amadey | 75cfc6f8c7dba0901682c01c91f8ada8bbf8c2255b27ae57f9b5c222cf0306c6

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
25-04-2024 13:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

75cfc6f8c7dba0901682c01c91f8ada8bbf8c2255b27ae57f9b5c222cf0306c6.exe
Size

1.8MB
MD5

15c2048b0ae93cafb63ec673aa92632f
SHA1

14610f51009a716ba00e4c28e85fe749d09c4934
SHA256

75cfc6f8c7dba0901682c01c91f8ada8bbf8c2255b27ae57f9b5c222cf0306c6
SHA512

7907e533201fd93a87ae0a3a8a451afd86231f1325497b739eb6348f731ab02cba947730a17faf1a656718d59db2f1de0f059df3fdcfa5375b7406b48e74571f
SSDEEP

49152:M3/bnkQ86VBIaSj1YTWhAs0MpHCXw1eDNI6eN:MjnTNB7kYTSGyiXwad

Score

10^/10

amadey risepro evasion persistence spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.20

http://193.233.132.139

Attributes

install_dir
5454e6f062
install_file
explorta.exe
strings_key
c7a869c5ba1d72480093ec207994e2bf
url_paths
/sev56rkm/index.php

rc4.plain

Extracted

Family

amadey

Version

4.17

http://193.233.132.167

Attributes

install_dir
4d0ab15804
install_file
chrosha.exe
strings_key
1a9519d7b465e1f4880fa09a6162d768
url_paths
/enigma/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 8 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

amert.exe8fbce4b551.exechrosha.exeexplorta.exeexplorta.exe75cfc6f8c7dba0901682c01c91f8ada8bbf8c2255b27ae57f9b5c222cf0306c6.exeexplorta.exeexplorta.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	amert.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	8fbce4b551.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	chrosha.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorta.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorta.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	75cfc6f8c7dba0901682c01c91f8ada8bbf8c2255b27ae57f9b5c222cf0306c6.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorta.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorta.exe

Blocklisted process makes network request 2 IoCs

Processes:

rundll32.exerundll32.exe

flow pid process

32 3744 rundll32.exe
33 1976 rundll32.exe
Downloads MZ/PE file

flow	pid	process
32	3744	rundll32.exe
33	1976	rundll32.exe

Checks BIOS information in registry 2 TTPs 16 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

8fbce4b551.exechrosha.exeexplorta.exeexplorta.exeamert.exeexplorta.exeexplorta.exe75cfc6f8c7dba0901682c01c91f8ada8bbf8c2255b27ae57f9b5c222cf0306c6.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	8fbce4b551.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	chrosha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorta.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorta.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorta.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	amert.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	chrosha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorta.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorta.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	8fbce4b551.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorta.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorta.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	amert.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorta.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	75cfc6f8c7dba0901682c01c91f8ada8bbf8c2255b27ae57f9b5c222cf0306c6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	75cfc6f8c7dba0901682c01c91f8ada8bbf8c2255b27ae57f9b5c222cf0306c6.exe

Executes dropped EXE 8 IoCs

Processes:

explorta.exeexplorta.exeamert.exe2a990e20c9.exe8fbce4b551.exechrosha.exeexplorta.exeexplorta.exe

pid process

3824 explorta.exe
792 explorta.exe
1436 amert.exe
1392 2a990e20c9.exe
1536 8fbce4b551.exe
2952 chrosha.exe
3640 explorta.exe
4736 explorta.exe

pid	process
3824	explorta.exe
792	explorta.exe
1436	amert.exe
1392	2a990e20c9.exe
1536	8fbce4b551.exe
2952	chrosha.exe
3640	explorta.exe
4736	explorta.exe

Identifies Wine through registry keys 2 TTPs 8 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

explorta.exeamert.exe8fbce4b551.exechrosha.exeexplorta.exeexplorta.exe75cfc6f8c7dba0901682c01c91f8ada8bbf8c2255b27ae57f9b5c222cf0306c6.exeexplorta.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000\Software\Wine	explorta.exe
Key opened	\REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000\Software\Wine	amert.exe
Key opened	\REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000\Software\Wine	8fbce4b551.exe
Key opened	\REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000\Software\Wine	chrosha.exe
Key opened	\REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000\Software\Wine	explorta.exe
Key opened	\REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000\Software\Wine	explorta.exe
Key opened	\REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000\Software\Wine	75cfc6f8c7dba0901682c01c91f8ada8bbf8c2255b27ae57f9b5c222cf0306c6.exe
Key opened	\REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000\Software\Wine	explorta.exe

