722808e056cc5f1bbcee0852f6574c7e85c6bc38be575fda
SHA5121ff6933ca34796322651b4dee998be93edc7714d6d3c1c066583253eb3dc5dc13e7e63eaebfe3556f5106586c68ba8385793d195c44b321aff2c0b56659787bc
-
C:\Users\Admin\AppData\Local\Temp\1000014001\dea6c2af0f.exeFilesize
2.3MB
MD5fc80488b06fca858884237733932cfcd
SHA1c44ad80e1b7f9d32b6bfa8c1dff9682b7039867d
SHA256d0b26d920204146c943fb05df421124416301b085f6e029e205bf468cead37f0
SHA512851dd20a318b108bf363d6731afa629fcd1cb6ee8cc096fa1a98ba881e7924fbe4cac44ea36674c0835b8a0c9f539150dccc7f1922e7201941e5ad36c19b04ed
-
C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exeFilesize
1.8MB
MD5bba1c618c48eef2f854048896e25d9c2
SHA19e3f25949de0c9f0d9e2826b6dbfcc03bad3e952
SHA25685dbc28b7ff04c232303ffa7c137808f5c3b68e66a7468de579af70353308a72
SHA512a967ee74ff57f8a73fa3f615f8ed1e88354c37543eda27b44d588fffddb2310b39db1317bc81c9ba20582e5060c73878022f4afa7db6f2c42fb129ea4bb923ca
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_olcpiai1.4qz.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dllFilesize
109KB
MD5154c3f1334dd435f562672f2664fea6b
SHA151dd25e2ba98b8546de163b8f26e2972a90c2c79
SHA2565f431129f97f3d56929f1e5584819e091bd6c854d7e18503074737fc6d79e33f
SHA5121bca69bbcdb7ecd418769e9d4befc458f9f8e3cee81feb7316bb61e189e2904f4431e4cc7d291e179a5dec441b959d428d8e433f579036f763bbad6460222841
-
C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dllFilesize
1.2MB
MD5f35b671fda2603ec30ace10946f11a90
SHA1059ad6b06559d4db581b1879e709f32f80850872
SHA25683e3df5bec15d5333935bea8b719a6d677e2fb3dc1cf9e18e7b82fd0438285c7
SHA512b5fa27d08c64727cef7fdda5e68054a4359cd697df50d70d1d90da583195959a139066a6214531bbc5f20cd4f9bc1ca3e4244396547381291a6a1d2df9cf8705
-
\??\pipe\crashpad_2556_UZAVDQMLGUVYCYXVMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/1736-329-0x0000000000580000-0x0000000000A15000-memory.dmpFilesize
4.6MB
-
memory/3488-272-0x0000000000580000-0x0000000000A15000-memory.dmpFilesize
4.6MB
-
memory/3488-164-0x0000000000580000-0x0000000000A15000-memory.dmpFilesize
4.6MB
-
memory/3488-30-0x0000000004A90000-0x0000000004A91000-memory.dmpFilesize
4KB
-
memory/3488-28-0x0000000004A70000-0x0000000004A71000-memory.dmpFilesize
4KB
-
memory/3488-356-0x0000000000580000-0x0000000000A15000-memory.dmpFilesize
4.6MB
-
memory/3488-344-0x0000000000580000-0x0000000000A15000-memory.dmpFilesize
4.6MB
-
memory/3488-335-0x0000000000580000-0x0000000000A15000-memory.dmpFilesize
4.6MB
-
memory/3488-333-0x0000000000580000-0x0000000000A15000-memory.dmpFilesize
4.6MB
-
memory/3488-330-0x0000000000580000-0x0000000000A15000-memory.dmpFilesize
4.6MB
-
memory/3488-317-0x0000000000580000-0x0000000000A15000-memory.dmpFilesize
4.6MB
-
memory/3488-314-0x0000000000580000-0x0000000000A15000-memory.dmpFilesize
4.6MB
-
memory/3488-29-0x0000000004AA0000-0x0000000004AA1000-memory.dmpFilesize
4KB
-
memory/3488-286-0x0000000000580000-0x0000000000A15000-memory.dmpFilesize
4.6MB
-
memory/3488-26-0x0000000004A20000-0x0000000004A21000-memory.dmpFilesize
4KB
-
memory/3488-234-0x0000000000580000-0x0000000000A15000-memory.dmpFilesize
4.6MB
-
memory/3488-220-0x0000000000580000-0x0000000000A15000-memory.dmpFilesize
4.6MB
-
memory/3488-78-0x0000000000580000-0x0000000000A15000-memory.dmpFilesize
4.6MB
-
memory/3488-200-0x0000000000580000-0x0000000000A15000-memory.dmpFilesize
4.6MB
-
memory/3488-27-0x0000000004A30000-0x0000000004A31000-memory.dmpFilesize
