Analysis

  • max time kernel
    149s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-05-2024 17:02

General

  • Target

    093f831460eb697ac964d41392c8d2dc9f060910401efc8e71463cac1ae665da.exe

  • Size

    1.7MB

  • MD5

    ba0c737c9ce3c5ac570d38b96482fc45

  • SHA1

    19c63d3235c1a21b8cf1824992c9ec8e2be0264a

  • SHA256

    093f831460eb697ac964d41392c8d2dc9f060910401efc8e71463cac1ae665da

  • SHA512

    46daf9c6582b617fea6f3343ba4c71b0cda92e762e68092fd4e2d27a77b39bbf1bd3b40a915df6185ab10a7a271a62110bcf41e47e3531fd808eb6893b155390

  • SSDEEP

    24576:uFIq6QGrEvBUvOaP704IrxS+ffC+lX2KHdSbiYc4seHcYqwAcPAcmnJ8gErDT/W2:uFOEdaP7oZfVdOfckqvJ8gcuC2X3wLI4

Malware Config

Extracted

Family

amadey

Version

4.20

C2

http://193.233.132.139

Attributes
  • install_dir

    5454e6f062

  • install_file

    explorta.exe

  • strings_key

    c7a869c5ba1d72480093ec207994e2bf

  • url_paths

    /sev56rkm/index.php

rc4.plain

Extracted

Family

amadey

Version

4.18

C2

http://193.233.132.56

Attributes
  • install_dir

    09fd851a4f

  • install_file

    explorha.exe

  • strings_key

    443351145ece4966ded809641c77cfa8

  • url_paths

    /Pneh2sXQk0/index.php

rc4.plain

Extracted

Family

risepro

C2

147.45.47.93:58709

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs
  • Blocklisted process makes network request 2 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 18 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 5 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 9 IoCs
  • Identifies Wine through registry keys 2 TTPs 4 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 3 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 51 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks whether UAC is enabled 1 TTPs 5 IoCs
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Drops file in Windows directory 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 22 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 63 IoCs
  • Suspicious use of SendNotifyMessage 60 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\093f831460eb697ac964d41392c8d2dc9f060910401efc8e71463cac1ae665da.exe
    "C:\Users\Admin\AppData\Local\Temp\093f831460eb697ac964d41392c8d2dc9f060910401efc8e71463cac1ae665da.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Checks whether UAC is enabled
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:4064
    • C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
      "C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Suspicious use of WriteProcessMemory
      PID:3348
      • C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
        "C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe"
        3⤵
          PID:2924
        • C:\Users\Admin\AppData\Local\Temp\1000019001\amert.exe
          "C:\Users\Admin\AppData\Local\Temp\1000019001\amert.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Checks computer location settings
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4408
          • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
            "C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"
            4⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Checks computer location settings
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:4040
            • C:\Windows\SysWOW64\rundll32.exe
              "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
              5⤵
              • Loads dropped DLL
              • Suspicious use of WriteProcessMemory
              PID:3208
              • C:\Windows\system32\rundll32.exe
                "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
                6⤵
                • Blocklisted process makes network request
                • Loads dropped DLL
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:3424
                • C:\Windows\system32\netsh.exe
                  netsh wlan show profiles
                  7⤵
                    PID:3800
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\860750803256_Desktop.zip' -CompressionLevel Optimal
                    7⤵
                    • Command and Scripting Interpreter: PowerShell
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3976
              • C:\Windows\SysWOW64\rundll32.exe
                "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
                5⤵
                • Blocklisted process makes network request
                • Loads dropped DLL
                PID:4404
          • C:\Users\Admin\AppData\Local\Temp\1000020001\4c8b172495.exe
            "C:\Users\Admin\AppData\Local\Temp\1000020001\4c8b172495.exe"
            3⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Checks whether UAC is enabled
            PID:2364
          • C:\Users\Admin\1000021002\0e3c0625b8.exe
            "C:\Users\Admin\1000021002\0e3c0625b8.exe"
            3⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of WriteProcessMemory
            PID:3752
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
              4⤵
              • Enumerates system info in registry
              • Modifies data under HKEY_USERS
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of WriteProcessMemory
              PID:1360
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff94937cc40,0x7ff94937cc4c,0x7ff94937cc58
                5⤵
                  PID:1772
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1832,i,13498035085031657642,14290066730992423395,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=1828 /prefetch:2
                  5⤵
                    PID:1688
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2212,i,13498035085031657642,14290066730992423395,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=2264 /prefetch:3
                    5⤵
                      PID:1864
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2272,i,13498035085031657642,14290066730992423395,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=2468 /prefetch:8
                      5⤵
                        PID:3084
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3172,i,13498035085031657642,14290066730992423395,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3184 /prefetch:1
                        5⤵
                          PID:1476
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3176,i,13498035085031657642,14290066730992423395,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3236 /prefetch:1
                          5⤵
                            PID:508
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4620,i,13498035085031657642,14290066730992423395,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4636 /prefetch:8
                            5⤵
                              PID:1176
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4712,i,13498035085031657642,14290066730992423395,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4720 /prefetch:8
                              5⤵
                                PID:4768
                      • C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
                        C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
                        1⤵
                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                        • Checks BIOS information in registry
                        • Executes dropped EXE
                        • Checks whether UAC is enabled
                        PID:2500
                      • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                        C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                        1⤵
                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                        • Checks BIOS information in registry
                        • Executes dropped EXE
                        • Identifies Wine through registry keys
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        • Suspicious behavior: EnumeratesProcesses
                        PID:404
                      • C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe
                        "C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"
                        1⤵
                          PID:4740
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                          1⤵
                            PID:2532
                          • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                            C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                            1⤵
                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                            • Checks BIOS information in registry
                            • Executes dropped EXE
                            • Identifies Wine through registry keys
                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                            • Suspicious behavior: EnumeratesProcesses
                            PID:2400
                          • C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
                            C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
                            1⤵
                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                            • Checks BIOS information in registry
                            • Executes dropped EXE
                            • Checks whether UAC is enabled
                            PID:3748

