Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
25-04-2024 10:53
Static task
static1
Behavioral task
behavioral1
Sample
4cd40eaeb03442f0c4eeba38be62cfc505dfe4d2e5ba5b77ee3870f4273bda7a.exe
Resource
win10v2004-20240412-en
General
-
Target
4cd40eaeb03442f0c4eeba38be62cfc505dfe4d2e5ba5b77ee3870f4273bda7a.exe
-
Size
1.8MB
-
MD5
126c418bf263b13230462fd91c5dee18
-
SHA1
2f5bcba8453adec7bfe1baf9bbede7efaee9539c
-
SHA256
4cd40eaeb03442f0c4eeba38be62cfc505dfe4d2e5ba5b77ee3870f4273bda7a
-
SHA512
74d52a022b3e2c6281543018508543c473b4beca00be951f9b5b4a7d47da6d67ce78831ef3c78878563aa0db5839eae28bed1ac76ef4d51375b838dfadf1ef4a
-
SSDEEP
49152:43/bnGc6YnG86tZfgoDZjUypRJo+pKE8Er1OEUT:4jnhGZfgOjFoO1hh+
Malware Config
Extracted
amadey
4.20
http://193.233.132.139
-
install_dir
5454e6f062
-
install_file
explorta.exe
-
strings_key
c7a869c5ba1d72480093ec207994e2bf
-
url_paths
/sev56rkm/index.php
Extracted
amadey
4.17
http://193.233.132.167
-
install_dir
4d0ab15804
-
install_file
chrosha.exe
-
strings_key
1a9519d7b465e1f4880fa09a6162d768
-
url_paths
/enigma/index.php
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 8 IoCs
Processes:
explorta.exechrosha.exeexplorta.exeexplorta.exe4cd40eaeb03442f0c4eeba38be62cfc505dfe4d2e5ba5b77ee3870f4273bda7a.exeexplorta.exeamert.exee3a38e9990.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorta.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ chrosha.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorta.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorta.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 4cd40eaeb03442f0c4eeba38be62cfc505dfe4d2e5ba5b77ee3870f4273bda7a.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorta.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ amert.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ e3a38e9990.exe -
Blocklisted process makes network request 2 IoCs
Processes:
rundll32.exerundll32.exeflow pid process 105 5900 rundll32.exe 106 5668 rundll32.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 16 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
explorta.exechrosha.exeexplorta.exeexplorta.exeexplorta.exe4cd40eaeb03442f0c4eeba38be62cfc505dfe4d2e5ba5b77ee3870f4273bda7a.exee3a38e9990.exeamert.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorta.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorta.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion chrosha.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorta.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorta.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorta.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorta.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorta.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion chrosha.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 4cd40eaeb03442f0c4eeba38be62cfc505dfe4d2e5ba5b77ee3870f4273bda7a.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion e3a38e9990.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion amert.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion e3a38e9990.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorta.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 4cd40eaeb03442f0c4eeba38be62cfc505dfe4d2e5ba5b77ee3870f4273bda7a.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion amert.exe -
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
2661bd25bc.exechrosha.exe4cd40eaeb03442f0c4eeba38be62cfc505dfe4d2e5ba5b77ee3870f4273bda7a.exeexplorta.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Control Panel\International\Geo\Nation 2661bd25bc.exe Key value queried \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Control Panel\International\Geo\Nation chrosha.exe Key value queried \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Control Panel\International\Geo\Nation 4cd40eaeb03442f0c4eeba38be62cfc505dfe4d2e5ba5b77ee3870f4273bda7a.exe Key value queried \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Control Panel\International\Geo\Nation explorta.exe -