Loads dropped DLL 3 IoCs

Processes:

rundll32.exerundll32.exerundll32.exe

pid process

3444 rundll32.exe
3744 rundll32.exe
1976 rundll32.exe
Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
3444	rundll32.exe
3744	rundll32.exe
1976	rundll32.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explorta.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000\Software\Microsoft\Windows\CurrentVersion\Run\2a990e20c9.exe = "C:\\Users\\Admin\\1000013002\\2a990e20c9.exe"	explorta.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000\Software\Microsoft\Windows\CurrentVersion\Run\8fbce4b551.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000014001\\8fbce4b551.exe"	explorta.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
C:\Users\Admin\1000013002\2a990e20c9.exe	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs

Processes:

75cfc6f8c7dba0901682c01c91f8ada8bbf8c2255b27ae57f9b5c222cf0306c6.exeexplorta.exeexplorta.exeamert.exe8fbce4b551.exechrosha.exeexplorta.exeexplorta.exe

pid	process
3264	75cfc6f8c7dba0901682c01c91f8ada8bbf8c2255b27ae57f9b5c222cf0306c6.exe
3824	explorta.exe
792	explorta.exe
1436	amert.exe
1536	8fbce4b551.exe
2952	chrosha.exe
3640	explorta.exe
4736	explorta.exe

Drops file in Windows directory 2 IoCs

Processes:

75cfc6f8c7dba0901682c01c91f8ada8bbf8c2255b27ae57f9b5c222cf0306c6.exeamert.exe

description	ioc	process
File created	C:\Windows\Tasks\explorta.job	75cfc6f8c7dba0901682c01c91f8ada8bbf8c2255b27ae57f9b5c222cf0306c6.exe
File created	C:\Windows\Tasks\chrosha.job	amert.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133585253853957900"	chrome.exe

Modifies registry class 1 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-801765966-3955847401-2235691403-1000\{645A5619-5C97-4046-B85B-134E4EAE99EB}	chrome.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

Processes:

75cfc6f8c7dba0901682c01c91f8ada8bbf8c2255b27ae57f9b5c222cf0306c6.exeexplorta.exeexplorta.exeamert.exechrome.exe8fbce4b551.exechrosha.exeexplorta.exerundll32.exepowershell.exeexplorta.exe

pid	process
3264	75cfc6f8c7dba0901682c01c91f8ada8bbf8c2255b27ae57f9b5c222cf0306c6.exe
3264	75cfc6f8c7dba0901682c01c91f8ada8bbf8c2255b27ae57f9b5c222cf0306c6.exe
3824	explorta.exe
3824	explorta.exe
792	explorta.exe
792	explorta.exe
1436	amert.exe
1436	amert.exe
3052	chrome.exe
3052	chrome.exe
1536	8fbce4b551.exe
1536	8fbce4b551.exe
2952	chrosha.exe
2952	chrosha.exe
3640	explorta.exe
3640	explorta.exe
3744	rundll32.exe
3744	rundll32.exe
3744	rundll32.exe
3744	rundll32.exe
3744	rundll32.exe
3744	rundll32.exe
3744	rundll32.exe
3744	rundll32.exe
3744	rundll32.exe
3744	rundll32.exe
1316	powershell.exe
1316	powershell.exe
1316	powershell.exe
4736	explorta.exe
4736	explorta.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

Processes:

chrome.exe

pid process

3052 chrome.exe
3052 chrome.exe
3052 chrome.exe
3052 chrome.exe

pid	process
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe
Token: SeShutdownPrivilege	3052	chrome.exe
Token: SeCreatePagefilePrivilege	3052	chrome.exe

Suspicious use of FindShellTrayWindow 63 IoCs

Processes:

2a990e20c9.exechrome.exe

pid	process
1392	2a990e20c9.exe
1392	2a990e20c9.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
1392	2a990e20c9.exe
3052	chrome.exe
1392	2a990e20c9.exe
3052	chrome.exe
1392	2a990e20c9.exe
1392	2a990e20c9.exe
1392	2a990e20c9.exe
1392	2a990e20c9.exe
1392	2a990e20c9.exe
1392	2a990e20c9.exe
1392	2a990e20c9.exe
1392	2a990e20c9.exe
1392	2a990e20c9.exe
1392	2a990e20c9.exe
1392	2a990e20c9.exe
1392	2a990e20c9.exe
1392	2a990e20c9.exe
1392	2a990e20c9.exe
1392	2a990e20c9.exe
1392	2a990e20c9.exe
1392	2a990e20c9.exe
1392	2a990e20c9.exe
1392	2a990e20c9.exe
1392	2a990e20c9.exe
1392	2a990e20c9.exe
1392	2a990e20c9.exe
1392	2a990e20c9.exe
1392	2a990e20c9.exe
1392	2a990e20c9.exe
1392	2a990e20c9.exe
1392	2a990e20c9.exe
1392	2a990e20c9.exe
1392	2a990e20c9.exe
1392	2a990e20c9.exe
1392	2a990e20c9.exe
1392	2a990e20c9.exe

Suspicious use of SendNotifyMessage 48 IoCs

Processes:

2a990e20c9.exechrome.exe

pid	process
1392	2a990e20c9.exe
1392	2a990e20c9.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
3052	chrome.exe
1392	2a990e20c9.exe
1392	2a990e20c9.exe
1392	2a990e20c9.exe
1392	2a990e20c9.exe
1392	2a990e20c9.exe
1392	2a990e20c9.exe
1392	2a990e20c9.exe
1392	2a990e20c9.exe
1392	2a990e20c9.exe
1392	2a990e20c9.exe
1392	2a990e20c9.exe
1392	2a990e20c9.exe
1392	2a990e20c9.exe
1392	2a990e20c9.exe
1392	2a990e20c9.exe
1392	2a990e20c9.exe
1392	2a990e20c9.exe
1392	2a990e20c9.exe
1392	2a990e20c9.exe
1392	2a990e20c9.exe
1392	2a990e20c9.exe
1392	2a990e20c9.exe
1392	2a990e20c9.exe
1392	2a990e20c9.exe
1392	2a990e20c9.exe
1392	2a990e20c9.exe
1392	2a990e20c9.exe
1392	2a990e20c9.exe
1392	2a990e20c9.exe
1392	2a990e20c9.exe
1392	2a990e20c9.exe
1392	2a990e20c9.exe
1392	2a990e20c9.exe
1392	2a990e20c9.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

75cfc6f8c7dba0901682c01c91f8ada8bbf8c2255b27ae57f9b5c222cf0306c6.exeexplorta.exe2a990e20c9.exechrome.exe

description	pid	process	target process
PID 3264 wrote to memory of 3824	3264	75cfc6f8c7dba0901682c01c91f8ada8bbf8c2255b27ae57f9b5c222cf0306c6.exe	explorta.exe
PID 3264 wrote to memory of 3824	3264	75cfc6f8c7dba0901682c01c91f8ada8bbf8c2255b27ae57f9b5c222cf0306c6.exe	explorta.exe
PID 3264 wrote to memory of 3824	3264	75cfc6f8c7dba0901682c01c91f8ada8bbf8c2255b27ae57f9b5c222cf0306c6.exe	explorta.exe
PID 3824 wrote to memory of 1096	3824	explorta.exe	explorta.exe
PID 3824 wrote to memory of 1096	3824	explorta.exe	explorta.exe
PID 3824 wrote to memory of 1096	3824	explorta.exe	explorta.exe
PID 3824 wrote to memory of 1436	3824	explorta.exe	amert.exe
PID 3824 wrote to memory of 1436	3824	explorta.exe	amert.exe
PID 3824 wrote to memory of 1436	3824	explorta.exe	amert.exe
PID 3824 wrote to memory of 1392	3824	explorta.exe	2a990e20c9.exe
PID 3824 wrote to memory of 1392	3824	explorta.exe	2a990e20c9.exe
PID 3824 wrote to memory of 1392	3824	explorta.exe	2a990e20c9.exe
PID 1392 wrote to memory of 3052	1392	2a990e20c9.exe	chrome.exe
PID 1392 wrote to memory of 3052	1392	2a990e20c9.exe	chrome.exe
PID 3052 wrote to memory of 568	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 568	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 3920	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 3920	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 3920	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 3920	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 3920	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 3920	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 3920	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 3920	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 3920	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 3920	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 3920	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 3920	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 3920	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 3920	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 3920	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 3920	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 3920	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 3920	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 3920	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 3920	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 3920	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 3920	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 3920	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 3920	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 3920	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 3920	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 3920	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 3920	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 3920	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 3920	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 3920	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 2716	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 2716	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 408	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 408	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 408	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 408	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 408	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 408	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 408	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 408	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 408	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 408	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 408	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 408	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 408	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 408	3052	chrome.exe	chrome.exe
PID 3052 wrote to memory of 408	3052	chrome.exe	chrome.exe