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\1000021002\0e3c0625b8.exe

                            Filesize

                            1.1MB

                            MD5

                            5b8ace1d2b2d1983bae6e356c0a0d506

                            SHA1

                            5e1fb5ee305bfc0e5e0857de48dc0e7e2dbe468d

                            SHA256

                            13c95efc92db967346b21bce66e03da403e5dad28bda3d0af84f61078602dc60

                            SHA512

                            d2462fa6a786e0470b7b474e83d3ab66208d4c01c4c347e5ff2d10744ac6be77aa87c2c78cd79fe83b75484fb7c42f0585427b978aee39377443c6ae884ba267

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\6b45346e-7a1e-4c44-af87-a645355966dd.tmp

                            Filesize

                            15KB

                            MD5

                            ed23b711f3f11e71a0f2b66f9219635c

                            SHA1

                            b78d910387054757bb704c7a5838b8b773688b6d

                            SHA256

                            306e0ceff008a4351db6a3c5a6726d9444e83903b613b96c8fd8d94a058151ff

                            SHA512

                            37023257592716a952ffafc74f7453a37866e3dd2e7c5da0359d610d9f7f28056a2b39015401fce3212108c0a6e07d7a59141e9f39a3dda46a66ba11fec45846

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                            Filesize

                            649B

                            MD5

                            04c11f381b2439608f20a36ebbd59a77

                            SHA1

                            3b6f24515584f7e65e4aa22039a324b0d6bd1d04

                            SHA256

                            b6184e63d29986ec6d803a858650dd23ff3f7059369889a1531c3af4c3d0060b

                            SHA512

                            73e5d92ff0e7a0fdc2bfefd87f3837e9b8c55cae1f1b4dacab9da6f3390f5d07b1136ba0e8ec52cd896f5b150ffee538beb6d4c4160ea28fcbbee3158aa49426

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                            Filesize

                            264B

                            MD5

                            fb8188f3751a1c449b7ca83ac89541df

                            SHA1

                            da4fc8578ac2cd56cdc486b3b3d166d2360031d0

                            SHA256

                            a3845fac165fadd106c4b311f6d959b7bfef3b28ee0745c331e965ede52e7f10

                            SHA512

                            f8640f84a87dbee59243e28e48e5802e74546ff738b6987886ed007b1924a1ce4d0ba069c7011db060b35a3c45eae945aef2423c8eb6f8b974a192bc3f5b20fd