Executes dropped EXE 8 IoCs
Processes:
explorta.exeamert.exe2661bd25bc.exee3a38e9990.exeexplorta.exechrosha.exeexplorta.exeexplorta.exepid process 1780 explorta.exe 4268 amert.exe 828 2661bd25bc.exe 5276 e3a38e9990.exe 5932 explorta.exe 5940 chrosha.exe 5652 explorta.exe 2872 explorta.exe -
Identifies Wine through registry keys 2 TTPs 8 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
explorta.exeamert.exee3a38e9990.exeexplorta.exechrosha.exeexplorta.exeexplorta.exe4cd40eaeb03442f0c4eeba38be62cfc505dfe4d2e5ba5b77ee3870f4273bda7a.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Software\Wine explorta.exe Key opened \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Software\Wine amert.exe Key opened \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Software\Wine e3a38e9990.exe Key opened \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Software\Wine explorta.exe Key opened \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Software\Wine chrosha.exe Key opened \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Software\Wine explorta.exe Key opened \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Software\Wine explorta.exe Key opened \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Software\Wine 4cd40eaeb03442f0c4eeba38be62cfc505dfe4d2e5ba5b77ee3870f4273bda7a.exe -
Loads dropped DLL 3 IoCs
Processes:
rundll32.exerundll32.exerundll32.exepid process 5868 rundll32.exe 5900 rundll32.exe 5668 rundll32.exe -
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorta.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2661bd25bc.exe = "C:\\Users\\Admin\\1000013002\\2661bd25bc.exe" explorta.exe Set value (str) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\e3a38e9990.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000014001\\e3a38e9990.exe" explorta.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule C:\Users\Admin\1000013002\2661bd25bc.exe autoit_exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
Processes:
4cd40eaeb03442f0c4eeba38be62cfc505dfe4d2e5ba5b77ee3870f4273bda7a.exeexplorta.exeamert.exee3a38e9990.exeexplorta.exechrosha.exeexplorta.exeexplorta.exepid process 5020 4cd40eaeb03442f0c4eeba38be62cfc505dfe4d2e5ba5b77ee3870f4273bda7a.exe 1780 explorta.exe 4268 amert.exe 5276 e3a38e9990.exe 5932 explorta.exe 5940 chrosha.exe 5652 explorta.exe 2872 explorta.exe -
Drops file in Windows directory 2 IoCs
Processes:
4cd40eaeb03442f0c4eeba38be62cfc505dfe4d2e5ba5b77ee3870f4273bda7a.exeamert.exedescription ioc process File created C:\Windows\Tasks\explorta.job 4cd40eaeb03442f0c4eeba38be62cfc505dfe4d2e5ba5b77ee3870f4273bda7a.exe File created C:\Windows\Tasks\chrosha.job amert.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133585160321726502" chrome.exe -
Modifies registry class 1 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1132431369-515282257-1998160155-1000\{F32D2C4A-D687-4EE4-92BE-F008817DF85B} chrome.exe -
Suspicious behavior: EnumeratesProcesses 33 IoCs
Processes:
4cd40eaeb03442f0c4eeba38be62cfc505dfe4d2e5ba5b77ee3870f4273bda7a.exeexplorta.exeamert.exechrome.exee3a38e9990.exeexplorta.exechrosha.exerundll32.exepowershell.exeexplorta.exechrome.exeexplorta.exepid process 5020 4cd40eaeb03442f0c4eeba38be62cfc505dfe4d2e5ba5b77ee3870f4273bda7a.exe 5020 4cd40eaeb03442f0c4eeba38be62cfc505dfe4d2e5ba5b77ee3870f4273bda7a.exe 1780 explorta.exe 1780 explorta.exe 4268 amert.exe 4268 amert.exe 4008 chrome.exe 4008 chrome.exe 5276 e3a38e9990.exe 5276 e3a38e9990.exe 5932 explorta.exe 5932 explorta.exe 5940 chrosha.exe 5940 chrosha.exe 5900 rundll32.exe 5900 rundll32.exe 5900 rundll32.exe 5900 rundll32.exe 5900 rundll32.exe 5900 rundll32.exe 5900 rundll32.exe 5900 rundll32.exe 5900 rundll32.exe 5900 rundll32.exe 3352 powershell.exe 3352 powershell.exe 3352 powershell.exe 5652 explorta.exe 5652 explorta.exe 4112 chrome.exe 4112 chrome.exe 2872 explorta.exe 2872 explorta.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