C:\Users\Admin\AppData\Local\Temp\75cfc6f8c7dba0901682c01c91f8ada8bbf8c2255b27ae57f9b5c222cf0306c6.exe
"C:\Users\Admin\AppData\Local\Temp\75cfc6f8c7dba0901682c01c91f8ada8bbf8c2255b27ae57f9b5c222cf0306c6.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3264

C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
"C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe"
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3824

C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
"C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe"
3⤵
PID:1096

C:\Users\Admin\AppData\Local\Temp\1000012001\amert.exe
"C:\Users\Admin\AppData\Local\Temp\1000012001\amert.exe"
3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:1436

C:\Users\Admin\1000013002\2a990e20c9.exe
"C:\Users\Admin\1000013002\2a990e20c9.exe"
3⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1392

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
4⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3052

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffab9fdab58,0x7ffab9fdab68,0x7ffab9fdab78
5⤵
PID:568

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1688 --field-trial-handle=1840,i,1607411310529631998,16658374378213270118,131072 /prefetch:2
5⤵
PID:3920

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=1840,i,1607411310529631998,16658374378213270118,131072 /prefetch:8
5⤵
PID:2716

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2148 --field-trial-handle=1840,i,1607411310529631998,16658374378213270118,131072 /prefetch:8
5⤵
PID:408

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3044 --field-trial-handle=1840,i,1607411310529631998,16658374378213270118,131072 /prefetch:1
5⤵
PID:4640

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3056 --field-trial-handle=1840,i,1607411310529631998,16658374378213270118,131072 /prefetch:1
5⤵
PID:4560

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4152 --field-trial-handle=1840,i,1607411310529631998,16658374378213270118,131072 /prefetch:1
5⤵
PID:3756

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3380 --field-trial-handle=1840,i,1607411310529631998,16658374378213270118,131072 /prefetch:1
5⤵
PID:2104

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4396 --field-trial-handle=1840,i,1607411310529631998,16658374378213270118,131072 /prefetch:8
5⤵
PID:3552

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4416 --field-trial-handle=1840,i,1607411310529631998,16658374378213270118,131072 /prefetch:8
5⤵
- Modifies registry class
PID:4100

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4780 --field-trial-handle=1840,i,1607411310529631998,16658374378213270118,131072 /prefetch:8
5⤵
PID:2112

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4904 --field-trial-handle=1840,i,1607411310529631998,16658374378213270118,131072 /prefetch:8
5⤵
PID:1988

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5064 --field-trial-handle=1840,i,1607411310529631998,16658374378213270118,131072 /prefetch:8
5⤵
PID:996

C:\Users\Admin\AppData\Local\Temp\1000014001\8fbce4b551.exe
"C:\Users\Admin\AppData\Local\Temp\1000014001\8fbce4b551.exe"
3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1536

C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:792

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:5100

C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2952

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
2⤵
- Loads dropped DLL
PID:3444

C:\Windows\system32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3744

C:\Windows\system32\netsh.exe
netsh wlan show profiles
4⤵
PID:5036

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\017659663955_Desktop.zip' -CompressionLevel Optimal
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:1316

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main
2⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:1976

C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3640

C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4736

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\1000013002\2a990e20c9.exe
Filesize
1.1MB

MD5
3c0e9766b3871534c9ce1cb3c1bd6411

SHA1
51c16a07072426188274a51ed54f9221451d3d07

SHA256
7c813337ec7128442715e50e9206b28eeeeef151d1d9e2feb811813c44ff0cf3

SHA512
43f315a302619547012defee1a136d9fe209fa4049fd6dc9ac88cfd4c8d721aa095062869c175219c4244dbf7d67854b15e5e0aab0c61aa2a2126f62c1f0bf98