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                            Filesize

                            3KB

                            MD5

                            300561512e1926ae025325a40a5dadd0

                            SHA1

                            965b96bf30ecf8ac77d8327284f62fe0d02ee521

                            SHA256

                            46e1c9f1c4808434c907a24460bab86e2154a0ad2eab988b334b188806b77244

                            SHA512

                            2b7cdc4c6aed8d20c6e8720722c9ff09cd7b79c38e2517529546954d20a01c448fda0fc06dc1d9592b4b3240da6103f98d6903da6b98fb01b6316675fc8140cd

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                            Filesize

                            2B

                            MD5

                            d751713988987e9331980363e24189ce

                            SHA1

                            97d170e1550eee4afc0af065b78cda302a97674c

                            SHA256

                            4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                            SHA512

                            b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                            Filesize

                            692B

                            MD5

                            73de476b238aa2f3396c40626b7fda6f

                            SHA1

                            1d8f60affca8a4e0dcb32b15734ebd39613a5136

                            SHA256

                            b7e52413234c7d0488f9235694706073039f9306110d7cda7ea516cf438b7dbe

                            SHA512

                            81acc5ee63d99917729cd5c7c8386a9a392dc8cdaf7f6a52012d842c5eb5cf536696b5b4680c46256404c2fd81a43613f246377728b36fd37c64c8dd2c76754d

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            9KB

                            MD5

                            556de630fb53bcc714c230841cacf434

                            SHA1

                            ca27105e680f2b98f8f0571ee9fbee5d4e68727d

                            SHA256

                            1475d616ad336003248745e2dca7d4f9dfecd840ad077dc1332164c2ca42b486

                            SHA512

                            122ce8559415d580c0e9fbd9912f03fa9ebf600901028f514fa534078d103b0b8e64fc524ae9c886b69613c59f28fa12fcd99a03b0e13714d7f7592c987f5e82

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            9KB

                            MD5

                            e32cd81bfacdce18c165101ac0883a95

                            SHA1

                            6707fec8a330e382472c3a6c5357c383bacf445b

                            SHA256

                            d521089f692d4fc926c0af6e6ba23b23ea7c4a17f75291d0f64e26de93e2a62e

                            SHA512

                            f0fdf5b1ccb8095ed5f7ba92359d9679f2846d315c81ba908bd1a4a759b66a201e2b420eda25acf4099f9c2d0d8b7021305317347cf26268320683bf4a9c8a01

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            9KB

                            MD5

                            aa14468d540d97fdf37f1326b6ad7948

                            SHA1

                            8763dce5462a7bbe2bf735edc8f7f7b3c9a0153a

                            SHA256

                            54ada119c1e959d5affdf9f467f24b31cc80f431e49c78861cd7e508673855ad

                            SHA512

                            d7fd52247d5ecfc30be3c93d6d2c186a5a8aca6c97efa46a4afdff5a9cb94e72b93e8dae4516d37c35134fd33a4d546e0d144bddd9b31dbefbb2eaaba0862ce0

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            9KB

                            MD5

                            5b37334294bf9796136c8e3759bce434

                            SHA1

                            f3a6fe4c02264b084540725ee02a050d5a0760d5

                            SHA256

                            097e2fada34b8abf6c04d61a24d4693766f71e702d7fe4388b649c9a2a0382d5

                            SHA512

                            a3c75870fe80a62992d732f644eb7e7d23f694775351084aab17285779532e715989fff351636d0a69059658d739b5d162d493ac10fa76500828dbe44a23d891

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            9KB

                            MD5

                            4ab7ece023bc3adf470ea424ec1f86bc

                            SHA1

                            fa0b12d509a459107904b41dbe6c15ff0504c575

                            SHA256

                            d7ae75613c9d4349ea3c32e425e75f05b9f4eecf2f0d18bc3a8c71f59ae63506

                            SHA512

                            4cbc77fa28b5ab85bae9c2c102cbcd5b7a77adb5e8c0e7ed7937a49576c578a82c656c8531a880cadce97ee412b665139786792ef298a3d047baef5823084a49

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                            Filesize