Processes:
chrome.exepid process 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exepowershell.exedescription pid process Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeDebugPrivilege 3352 powershell.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe Token: SeCreatePagefilePrivilege 4008 chrome.exe Token: SeShutdownPrivilege 4008 chrome.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
4cd40eaeb03442f0c4eeba38be62cfc505dfe4d2e5ba5b77ee3870f4273bda7a.exe2661bd25bc.exechrome.exepid process 5020 4cd40eaeb03442f0c4eeba38be62cfc505dfe4d2e5ba5b77ee3870f4273bda7a.exe 828 2661bd25bc.exe 828 2661bd25bc.exe 828 2661bd25bc.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 828 2661bd25bc.exe 828 2661bd25bc.exe 4008 chrome.exe 828 2661bd25bc.exe 828 2661bd25bc.exe 828 2661bd25bc.exe 828 2661bd25bc.exe 828 2661bd25bc.exe 828 2661bd25bc.exe 828 2661bd25bc.exe 828 2661bd25bc.exe 828 2661bd25bc.exe 828 2661bd25bc.exe 828 2661bd25bc.exe 828 2661bd25bc.exe 828 2661bd25bc.exe 828 2661bd25bc.exe 828 2661bd25bc.exe 828 2661bd25bc.exe 828 2661bd25bc.exe 828 2661bd25bc.exe 828 2661bd25bc.exe 828 2661bd25bc.exe 828 2661bd25bc.exe 828 2661bd25bc.exe 828 2661bd25bc.exe 828 2661bd25bc.exe 828 2661bd25bc.exe 828 2661bd25bc.exe 828 2661bd25bc.exe 828 2661bd25bc.exe 828 2661bd25bc.exe 828 2661bd25bc.exe 828 2661bd25bc.exe -
Suspicious use of SendNotifyMessage 60 IoCs
Processes:
2661bd25bc.exechrome.exepid process 828 2661bd25bc.exe 828 2661bd25bc.exe 828 2661bd25bc.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 4008 chrome.exe 828 2661bd25bc.exe 828 2661bd25bc.exe 828 2661bd25bc.exe 828 2661bd25bc.exe 828 2661bd25bc.exe 828 2661bd25bc.exe 828 2661bd25bc.exe 828 2661bd25bc.exe 828 2661bd25bc.exe 828 2661bd25bc.exe 828 2661bd25bc.exe 828 2661bd25bc.exe 828 2661bd25bc.exe 828 2661bd25bc.exe 828 2661bd25bc.exe 828 2661bd25bc.exe 828 2661bd25bc.exe 828 2661bd25bc.exe 828 2661bd25bc.exe 828 2661bd25bc.exe 828 2661bd25bc.exe 828 2661bd25bc.exe 828 2661bd25bc.exe 828 2661bd25bc.exe 828 2661bd25bc.exe 828 2661bd25bc.exe 828 2661bd25bc.exe 828 2661bd25bc.exe 828 2661bd25bc.exe 828 2661bd25bc.exe 828 2661bd25bc.exe 828 2661bd25bc.exe 828 2661bd25bc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
4cd40eaeb03442f0c4eeba38be62cfc505dfe4d2e5ba5b77ee3870f4273bda7a.exeexplorta.exe2661bd25bc.exechrome.exedescription pid process target process PID 5020 wrote to memory of 1780 5020 4cd40eaeb03442f0c4eeba38be62cfc505dfe4d2e5ba5b77ee3870f4273bda7a.exe explorta.exe PID 5020 wrote to memory of 1780 5020 4cd40eaeb03442f0c4eeba38be62cfc505dfe4d2e5ba5b77ee3870f4273bda7a.exe explorta.exe PID 5020 wrote to memory of 1780 5020 4cd40eaeb03442f0c4eeba38be62cfc505dfe4d2e5ba5b77ee3870f4273bda7a.exe explorta.exe PID 1780 wrote to memory of 4816 1780 explorta.exe explorta.exe PID 1780 wrote to memory of 4816 1780 explorta.exe explorta.exe PID 1780 wrote to memory of 4816 1780 explorta.exe explorta.exe PID 1780 wrote to memory of 4268 1780 explorta.exe amert.exe PID 1780 wrote to memory of 4268 1780 explorta.exe amert.exe PID 1780 wrote to memory of 4268 1780 explorta.exe amert.exe PID 1780 wrote to memory of 828 1780 explorta.exe 2661bd25bc.exe PID 1780 wrote to memory of 828 1780 explorta.exe 2661bd25bc.exe PID 1780 wrote to memory of 828 1780 explorta.exe 2661bd25bc.exe PID 828 wrote to memory of 4008 828 2661bd25bc.exe chrome.exe PID 828 wrote to memory of 4008 828 2661bd25bc.exe chrome.exe PID 4008 wrote to memory of 3920 4008 chrome.exe chrome.exe PID 4008 wrote to memory of 3920 4008 chrome.exe chrome.exe PID 4008 wrote to memory of 4992 4008 chrome.exe chrome.exe PID 4008 wrote to memory of 4992 4008 chrome.exe chrome.exe PID 4008 wrote to memory of 4992 4008 chrome.exe chrome.exe PID 4008 wrote to memory of 4992 4008 chrome.exe chrome.exe PID 4008 wrote to memory of 4992 4008 chrome.exe chrome.exe PID 4008 wrote to memory of 4992 4008 chrome.exe chrome.exe PID 4008 wrote to