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
336B

MD5
0e5ce31a0ee68c2d5e519aa8d9def212

SHA1
1d206cf071de56d189c76f98b35ef631ba690fb5

SHA256
b25973d0cf20cb99eb95186d1adb18eae652837b7cb0982fd6490cdd82764f9b

SHA512
71079026b58bdc3440097991e17ae503d1c9f11e49a48771965e00326d853459564885f1ba3646def6bb813ada6b40e72db10577cf2d42ac00cab9ab8feb9994

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
2KB

MD5
46c5eabce2e17be1597f40fe39ed9235

SHA1
bd101b86ee8a086d64bf6fa996a2ddfc317df41b

SHA256
f795d29a378a94858dbe10255ff63fcdec34babeb2c2c78f84183cbfae9ea375

SHA512
6b9ce41923951b961b11a47816e5f0988483de5ec6a8f6f81e85c2507d15d20d0788237092888a3fdb9af59ac7236997d04bedd5f93cdff671ddb7582655f541

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
522B

MD5
dea4fa58db700868099d1ba2122c6ff5

SHA1
005f73b1000c48816905c9a9077c717b357142a3

SHA256
f06b30a3526dc2e6bf4ccaa6e51eb33bf33655bfd17b397bad7b096f6340682c

SHA512
40da73c27a57a2fec8af42dda62d571b91bfa2068b3d5f6852cee5d4d6d290604acb2c58f30e4c452eae1ffadf17cbe92468ab59146f41245686c5021ec68e88

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
522B

MD5
96aa647de2ab70a53e752570ee718e5d

SHA1
97ddcb0399135f5aafd08d58a75f088eb93b1e4a

SHA256
853bc4d43f82a9f612b125c047851cb992425c36a7272348f39ab5862b4ffb30

SHA512
ad6c162e0f3329f05605a612bb508bbe27bc2840cf0557c93706a92e723bd685f4612d7eaf108dc5ea001de701ade05d1e2ece54dc51579f80de38d929069270

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
056a3093cd6a8ad254f45c740900266a

SHA1
8a6c2716cd6c399903caef4b34a06e3ae96fb30d

SHA256
43e98ad703a4f0c597e7843d51140088b948df545fb12ce1d4b564faf66de884

SHA512
5fb36f7f65f3e7c13fc394d3dc2333754af2613de15afb54c4c1217c887464a2711148453a6b6937e910d07e755acd4ddd0720a14a87ee3148aeb536818f5158

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Filesize
16KB

MD5
078ddd9d8423c6b38975fc3256440279

SHA1
64e49ea2ef8b7397444b78110a6d7ce2f0d1167f

SHA256
d179acff253814b14cf7418888cd2ccdbd13bdca70d8b8e0981cd5020936f3d0

SHA512
bfe7a484b3810852d90cd5fadb29e12c2c801534e1fea084bbf9157636a5c99005832a969a6f1d110e3926f834fa59c42c5bdf957610c6c3eb47ecbcc6941f6b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
253KB

MD5
a63b1745f7c9786ca65271991deb2ac8

SHA1
2b1ab73f6b8130ebd097a1b7fd8f59b83aa8ef1f

SHA256
5e64a0712292f73d7cc6bc4991df4f167af53b1ea888472d8dd4db4d2ede3923

SHA512
ec65ad3f825b8f467db1403817d3c2432e639fddb6c9f6de32874673c7ff819990f0436bf7b8ff8b5250fa3e47bd3ca8517df8950798e976728740826de7b569

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000012001\amert.exe
Filesize
1.9MB

MD5
d29e40c77247d5eea4c4029b804aa549

SHA1
9031e95e7c03ebe7b7c1e828bf18325a76972168

SHA256
0baee82ecdf7b62ca540857e4e3a46dfeda2e4c31352a4a064af7c40c154b9c2

SHA512
3a50c63887f677aae90fb976b5c8677f913447cb6700eeb83bcc261e60d2d394f8876350b10e6c6b4e1906a7f05777eb6379346dbf0d618f1e3e35febbf5a4cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000014001\8fbce4b551.exe
Filesize
2.3MB

MD5
c276e339570b6fd5baee1f245d5709fe

SHA1
26441e287b3afea93aa261fe67e462198f6dd6a5

SHA256
bb8ffe36beffbd984cff743f7091577798e5a58c7f6292bebc913bea7188a288

SHA512
aa22735eb01db36c14935640814c275dbde94602d13095fded0c36c19bb8ba2160b8fa63471cd131169554ea657cd6db8b7bf1b5fba19aeee8ab3412277ebf72

Download Submit
C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
Filesize
1.8MB