                            152KB

                            MD5

                            82e001056a4400c5c2b1f82a36456a9f

                            SHA1

                            b3314a7eca1c1e7606c97b87e72a655f5b6b4607

                            SHA256

                            8ed32117957281a5ea58447c80705018fa098907a9ec214cde0b68d546473bac

                            SHA512

                            f3f8259817ba52389dd05b992512e97b065a93f83a018bb01c47610d39a94f75f72c09d2f569e235fe6bf2ff0fe4eb4f2ac20eb50147af2ba262d87ef8573948

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                            Filesize

                            152KB

                            MD5

                            6d92cfd708b9108804af7f62db8c6179

                            SHA1

                            0059648a268733bb5893660a77ec6110d87b0fe4

                            SHA256

                            57c13f40c39fccee9f952bd8520a5d30aed557878844abf73e470692e619812b

                            SHA512

                            27e6fdc480215f301b23b228d6aa1ee0dbeff03623d9718bb4e7d7fdd648c2ee0388bc9c5516db52e0b0585514b2952206551237a9637a6b75b76fefaac70fe5

                          • C:\Users\Admin\AppData\Local\Temp\1000019001\amert.exe

                            Filesize

                            1.8MB

                            MD5

                            4a5a212d78ffc9c69da2284b460f459b

                            SHA1

                            15f2bc513f2ae5183352dd56e801b163d22c6a1d

                            SHA256

                            96e5c68fffb42920fde28e8f2c94579e8628130f5a6764f3b899c5aa95af6292

                            SHA512

                            196f39277d39250d7cc3519d14f11f4aaca2b74c0018ef3736a62db3b27e7141dc19f668f754f92718371ea3617b1a2193c0df46362f910fe475763c6eb2d5b1

                          • C:\Users\Admin\AppData\Local\Temp\1000020001\4c8b172495.exe

                            Filesize

                            2.1MB

                            MD5

                            e351d70cc87a4fe550cc1e7b9d4d6784

                            SHA1

                            aeabd8cc91a7f5bbc712a47b5cfa10978a40e086

                            SHA256

                            5ad952ffcc52041ee282f97fdfc735667d5b60823719a62a586cdd779a76d0fb

                            SHA512

                            8857a4258ba9962caba452f435d736113dab921dc18b5fdfdcaf9045739cc625ef044f8e18b84421824f5ab433d2d46ab8da14132f5d3a0f0e1b9ab674e81c90

                          • C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe

                            Filesize

                            1.7MB

                            MD5

                            ba0c737c9ce3c5ac570d38b96482fc45

                            SHA1

                            19c63d3235c1a21b8cf1824992c9ec8e2be0264a

                            SHA256

                            093f831460eb697ac964d41392c8d2dc9f060910401efc8e71463cac1ae665da

                            SHA512

                            46daf9c6582b617fea6f3343ba4c71b0cda92e762e68092fd4e2d27a77b39bbf1bd3b40a915df6185ab10a7a271a62110bcf41e47e3531fd808eb6893b155390

                          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wwvxghdd.vq0.ps1

                            Filesize

                            60B

                            MD5

                            d17fe0a3f47be24a6453e9ef58c94641

                            SHA1

                            6ab83620379fc69f80c0242105ddffd7d98d5d9d

                            SHA256

                            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                            SHA512

                            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                          • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

                            Filesize

                            109KB

                            MD5

                            726cd06231883a159ec1ce28dd538699

                            SHA1

                            404897e6a133d255ad5a9c26ac6414d7134285a2

                            SHA256

                            12fef2d5995d671ec0e91bdbdc91e2b0d3c90ed3a8b2b13ddaa8ad64727dcd46

                            SHA512

                            9ea82e7cb6c6a58446bd5033855947c3e2d475d2910f2b941235e0b96aa08eec822d2dd17cc86b2d3fce930f78b799291992408e309a6c63e3011266810ea83e

                          • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

                            Filesize

                            1.2MB

                            MD5

                            15a42d3e4579da615a384c717ab2109b

                            SHA1

                            22aeedeb2307b1370cdab70d6a6b6d2c13ad2301

                            SHA256

                            3c97bb410e49b11af8116feb7240b7101e1967cae7538418c45c3d2e072e8103

                            SHA512

                            1eb7f126dccc88a2479e3818c36120f5af3caa0d632b9ea803485ee6531d6e2a1fd0805b1c4364983d280df23ea5ca3ad4a5fca558ac436efae36af9b795c444