memory of 4992 4008 chrome.exe chrome.exe PID 4008 wrote to memory of 4992 4008 chrome.exe chrome.exe PID 4008 wrote to memory of 4992 4008 chrome.exe chrome.exe PID 4008 wrote to memory of 4992 4008 chrome.exe chrome.exe PID 4008 wrote to memory of 4992 4008 chrome.exe chrome.exe PID 4008 wrote to memory of 4992 4008 chrome.exe chrome.exe PID 4008 wrote to memory of 4992 4008 chrome.exe chrome.exe PID 4008 wrote to memory of 4992 4008 chrome.exe chrome.exe PID 4008 wrote to memory of 4992 4008 chrome.exe chrome.exe PID 4008 wrote to memory of 4992 4008 chrome.exe chrome.exe PID 4008 wrote to memory of 4992 4008 chrome.exe chrome.exe PID 4008 wrote to memory of 4992 4008 chrome.exe chrome.exe PID 4008 wrote to memory of 4992 4008 chrome.exe chrome.exe PID 4008 wrote to memory of 4992 4008 chrome.exe chrome.exe PID 4008 wrote to memory of 4992 4008 chrome.exe chrome.exe PID 4008 wrote to memory of 4992 4008 chrome.exe chrome.exe PID 4008 wrote to memory of 4992 4008 chrome.exe chrome.exe PID 4008 wrote to memory of 4992 4008 chrome.exe chrome.exe PID 4008 wrote to memory of 4992 4008 chrome.exe chrome.exe PID 4008 wrote to memory of 4992 4008 chrome.exe chrome.exe PID 4008 wrote to memory of 4992 4008 chrome.exe chrome.exe PID 4008 wrote to memory of 4992 4008 chrome.exe chrome.exe PID 4008 wrote to memory of 4992 4008 chrome.exe chrome.exe PID 4008 wrote to memory of 4992 4008 chrome.exe chrome.exe PID 4008 wrote to memory of 4992 4008 chrome.exe chrome.exe PID 4008 wrote to memory of 3096 4008 chrome.exe chrome.exe PID 4008 wrote to memory of 3096 4008 chrome.exe chrome.exe PID 4008 wrote to memory of 1644 4008 chrome.exe chrome.exe PID 4008 wrote to memory of 1644 4008 chrome.exe chrome.exe PID 4008 wrote to memory of 1644 4008 chrome.exe chrome.exe PID 4008 wrote to memory of 1644 4008 chrome.exe chrome.exe PID 4008 wrote to memory of 1644 4008 chrome.exe chrome.exe PID 4008 wrote to memory of 1644 4008 chrome.exe chrome.exe PID 4008 wrote to memory of 1644 4008 chrome.exe chrome.exe PID 4008 wrote to memory of 1644 4008 chrome.exe chrome.exe PID 4008 wrote to memory of 1644 4008 chrome.exe chrome.exe PID 4008 wrote to memory of 1644 4008 chrome.exe chrome.exe PID 4008 wrote to memory of 1644 4008 chrome.exe chrome.exe PID 4008 wrote to memory of 1644 4008 chrome.exe chrome.exe PID 4008 wrote to memory of 1644 4008 chrome.exe chrome.exe PID 4008 wrote to memory of 1644 4008 chrome.exe chrome.exe PID 4008 wrote to memory of 1644 4008 chrome.exe chrome.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4cd40eaeb03442f0c4eeba38be62cfc505dfe4d2e5ba5b77ee3870f4273bda7a.exe"C:\Users\Admin\AppData\Local\Temp\4cd40eaeb03442f0c4eeba38be62cfc505dfe4d2e5ba5b77ee3870f4273bda7a.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe"C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe"C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\1000012001\amert.exe"C:\Users\Admin\AppData\Local\Temp\1000012001\amert.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\1000013002\2661bd25bc.exe"C:\Users\Admin\1000013002\2661bd25bc.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account4⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9a262ab58,0x7ff9a262ab68,0x7ff9a262ab785⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1708 --field-trial-handle=1932,i,9746576019191250918,13455801274044611738,131072 /prefetch:25⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=1932,i,9746576019191250918,13455801274044611738,131072 /prefetch:85⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2200 --field-trial-handle=1932,i,9746576019191250918,13455801274044611738,131072 /prefetch:85⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3092 --field-trial-handle=1932,i,9746576019191250918,13455801274044611738,131072 /prefetch:15⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3104 --field-trial-handle=1932,i,9746576019191250918,13455801274044611738,131072 /prefetch:15⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4296 --field-trial-handle=1932,i,9746576019191250918,13455801274044611738,131072 /prefetch:15⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3320 --field-trial-handle=1932,i,9746576019191250918,13455801274044611738,131072 /prefetch:15⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4540 --field-trial-handle=1932,i,9746576019191250918,13455801274044611738,131072 /prefetch:85⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4560 --field-trial-handle=1932,i,9746576019191250918,13455801274044611738,131072 /prefetch:85⤵