MD5
15c2048b0ae93cafb63ec673aa92632f

SHA1
14610f51009a716ba00e4c28e85fe749d09c4934

SHA256
75cfc6f8c7dba0901682c01c91f8ada8bbf8c2255b27ae57f9b5c222cf0306c6

SHA512
7907e533201fd93a87ae0a3a8a451afd86231f1325497b739eb6348f731ab02cba947730a17faf1a656718d59db2f1de0f059df3fdcfa5375b7406b48e74571f

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_u5sektzo.ezh.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll
Filesize
109KB

MD5
154c3f1334dd435f562672f2664fea6b

SHA1
51dd25e2ba98b8546de163b8f26e2972a90c2c79

SHA256
5f431129f97f3d56929f1e5584819e091bd6c854d7e18503074737fc6d79e33f

SHA512
1bca69bbcdb7ecd418769e9d4befc458f9f8e3cee81feb7316bb61e189e2904f4431e4cc7d291e179a5dec441b959d428d8e433f579036f763bbad6460222841

Download Submit
C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll
Filesize
1.2MB

MD5
f35b671fda2603ec30ace10946f11a90

SHA1
059ad6b06559d4db581b1879e709f32f80850872

SHA256
83e3df5bec15d5333935bea8b719a6d677e2fb3dc1cf9e18e7b82fd0438285c7

SHA512
b5fa27d08c64727cef7fdda5e68054a4359cd697df50d70d1d90da583195959a139066a6214531bbc5f20cd4f9bc1ca3e4244396547381291a6a1d2df9cf8705

Download Submit
\??\pipe\crashpad_3052_ZIYQDERNMWCNJUWY
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/792-40-0x0000000004FB0000-0x0000000004FB1000-memory.dmp