4KB
-
memory/3488-25-0x0000000004A80000-0x0000000004A81000-memory.dmpFilesize
4KB
-
memory/3488-24-0x0000000004A40000-0x0000000004A41000-memory.dmpFilesize
4KB
-
memory/3488-20-0x0000000000580000-0x0000000000A15000-memory.dmpFilesize
4.6MB
-
memory/3488-185-0x0000000000580000-0x0000000000A15000-memory.dmpFilesize
4.6MB
-
memory/3488-22-0x0000000004A50000-0x0000000004A51000-memory.dmpFilesize
4KB
-
memory/3488-23-0x0000000004A60000-0x0000000004A61000-memory.dmpFilesize
4KB
-
memory/4072-287-0x00000000001E0000-0x00000000007B8000-memory.dmpFilesize
5.8MB
-
memory/4072-232-0x00000000001E0000-0x00000000007B8000-memory.dmpFilesize
5.8MB
-
memory/4072-153-0x0000000004C20000-0x0000000004C21000-memory.dmpFilesize
4KB
-
memory/4072-146-0x0000000004BD0000-0x0000000004BD1000-memory.dmpFilesize
4KB
-
memory/4072-154-0x0000000004BA0000-0x0000000004BA1000-memory.dmpFilesize
4KB
-
memory/4072-155-0x0000000004BC0000-0x0000000004BC1000-memory.dmpFilesize
4KB
-
memory/4072-157-0x0000000004B70000-0x0000000004B71000-memory.dmpFilesize
4KB
-
memory/4072-158-0x0000000004C40000-0x0000000004C42000-memory.dmpFilesize
8KB
-
memory/4072-150-0x0000000004BE0000-0x0000000004BE1000-memory.dmpFilesize
4KB
-
memory/4072-149-0x0000000004B80000-0x0000000004B81000-memory.dmpFilesize
4KB
-
memory/4072-148-0x0000000004C00000-0x0000000004C01000-memory.dmpFilesize
4KB
-
memory/4072-354-0x00000000001E0000-0x00000000007B8000-memory.dmpFilesize
5.8MB
-
memory/4072-182-0x00000000001E0000-0x00000000007B8000-memory.dmpFilesize
5.8MB
-
memory/4072-147-0x0000000004B90000-0x0000000004B91000-memory.dmpFilesize
4KB
-
memory/4072-137-0x00000000001E0000-0x00000000007B8000-memory.dmpFilesize
5.8MB
-
memory/4072-193-0x00000000001E0000-0x00000000007B8000-memory.dmpFilesize
5.8MB
-
memory/4072-194-0x00000000001E0000-0x00000000007B8000-memory.dmpFilesize
5.8MB
-
memory/4072-342-0x00000000001E0000-0x00000000007B8000-memory.dmpFilesize
5.8MB
-
memory/4072-334-0x00000000001E0000-0x00000000007B8000-memory.dmpFilesize
5.8MB
-
memory/4072-204-0x00000000001E0000-0x00000000007B8000-memory.dmpFilesize
5.8MB
-
memory/4072-331-0x00000000001E0000-0x00000000007B8000-memory.dmpFilesize
5.8MB
-
memory/4072-318-0x00000000001E0000-0x00000000007B8000-memory.dmpFilesize
5.8MB
-
memory/4072-315-0x00000000001E0000-0x00000000007B8000-memory.dmpFilesize
5.8MB
-
memory/4072-152-0x0000000004C10000-0x0000000004C11000-memory.dmpFilesize
4KB
-
memory/4072-303-0x00000000001E0000-0x00000000007B8000-memory.dmpFilesize
5.8MB
-
memory/4072-271-0x00000000001E0000-0x00000000007B8000-memory.dmpFilesize
5.8MB
-
memory/4336-54-0x0000000005240000-0x0000000005241000-memory.dmpFilesize
4KB
-
memory/4336-75-0x00000000052B0000-0x00000000052B1000-memory.dmpFilesize
4KB
-
memory/4336-48-0x0000000000E70000-0x0000000001323000-memory.dmpFilesize
4.7MB
-
memory/4336-49-0x0000000000E70000-0x0000000001323000-memory.dmpFilesize
4.7MB
-
memory/4336-50-0x0000000005260000-0x0000000005261000-memory.dmpFilesize
4KB
-
memory/4336-83-0x0000000000E70000-0x0000000001323000-memory.dmpFilesize
4.7MB
-
memory/4336-51-0x0000000005250000-0x0000000005251000-memory.dmpFilesize
4KB
-
memory/4336-52-0x0000000005290000-0x0000000005291000-memory.dmpFilesize
4KB
-
memory/4336-53-0x0000000005230000-0x0000000005231000-memory.dmpFilesize
4KB
-
memory/4336-76-0x00000000052A0000-0x00000000052A1000-memory.dmpFilesize
4KB
-