- Modifies registry class
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4952 --field-trial-handle=1932,i,9746576019191250918,13455801274044611738,131072 /prefetch:85⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4948 --field-trial-handle=1932,i,9746576019191250918,13455801274044611738,131072 /prefetch:85⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5012 --field-trial-handle=1932,i,9746576019191250918,13455801274044611738,131072 /prefetch:85⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1860 --field-trial-handle=1932,i,9746576019191250918,13455801274044611738,131072 /prefetch:25⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1000014001\e3a38e9990.exe"C:\Users\Admin\AppData\Local\Temp\1000014001\e3a38e9990.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exeC:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exeC:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main2⤵
- Loads dropped DLL
-
C:\Windows\system32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\netsh.exenetsh wlan show profiles4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\132431369515_Desktop.zip' -CompressionLevel Optimal4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main2⤵
- Blocklisted process makes network request
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exeC:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exeC:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Unsecured Credentials
3Credentials In Files
2Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\1000013002\2661bd25bc.exeFilesize
1.1MB
MD5919a6f77f81c5b989cb6bda9833dc666
SHA164e02e8971321dbcfb7dc083361de230febbf902
SHA256b9296279d80a5b58ac0065455049f83f7d71eaf422cfed73b3b2561ecde04d8a
SHA5127be129f6fcd8600a96bd8d444561035db7a564259ec5690a48358b8f0db6f87b1aedf054df0c40ca8c2d28e4d47234b56765bf951beebb224c1826b8ee4acb15
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
336B
MD5a783e74c607a86ef7d7a6b725162769f
SHA1b6597c9900e64cf3ebd44bc2fcbfb8bdf3a5148a
SHA256d99a9d33dee4deacb02bd8d9f609fb57f03716ff32b9261e6e3adc7a76812b2f
SHA512b46c5c3b1b4375ab4d674f37f9bbdeba89110647a15635b48c9415c0485ee525539e8eb6b58f2684229306e34d4ae5405ec48431c5571add6c01675c4bd56c1a
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
2KB
MD5d6e616bc6dd3647598c5e9a7d0742414
SHA10e685c5772afc8c3701522c2f18e640008b69d6a
SHA256cda79a12d6e2ef0af3a43d310b5561a5e8834a95f2968393a3f3626855879b68
SHA512478ec92fa503577e1d46f87c474e4f59edcff1f84e5cc717f82e2a4d1157978772caad1ce114c9897ad5a1265bf948807537a8978ea787442cfaa37f15ee28fc
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
2KB
MD56b1a89b5738c5dbdece86bbb7269a849
SHA1eeba96b0713ab12dbad579a25f5945155a893d8f
SHA256d0817e856b7ec249f02bc9fa3866ba3a1923844550a1b59fd6100633317e59bd
SHA5125fd88db2c223d851732a0262dee633508fedde91c3e62c8ffdd859e4109097cf9f599fb67765946335132d78868b78075e793c2234adf1a627c2e06799aee96c
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending ReportsFilesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
524B
MD5101055f657bfbe3464712b1262a45065
SHA1340d3e0991c990d0e024eea7ddecfb83b5f58724
SHA256c56aad3eddcb5c661f8d013eb64c703e0828d7f46f4afa824225d2c2cec534f0
SHA5125280a4e170ddb1c186e8ce8fcbb9215618c97421813b7ee650a3770a3eb34d75b69c811d5d3229e2138fea27252dd9e518525157b695988e8d288f541d5d66f1
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
522B
MD5343927957d16951f1310f70ef7fd7959