Filesize
4KB

Download
memory/792-39-0x0000000004FA0000-0x0000000004FA1000-memory.dmp

Filesize
4KB

Download
memory/792-42-0x0000000000310000-0x00000000007CC000-memory.dmp

Filesize
4.7MB

Download
memory/792-41-0x0000000004FD0000-0x0000000004FD1000-memory.dmp

Filesize
4KB

Download
memory/792-36-0x0000000004FE0000-0x0000000004FE1000-memory.dmp

Filesize
4KB

Download
memory/792-38-0x0000000005000000-0x0000000005001000-memory.dmp

Filesize
4KB

Download
memory/792-37-0x0000000004FC0000-0x0000000004FC1000-memory.dmp

Filesize
4KB

Download
memory/792-34-0x0000000000310000-0x00000000007CC000-memory.dmp

Filesize
4.7MB

Download
memory/1436-69-0x00000000051A0000-0x00000000051A1000-memory.dmp

Filesize
4KB

Download
memory/1436-68-0x0000000005190000-0x0000000005191000-memory.dmp

Filesize
4KB

Download
memory/1436-70-0x00000000051D0000-0x00000000051D1000-memory.dmp

Filesize
4KB

Download
memory/1436-72-0x0000000005220000-0x0000000005221000-memory.dmp

Filesize
4KB

Download
memory/1436-65-0x00000000051C0000-0x00000000051C1000-memory.dmp

Filesize
4KB

Download
memory/1436-63-0x0000000000710000-0x0000000000BEE000-memory.dmp

Filesize
4.9MB

Download
memory/1436-73-0x0000000005210000-0x0000000005211000-memory.dmp

Filesize
4KB

Download
memory/1436-77-0x0000000000710000-0x0000000000BEE000-memory.dmp

Filesize
4.9MB

Download
memory/1436-67-0x00000000051F0000-0x00000000051F1000-memory.dmp

Filesize
4KB

Download
memory/1436-66-0x00000000051B0000-0x00000000051B1000-memory.dmp

Filesize
4KB

Download
memory/1436-64-0x0000000000710000-0x0000000000BEE000-memory.dmp

Filesize
4.9MB

Download
memory/1536-202-0x0000000005160000-0x0000000005161000-memory.dmp

Filesize
4KB

Download
memory/1536-195-0x0000000005100000-0x0000000005101000-memory.dmp

Filesize
4KB

Download
memory/1536-206-0x0000000005180000-0x0000000005182000-memory.dmp

Filesize
8KB

Download
memory/1536-340-0x0000000000750000-0x0000000000D3B000-memory.dmp

Filesize
5.9MB

Download
memory/1536-205-0x00000000050A0000-0x00000000050A1000-memory.dmp

Filesize
4KB

Download
memory/1536-329-0x0000000000750000-0x0000000000D3B000-memory.dmp

Filesize
5.9MB

Download
memory/1536-201-0x0000000005130000-0x0000000005131000-memory.dmp

Filesize
4KB

Download
memory/1536-303-0x0000000000750000-0x0000000000D3B000-memory.dmp

Filesize
5.9MB

Download
memory/1536-203-0x00000000050F0000-0x00000000050F1000-memory.dmp

Filesize
4KB

Download
memory/1536-299-0x0000000000750000-0x0000000000D3B000-memory.dmp

Filesize
5.9MB

Download
memory/1536-204-0x0000000005150000-0x0000000005151000-memory.dmp

Filesize
4KB

Download
memory/1536-285-0x0000000000750000-0x0000000000D3B000-memory.dmp

Filesize
5.9MB

Download
memory/1536-199-0x00000000050B0000-0x00000000050B1000-memory.dmp

Filesize
4KB

Download
memory/1536-239-0x0000000000750000-0x0000000000D3B000-memory.dmp

Filesize
5.9MB

Download
memory/1536-200-0x0000000005110000-0x0000000005111000-memory.dmp

Filesize
4KB

Download
memory/1536-235-0x0000000000750000-0x0000000000D3B000-memory.dmp

Filesize
5.9MB

Download
memory/1536-219-0x0000000000750000-0x0000000000D3B000-memory.dmp

Filesize
5.9MB

Download
memory/1536-198-0x00000000050C0000-0x00000000050C1000-memory.dmp

Filesize
4KB

Download
memory/1536-197-0x0000000005140000-0x0000000005141000-memory.dmp

Filesize
4KB

Download
memory/1536-196-0x00000000050D0000-0x00000000050D1000-memory.dmp

Filesize
4KB

Download
memory/1536-194-0x0000000000750000-0x0000000000D3B000-memory.dmp

Filesize
5.9MB

Download
memory/2952-212-0x00000000059D0000-0x00000000059D1000-memory.dmp

Filesize
4KB

Download
memory/2952-211-0x00000000059C0000-0x00000000059C1000-memory.dmp

Filesize
4KB

Download
memory/2952-213-0x00000000059B0000-0x00000000059B1000-memory.dmp

Filesize
4KB

Download
memory/2952-215-0x0000000005990000-0x0000000005991000-memory.dmp

Filesize
4KB

Download
memory/2952-209-0x0000000000F10000-0x00000000013EE000-memory.dmp

Filesize
4.9MB

Download
memory/2952-214-0x00000000059F0000-0x00000000059F1000-memory.dmp

Filesize
4KB

Download
memory/2952-216-0x00000000059A0000-0x00000000059A1000-memory.dmp

Filesize
4KB

Download
memory/2952-236-0x0000000000F10000-0x00000000013EE000-memory.dmp

Filesize
4.9MB

Download
memory/2952-283-0x0000000000F10000-0x00000000013EE000-memory.dmp

Filesize
4.9MB