                          • memory/404-72-0x0000000000100000-0x00000000005BA000-memory.dmp

                            Filesize

                            4.7MB

                          • memory/404-80-0x0000000000100000-0x00000000005BA000-memory.dmp

                            Filesize

                            4.7MB

                          • memory/2364-108-0x0000000000130000-0x00000000007AD000-memory.dmp

                            Filesize

                            6.5MB

                          • memory/2364-105-0x0000000000130000-0x00000000007AD000-memory.dmp

                            Filesize

                            6.5MB

                          • memory/2364-204-0x0000000000130000-0x00000000007AD000-memory.dmp

                            Filesize

                            6.5MB

                          • memory/2364-111-0x0000000000130000-0x00000000007AD000-memory.dmp

                            Filesize

                            6.5MB

                          • memory/2364-104-0x0000000000130000-0x00000000007AD000-memory.dmp

                            Filesize

                            6.5MB

                          • memory/2364-106-0x0000000000130000-0x00000000007AD000-memory.dmp

                            Filesize

                            6.5MB

                          • memory/2364-109-0x0000000000130000-0x00000000007AD000-memory.dmp

                            Filesize

                            6.5MB

                          • memory/2364-110-0x0000000000130000-0x00000000007AD000-memory.dmp

                            Filesize

                            6.5MB

                          • memory/2364-107-0x0000000000130000-0x00000000007AD000-memory.dmp

                            Filesize

                            6.5MB

                          • memory/2364-103-0x0000000000130000-0x00000000007AD000-memory.dmp

                            Filesize

                            6.5MB

                          • memory/2400-294-0x0000000000100000-0x00000000005BA000-memory.dmp

                            Filesize

                            4.7MB

                          • memory/2400-286-0x0000000000100000-0x00000000005BA000-memory.dmp

                            Filesize

                            4.7MB

                          • memory/2500-77-0x0000000000B40000-0x0000000001086000-memory.dmp

                            Filesize

                            5.3MB

                          • memory/2500-76-0x0000000000B40000-0x0000000001086000-memory.dmp

                            Filesize

                            5.3MB

                          • memory/2500-79-0x0000000000B40000-0x0000000001086000-memory.dmp

                            Filesize

                            5.3MB

                          • memory/2500-70-0x0000000000B40000-0x0000000001086000-memory.dmp

                            Filesize

                            5.3MB

                          • memory/2500-73-0x0000000000B40000-0x0000000001086000-memory.dmp

                            Filesize

                            5.3MB

                          • memory/2500-74-0x0000000000B40000-0x0000000001086000-memory.dmp

                            Filesize

                            5.3MB

                          • memory/2500-71-0x0000000000B40000-0x0000000001086000-memory.dmp

                            Filesize

                            5.3MB

                          • memory/2500-78-0x0000000000B40000-0x0000000001086000-memory.dmp

                            Filesize

                            5.3MB

                          • memory/2500-75-0x0000000000B40000-0x0000000001086000-memory.dmp

                            Filesize

                            5.3MB

                          • memory/3348-29-0x0000000000B40000-0x0000000001086000-memory.dmp

                            Filesize

                            5.3MB

                          • memory/3348-27-0x0000000000B40000-0x0000000001086000-memory.dmp

                            Filesize

                            5.3MB

                          • memory/3348-101-0x0000000000B40000-0x0000000001086000-memory.dmp

                            Filesize

                            5.3MB

                          • memory/3348-22-0x0000000000B40000-0x0000000001086000-memory.dmp

                            Filesize

                            5.3MB

                          • memory/3348-63-0x0000000000B40000-0x0000000001086000-memory.dmp

                            Filesize

                            5.3MB

                          • memory/3348-24-0x0000000000B40000-0x0000000001086000-memory.dmp

                            Filesize

                            5.3MB

                          • memory/3348-23-0x0000000000B40000-0x0000000001086000-memory.dmp

                            Filesize

                            5.3MB

                          • memory/3348-21-0x0000000000B40000-0x0000000001086000-memory.dmp

                            Filesize

                            5.3MB

                          • memory/3348-26-0x0000000000B40000-0x0000000001086000-memory.dmp

                            Filesize

                            5.3MB