SHA17136a819dad9948a31d1be9de2f790ed6993daaa
SHA25619105b9f18013c2ee9cca267f5eb3a0a29ea078ae18d360004aa499e286f611a
SHA51230c0c9ee63962b008521a64637b70c9fa084d1b94418a2b25842d4b72fd36792ed55a331fda6c77d19c58608f57962a0647630c1a828afa8a268dde65fe9bdc6
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
7KB
MD59828e8e32a5c1c222fd4d616e78d9a72
SHA143aa548c6b4c96e01ab5ffe580c2cb9538e79366
SHA2566519ccbad12fd58ac674141d5778898f3d3d702ce1169f8aa909d2f5fad86e5a
SHA51214b9b07718f13940293beaf15016e940b619e6feebe76f73f97c1196ee98dc623c2c8041090e386c071d9ff1dc89f52f1ee6b0e91fe1f3f3a76b942e5bf906b7
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure PreferencesFilesize
16KB
MD5756d7a9c1aaf440fd9fc6b05f6521b0a
SHA17e90370eb3dd3ac3dc5c59cd4d5f80d2a70f8957
SHA2563e959d98dc2d79f9afe146752044e7ffeaf0302b7e101ec8fd4c2d7f50dc1da8
SHA512a32ab720ba833c365c42866e02e0ba0031f7572c2a16bb9c944b895e7e716c522f9104721c89bdbfcce6656d32b7dad3ade5fbc9aadc2d68c278e7183c6c6278
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
253KB
MD5a5b693e468a7bf44f95e0e7e9f36db60
SHA1ef55a261762284ed4a51f318abd64679a36fd1fe
SHA2566776a061084e54d3df8afc15866b28530bbf8ced9ccbceeeb1d90b8772c41e71
SHA5126b10a4345210401c79ce5cb3c823a116528fc2dc946cd62aede3e2cc4f00cf1677302f9c6bd2e1e03cc9c7ac9e3a2058aa970ffe549838f2092d39a5b834e218
-
C:\Users\Admin\AppData\Local\Temp\1000012001\amert.exeFilesize
1.8MB
MD5ac338e13157044447ee1c51026e46584
SHA191a659ab9b0279345daec05f0d4c01547b3739c1
SHA256dba045ff9399749f8c0d73f2d66f41003b73ec53729bebfbc2be482223bd7ec2
SHA5129a2a86841c9d316df37895bb58a08fe2085da47a1a8c808df224a08bbae3b535b306f68ccd7175438f5f9092aa37e7a9f77e7270b04fdea537fd387fbd9e05a5
-
C:\Users\Admin\AppData\Local\Temp\1000014001\e3a38e9990.exeFilesize
2.3MB
MD5516f4ae69573e3cb4e7ca44870a84e3f
SHA19fed4ca2ed71b38d016c09e345893cd5d2fd7902
SHA2560281c13686d8ae00e6256aab7fe23e9fed52c9b469fd473c0aa4ac3bcdb1b88a
SHA5125d1c2f9d14832ce359ab2b83cc8b7124d22fa81171e9ebc9abe9e1d41477b0a68e5b7295c10429d00d1f803002ff05900714ae69bbe1f5fff8df79934e815ee7
-
C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exeFilesize
1.8MB
MD5126c418bf263b13230462fd91c5dee18
SHA12f5bcba8453adec7bfe1baf9bbede7efaee9539c
SHA2564cd40eaeb03442f0c4eeba38be62cfc505dfe4d2e5ba5b77ee3870f4273bda7a
SHA51274d52a022b3e2c6281543018508543c473b4beca00be951f9b5b4a7d47da6d67ce78831ef3c78878563aa0db5839eae28bed1ac76ef4d51375b838dfadf1ef4a
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rpa20riy.vhl.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dllFilesize
109KB
MD5154c3f1334dd435f562672f2664fea6b
SHA151dd25e2ba98b8546de163b8f26e2972a90c2c79
SHA2565f431129f97f3d56929f1e5584819e091bd6c854d7e18503074737fc6d79e33f
SHA5121bca69bbcdb7ecd418769e9d4befc458f9f8e3cee81feb7316bb61e189e2904f4431e4cc7d291e179a5dec441b959d428d8e433f579036f763bbad6460222841
-
C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dllFilesize
1.2MB
MD5f35b671fda2603ec30ace10946f11a90
SHA1059ad6b06559d4db581b1879e709f32f80850872
SHA25683e3df5bec15d5333935bea8b719a6d677e2fb3dc1cf9e18e7b82fd0438285c7
SHA512b5fa27d08c64727cef7fdda5e68054a4359cd697df50d70d1d90da583195959a139066a6214531bbc5f20cd4f9bc1ca3e4244396547381291a6a1d2df9cf8705
-
\??\pipe\crashpad_4008_JJTCUXYVKVSWDOYQMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/1780-24-0x0000000005020000-0x0000000005021000-memory.dmpFilesize
4KB
-
memory/1780-28-0x0000000005050000-0x0000000005051000-memory.dmpFilesize
4KB
-
memory/1780-29-0x0000000005080000-0x0000000005081000-memory.dmpFilesize
4KB
-
memory/1780-30-0x0000000005070000-0x0000000005071000-memory.dmpFilesize
4KB
-
memory/1780-27-0x0000000005010000-0x0000000005011000-memory.dmpFilesize
4KB
-
memory/1780-337-0x00000000003F0000-0x00000000008A3000-memory.dmpFilesize
4.7MB
-
memory/1780-350-0x00000000003F0000-0x00000000008A3000-memory.dmpFilesize
4.7MB
-
memory/1780-334-0x00000000003F0000-0x00000000008A3000-memory.dmpFilesize
4.7MB
-
memory/1780-193-0x00000000003F0000-0x00000000008A3000-memory.dmpFilesize