Download
memory/2952-210-0x0000000000F10000-0x00000000013EE000-memory.dmp

Filesize
4.9MB

Download
memory/2952-297-0x0000000000F10000-0x00000000013EE000-memory.dmp

Filesize
4.9MB

Download
memory/2952-301-0x0000000000F10000-0x00000000013EE000-memory.dmp

Filesize
4.9MB

Download
memory/2952-313-0x0000000000F10000-0x00000000013EE000-memory.dmp

Filesize
4.9MB

Download
memory/2952-331-0x0000000000F10000-0x00000000013EE000-memory.dmp

Filesize
4.9MB

Download
memory/2952-341-0x0000000000F10000-0x00000000013EE000-memory.dmp

Filesize
4.9MB

Download
memory/3264-8-0x0000000005130000-0x0000000005131000-memory.dmp

Filesize
4KB

Download
memory/3264-6-0x00000000050D0000-0x00000000050D1000-memory.dmp

Filesize
4KB

Download
memory/3264-7-0x00000000050E0000-0x00000000050E1000-memory.dmp

Filesize
4KB

Download
memory/3264-0-0x0000000000700000-0x0000000000BBC000-memory.dmp

Filesize
4.7MB

Download
memory/3264-1-0x0000000077466000-0x0000000077468000-memory.dmp

Filesize
8KB

Download
memory/3264-9-0x0000000005160000-0x0000000005161000-memory.dmp

Filesize
4KB

Download
memory/3264-10-0x0000000005150000-0x0000000005151000-memory.dmp

Filesize
4KB

Download
memory/3264-2-0x0000000005100000-0x0000000005101000-memory.dmp

Filesize
4KB

Download
memory/3264-3-0x0000000005110000-0x0000000005111000-memory.dmp

Filesize
4KB

Download
memory/3264-4-0x00000000050F0000-0x00000000050F1000-memory.dmp

Filesize
4KB

Download
memory/3264-5-0x0000000005140000-0x0000000005141000-memory.dmp

Filesize
4KB

Download
memory/3264-22-0x0000000000700000-0x0000000000BBC000-memory.dmp

Filesize
4.7MB

Download
memory/3640-222-0x0000000004B50000-0x0000000004B51000-memory.dmp

Filesize
4KB

Download
memory/3640-221-0x0000000004B10000-0x0000000004B11000-memory.dmp

Filesize
4KB

Download
memory/3640-220-0x0000000004B20000-0x0000000004B21000-memory.dmp

Filesize
4KB

Download
memory/3640-228-0x0000000000310000-0x00000000007CC000-memory.dmp

Filesize
4.7MB

Download
memory/3640-218-0x0000000000310000-0x00000000007CC000-memory.dmp

Filesize
4.7MB

Download
memory/3824-298-0x0000000000310000-0x00000000007CC000-memory.dmp

Filesize
4.7MB

Download
memory/3824-302-0x0000000000310000-0x00000000007CC000-memory.dmp

Filesize
4.7MB

Download
memory/3824-24-0x0000000005530000-0x0000000005531000-memory.dmp

Filesize
4KB

Download
memory/3824-25-0x0000000005520000-0x0000000005521000-memory.dmp

Filesize
4KB

Download
memory/3824-148-0x0000000000310000-0x00000000007CC000-memory.dmp

Filesize
4.7MB

Download
memory/3824-78-0x0000000000310000-0x00000000007CC000-memory.dmp

Filesize
4.7MB

Download
memory/3824-284-0x0000000000310000-0x00000000007CC000-memory.dmp

Filesize
4.7MB

Download
memory/3824-28-0x0000000005510000-0x0000000005511000-memory.dmp

Filesize
4KB

Download
memory/3824-26-0x0000000005560000-0x0000000005561000-memory.dmp

Filesize
4KB

Download
memory/3824-29-0x0000000005540000-0x0000000005541000-memory.dmp

Filesize
4KB

Download
memory/3824-234-0x0000000000310000-0x00000000007CC000-memory.dmp

Filesize
4.7MB

Download
memory/3824-30-0x0000000005580000-0x0000000005581000-memory.dmp

Filesize
4KB

Download
memory/3824-31-0x0000000005590000-0x0000000005591000-memory.dmp

Filesize
4KB

Download
memory/3824-238-0x0000000000310000-0x00000000007CC000-memory.dmp

Filesize
4.7MB

Download
memory/3824-32-0x0000000000310000-0x00000000007CC000-memory.dmp

Filesize
4.7MB

Download
memory/3824-35-0x0000000000310000-0x00000000007CC000-memory.dmp

Filesize
4.7MB

Download
memory/3824-23-0x0000000000310000-0x00000000007CC000-memory.dmp

Filesize
4.7MB

Download
memory/3824-319-0x0000000000310000-0x00000000007CC000-memory.dmp

Filesize
4.7MB

Download
memory/3824-27-0x0000000005500000-0x0000000005501000-memory.dmp

Filesize
4KB

Download
memory/3824-175-0x0000000000310000-0x00000000007CC000-memory.dmp

Filesize
4.7MB

Download
memory/3824-45-0x0000000000310000-0x00000000007CC000-memory.dmp

Filesize
4.7MB

Download
memory/3824-47-0x0000000000310000-0x00000000007CC000-memory.dmp

Filesize
4.7MB

Download
memory/3824-339-0x0000000000310000-0x00000000007CC000-memory.dmp

Filesize
4.7MB

Download
memory/3824-46-0x0000000000310000-0x00000000007CC000-memory.dmp

Filesize
4.7MB

Download
memory/4736-338-0x0000000000310000-0x00000000007CC000-memory.dmp

Filesize
4.7MB

Download