memory/4336-55-0x0000000005270000-0x0000000005271000-memory.dmpFilesize
4KB
-
memory/4336-56-0x0000000005280000-0x0000000005281000-memory.dmpFilesize
4KB
-
memory/4904-4-0x0000000004E30000-0x0000000004E31000-memory.dmpFilesize
4KB
-
memory/4904-2-0x0000000004E40000-0x0000000004E41000-memory.dmpFilesize
4KB
-
memory/4904-21-0x00000000003A0000-0x0000000000835000-memory.dmpFilesize
4.6MB
-
memory/4904-7-0x0000000004E20000-0x0000000004E21000-memory.dmpFilesize
4KB
-
memory/4904-1-0x00000000771D4000-0x00000000771D6000-memory.dmpFilesize
8KB
-
memory/4904-6-0x0000000004E10000-0x0000000004E11000-memory.dmpFilesize
4KB
-
memory/4904-8-0x0000000004E90000-0x0000000004E91000-memory.dmpFilesize
4KB
-
memory/4904-0-0x00000000003A0000-0x0000000000835000-memory.dmpFilesize
4.6MB
-
memory/4904-3-0x0000000004E50000-0x0000000004E51000-memory.dmpFilesize
4KB
-
memory/4904-5-0x0000000004E70000-0x0000000004E71000-memory.dmpFilesize
4KB
-
memory/5232-248-0x000001D77F160000-0x000001D77F182000-memory.dmpFilesize
136KB
-
memory/5232-249-0x00007FF9B4C60000-0x00007FF9B5721000-memory.dmpFilesize
10.8MB
-
memory/5232-250-0x000001D77F1D0000-0x000001D77F1E0000-memory.dmpFilesize
64KB
-
memory/5548-207-0x0000000000B20000-0x0000000000FD3000-memory.dmpFilesize
4.7MB
-
memory/5548-273-0x0000000000B20000-0x0000000000FD3000-memory.dmpFilesize
4.7MB
-
memory/5548-288-0x0000000000B20000-0x0000000000FD3000-memory.dmpFilesize
4.7MB
-
memory/5548-212-0x0000000004CD0000-0x0000000004CD1000-memory.dmpFilesize
4KB
-
memory/5548-209-0x0000000004D10000-0x0000000004D11000-memory.dmpFilesize
4KB
-
memory/5548-304-0x0000000000B20000-0x0000000000FD3000-memory.dmpFilesize
4.7MB
-
memory/5548-221-0x0000000004D50000-0x0000000004D51000-memory.dmpFilesize
4KB
-
memory/5548-208-0x0000000004D00000-0x0000000004D01000-memory.dmpFilesize
4KB
-
memory/5548-233-0x0000000000B20000-0x0000000000FD3000-memory.dmpFilesize
4.7MB
-
memory/5548-316-0x0000000000B20000-0x0000000000FD3000-memory.dmpFilesize
4.7MB
-
memory/5548-355-0x0000000000B20000-0x0000000000FD3000-memory.dmpFilesize
4.7MB
-
memory/5548-206-0x0000000000B20000-0x0000000000FD3000-memory.dmpFilesize
4.7MB
-
memory/5548-320-0x0000000000B20000-0x0000000000FD3000-memory.dmpFilesize
4.7MB
-
memory/5548-211-0x0000000004D30000-0x0000000004D31000-memory.dmpFilesize
4KB
-
memory/5548-251-0x0000000000B20000-0x0000000000FD3000-memory.dmpFilesize
4.7MB
-
memory/5548-213-0x0000000004CE0000-0x0000000004CE1000-memory.dmpFilesize
4KB
-
memory/5548-332-0x0000000000B20000-0x0000000000FD3000-memory.dmpFilesize
4.7MB
-
memory/5548-343-0x0000000000B20000-0x0000000000FD3000-memory.dmpFilesize
4.7MB
-
memory/5548-210-0x0000000004CF0000-0x0000000004CF1000-memory.dmpFilesize
4KB
-
memory/5548-336-0x0000000000B20000-0x0000000000FD3000-memory.dmpFilesize
4.7MB
-
memory/5568-215-0x0000000004F20000-0x0000000004F21000-memory.dmpFilesize
4KB
-
memory/5568-216-0x0000000004F00000-0x0000000004F01000-memory.dmpFilesize
4KB
-
memory/5568-217-0x0000000004F40000-0x0000000004F41000-memory.dmpFilesize
4KB
-
memory/5568-205-0x0000000000580000-0x0000000000A15000-memory.dmpFilesize
4.6MB
-
memory/5568-218-0x0000000004EE0000-0x0000000004EE1000-memory.dmpFilesize
4KB
-
memory/5568-222-0x0000000000580000-0x0000000000A15000-memory.dmpFilesize
4.6MB
-
memory/5568-219-0x0000000004EF0000-0x0000000004EF1000-memory.dmpFilesize
4KB
-
memory/5568-214-0x0000000004F10000-0x0000000004F11000-memory.dmpFilesize
4KB