4.7MB
-
memory/1780-364-0x00000000003F0000-0x00000000008A3000-memory.dmpFilesize
4.7MB
-
memory/1780-261-0x00000000003F0000-0x00000000008A3000-memory.dmpFilesize
4.7MB
-
memory/1780-332-0x00000000003F0000-0x00000000008A3000-memory.dmpFilesize
4.7MB
-
memory/1780-167-0x00000000003F0000-0x00000000008A3000-memory.dmpFilesize
4.7MB
-
memory/1780-20-0x00000000003F0000-0x00000000008A3000-memory.dmpFilesize
4.7MB
-
memory/1780-340-0x00000000003F0000-0x00000000008A3000-memory.dmpFilesize
4.7MB
-
memory/1780-313-0x00000000003F0000-0x00000000008A3000-memory.dmpFilesize
4.7MB
-
memory/1780-223-0x00000000003F0000-0x00000000008A3000-memory.dmpFilesize
4.7MB
-
memory/1780-290-0x00000000003F0000-0x00000000008A3000-memory.dmpFilesize
4.7MB
-
memory/1780-26-0x0000000005000000-0x0000000005001000-memory.dmpFilesize
4KB
-
memory/1780-25-0x0000000005060000-0x0000000005061000-memory.dmpFilesize
4KB
-
memory/1780-23-0x0000000005040000-0x0000000005041000-memory.dmpFilesize
4KB
-
memory/1780-285-0x00000000003F0000-0x00000000008A3000-memory.dmpFilesize
4.7MB
-
memory/1780-147-0x00000000003F0000-0x00000000008A3000-memory.dmpFilesize
4.7MB
-
memory/1780-22-0x0000000005030000-0x0000000005031000-memory.dmpFilesize
4KB
-
memory/1780-293-0x00000000003F0000-0x00000000008A3000-memory.dmpFilesize
4.7MB
-
memory/2872-372-0x00000000003F0000-0x00000000008A3000-memory.dmpFilesize
4.7MB
-
memory/3352-244-0x000001B433D50000-0x000001B433D72000-memory.dmpFilesize
136KB
-
memory/4268-51-0x0000000005040000-0x0000000005041000-memory.dmpFilesize
4KB
-
memory/4268-53-0x0000000005070000-0x0000000005071000-memory.dmpFilesize
4KB
-
memory/4268-81-0x0000000000100000-0x00000000005A4000-memory.dmpFilesize
4.6MB
-
memory/4268-48-0x0000000000100000-0x00000000005A4000-memory.dmpFilesize
4.6MB
-
memory/4268-76-0x0000000005080000-0x0000000005081000-memory.dmpFilesize
4KB
-
memory/4268-49-0x0000000000100000-0x00000000005A4000-memory.dmpFilesize
4.6MB
-
memory/4268-50-0x0000000005030000-0x0000000005031000-memory.dmpFilesize
4KB
-
memory/4268-75-0x0000000005090000-0x0000000005091000-memory.dmpFilesize
4KB
-
memory/4268-56-0x0000000005060000-0x0000000005061000-memory.dmpFilesize
4KB
-
memory/4268-52-0x0000000005020000-0x0000000005021000-memory.dmpFilesize
4KB
-
memory/4268-55-0x0000000005010000-0x0000000005011000-memory.dmpFilesize
4KB
-
memory/4268-54-0x0000000005000000-0x0000000005001000-memory.dmpFilesize
4KB
-
memory/5020-6-0x0000000004C50000-0x0000000004C51000-memory.dmpFilesize
4KB
-
memory/5020-2-0x0000000004C80000-0x0000000004C81000-memory.dmpFilesize
4KB
-
memory/5020-3-0x0000000004C90000-0x0000000004C91000-memory.dmpFilesize
4KB
-
memory/5020-4-0x0000000004C70000-0x0000000004C71000-memory.dmpFilesize
4KB
-
memory/5020-5-0x0000000004CB0000-0x0000000004CB1000-memory.dmpFilesize
4KB
-
memory/5020-21-0x00000000002F0000-0x00000000007A3000-memory.dmpFilesize
4.7MB
-
memory/5020-0-0x00000000002F0000-0x00000000007A3000-memory.dmpFilesize
4.7MB
-
memory/5020-1-0x0000000077E74000-0x0000000077E76000-memory.dmpFilesize
8KB
-
memory/5020-7-0x0000000004C60000-0x0000000004C61000-memory.dmpFilesize
4KB
-
memory/5020-8-0x0000000004CD0000-0x0000000004CD1000-memory.dmpFilesize
4KB
-
memory/5276-155-0x0000000004BA0000-0x0000000004BA1000-memory.dmpFilesize
4KB
-
memory/5276-157-0x0000000004BE0000-0x0000000004BE1000-memory.dmpFilesize
4KB
-
memory/5276-338-0x00000000004E0000-0x0000000000ABF000-memory.dmpFilesize
5.9MB
-
memory/5276-348-0x00000000004E0000-0x0000000000ABF000-memory.dmpFilesize
5.9MB
-
memory/5276-335-0x00000000004E0000-0x0000000000ABF000-memory.dmpFilesize
5.9MB
-
memory/5276-360-0x00000000004E0000-0x0000000000ABF000-memory.dmpFilesize
5.9MB
-
memory/5276-188-0x00000000004E0000-0x0000000000ABF000-memory.dmpFilesize
5.9MB
-
memory/5276-331-0x00000000004E0000-0x0000000000ABF000-memory.dmpFilesize
5.9MB
-
memory/5276-161-0x0000000004C00000-0x0000000004C02000-memory.dmpFilesize
8KB
-
memory/5276-288-0x00000000004E0000-0x0000000000ABF000-memory.dmpFilesize
5.9MB
-
memory/5276-160-0x0000000004B30000-0x0000000004B31000-memory.dmpFilesize
4KB
-
memory/5276-310-0x00000000004E0000-0x0000000000ABF000-memory.dmpFilesize
5.9MB
-
memory/5276-158-0x0000000004B80000-0x0000000004B81000-memory.dmpFilesize
4KB
-
memory/5276-341-0x00000000004E0000-0x0000000000ABF000-memory.dmpFilesize
5.9MB
-
memory/5276-156-0x0000000004BF0000-0x0000000004BF1000-memory.dmpFilesize
4KB
-
memory/5276-224-0x00000000004E0000-0x0000000000ABF000-memory.dmpFilesize
5.9MB
-
memory/5276-154-0x0000000004BC0000-0x0000000004BC1000-memory.dmpFilesize
4KB
-
memory/5276-153-0x0000000004BB0000-0x0000000004BB1000-memory.dmpFilesize
4KB
-
memory/5276-152-0x0000000004B40000-0x0000000004B41000-memory.dmpFilesize
4KB
-
memory/5276-151-0x0000000004BD0000-0x0000000004BD1000-memory.dmpFilesize
4KB
-
memory/5276-150-0x0000000004B50000-0x0000000004B51000-memory.dmpFilesize
4KB
-
memory/5276-262-0x00000000004E0000-0x0000000000ABF000-memory.dmpFilesize
5.9MB
-
memory/5276-148-0x0000000004B90000-0x0000000004B91000-memory.dmpFilesize
4KB
-
memory/5276-149-0x0000000004B60000-0x0000000004B61000-memory.dmpFilesize
4KB
-
memory/5276-146-0x00000000004E0000-0x0000000000ABF000-memory.dmpFilesize
5.9MB
-
memory/5276-286-0x00000000004E0000-0x0000000000ABF000-memory.dmpFilesize
5.9MB
-
memory/5276-292-0x00000000004E0000-0x0000000000ABF000-memory.dmpFilesize
5.9MB
-
memory/5652-321-0x00000000003F0000-0x00000000008A3000-memory.dmpFilesize
4.7MB
-
memory/5932-195-0x00000000053C0000-0x00000000053C1000-memory.dmpFilesize
4KB
-
memory/5932-208-0x00000000003F0000-0x00000000008A3000-memory.dmpFilesize
4.7MB
-
memory/5932-189-0x00000000003F0000-0x00000000008A3000-memory.dmpFilesize
4.7MB
-
memory/5932-194-0x00000000053B0000-0x00000000053B1000-memory.dmpFilesize
4KB
-
memory/5932-196-0x00000000053F0000-0x00000000053F1000-memory.dmpFilesize
4KB
-
memory/5932-197-0x0000000005380000-0x0000000005381000-memory.dmpFilesize
4KB
-
memory/5932-198-0x00000000053A0000-0x00000000053A1000-memory.dmpFilesize
4KB
-
memory/5932-200-0x00000000053E0000-0x00000000053E1000-memory.dmpFilesize
4KB
-
memory/5932-199-0x0000000005390000-0x0000000005391000-memory.dmpFilesize
4KB
-
memory/5940-202-0x00000000049B0000-0x00000000049B1000-memory.dmpFilesize
4KB
-
memory/5940-205-0x0000000004970000-0x0000000004971000-memory.dmpFilesize
4KB
-
memory/5940-210-0x00000000049E0000-0x00000000049E1000-memory.dmpFilesize
4KB
-
memory/5940-209-0x00000000049F0000-0x00000000049F1000-memory.dmpFilesize
4KB
-
memory/5940-333-0x0000000000D40000-0x00000000011E4000-memory.dmpFilesize
4.6MB
-
memory/5940-201-0x00000000049A0000-0x00000000049A1000-memory.dmpFilesize
4KB
-
memory/5940-289-0x0000000000D40000-0x00000000011E4000-memory.dmpFilesize
4.6MB
-
memory/5940-336-0x0000000000D40000-0x00000000011E4000-memory.dmpFilesize
4.6MB
-
memory/5940-203-0x0000000004990000-0x0000000004991000-memory.dmpFilesize
4KB
-
memory/5940-204-0x00000000049D0000-0x00000000049D1000-memory.dmpFilesize
4KB
-
memory/5940-339-0x0000000000D40000-0x00000000011E4000-memory.dmpFilesize
4.6MB
-
memory/5940-207-0x0000000000D40000-0x00000000011E4000-memory.dmpFilesize
4.6MB
-
memory/5940-206-0x0000000004980000-0x0000000004981000-memory.dmpFilesize
4KB
-
memory/5940-342-0x0000000000D40000-0x00000000011E4000-memory.dmpFilesize
4.6MB
-
memory/5940-311-0x0000000000D40000-0x00000000011E4000-memory.dmpFilesize
4.6MB
-
memory/5940-349-0x0000000000D40000-0x00000000011E4000-memory.dmpFilesize
4.6MB
-
memory/5940-225-0x0000000000D40000-0x00000000011E4000-memory.dmpFilesize
4.6MB
-
memory/5940-294-0x0000000000D40000-0x00000000011E4000-memory.dmpFilesize
4.6MB
-
memory/5940-263-0x0000000000D40000-0x00000000011E4000-memory.dmpFilesize
4.6MB
-
memory/5940-362-0x0000000000D40000-0x00000000011E4000-memory.dmpFilesize
4.6MB
-
memory/5940-190-0x0000000000D40000-0x00000000011E4000-memory.dmpFilesize
4.6MB
-
memory/5940-287-0x0000000000D40000-0x00000000011E4000-memory.dmpFilesize
4.6MB