                          • memory/3348-203-0x0000000000B40000-0x0000000001086000-memory.dmp

                            Filesize

                            5.3MB

                          • memory/3348-25-0x0000000000B40000-0x0000000001086000-memory.dmp

                            Filesize

                            5.3MB

                          • memory/3348-28-0x0000000000B40000-0x0000000001086000-memory.dmp

                            Filesize

                            5.3MB

                          • memory/3748-291-0x0000000000B40000-0x0000000001086000-memory.dmp

                            Filesize

                            5.3MB

                          • memory/3748-289-0x0000000000B40000-0x0000000001086000-memory.dmp

                            Filesize

                            5.3MB

                          • memory/3748-283-0x0000000000B40000-0x0000000001086000-memory.dmp

                            Filesize

                            5.3MB

                          • memory/3748-285-0x0000000000B40000-0x0000000001086000-memory.dmp

                            Filesize

                            5.3MB

                          • memory/3748-293-0x0000000000B40000-0x0000000001086000-memory.dmp

                            Filesize

                            5.3MB

                          • memory/3748-287-0x0000000000B40000-0x0000000001086000-memory.dmp

                            Filesize

                            5.3MB

                          • memory/3748-290-0x0000000000B40000-0x0000000001086000-memory.dmp

                            Filesize

                            5.3MB

                          • memory/3748-288-0x0000000000B40000-0x0000000001086000-memory.dmp

                            Filesize

                            5.3MB

                          • memory/3748-284-0x0000000000B40000-0x0000000001086000-memory.dmp

                            Filesize

                            5.3MB

                          • memory/3976-152-0x000002ACA6460000-0x000002ACA646A000-memory.dmp

                            Filesize

                            40KB

                          • memory/3976-151-0x000002ACA86C0000-0x000002ACA86D2000-memory.dmp

                            Filesize

                            72KB

                          • memory/3976-125-0x000002ACA6410000-0x000002ACA6432000-memory.dmp

                            Filesize

                            136KB

                          • memory/4040-102-0x0000000000100000-0x00000000005BA000-memory.dmp

                            Filesize

                            4.7MB

                          • memory/4040-199-0x0000000000100000-0x00000000005BA000-memory.dmp

                            Filesize

                            4.7MB

                          • memory/4040-249-0x0000000000100000-0x00000000005BA000-memory.dmp

                            Filesize

                            4.7MB

                          • memory/4040-65-0x0000000000100000-0x00000000005BA000-memory.dmp

                            Filesize

                            4.7MB

                          • memory/4040-260-0x0000000000100000-0x00000000005BA000-memory.dmp

                            Filesize

                            4.7MB

                          • memory/4040-67-0x0000000000100000-0x00000000005BA000-memory.dmp

                            Filesize

                            4.7MB

                          • memory/4040-62-0x0000000000100000-0x00000000005BA000-memory.dmp

                            Filesize

                            4.7MB

                          • memory/4040-241-0x0000000000100000-0x00000000005BA000-memory.dmp

                            Filesize

                            4.7MB

                          • memory/4040-82-0x0000000000100000-0x00000000005BA000-memory.dmp

                            Filesize

                            4.7MB

                          • memory/4064-4-0x0000000000A40000-0x0000000000F86000-memory.dmp

                            Filesize

                            5.3MB

                          • memory/4064-0-0x0000000000A40000-0x0000000000F86000-memory.dmp

                            Filesize

                            5.3MB

                          • memory/4064-20-0x0000000000A40000-0x0000000000F86000-memory.dmp

                            Filesize

                            5.3MB

                          • memory/4064-5-0x0000000000A40000-0x0000000000F86000-memory.dmp

                            Filesize

                            5.3MB

                          • memory/4064-7-0x0000000000A40000-0x0000000000F86000-memory.dmp

                            Filesize

                            5.3MB

                          • memory/4064-6-0x0000000000A40000-0x0000000000F86000-memory.dmp

                            Filesize

                            5.3MB

                          • memory/4064-2-0x0000000000A40000-0x0000000000F86000-memory.dmp

                            Filesize

                            5.3MB

                          • memory/4064-1-0x0000000000A40000-0x0000000000F86000-memory.dmp

                            Filesize

                            5.3MB

                          • memory/4064-3-0x0000000000A40000-0x0000000000F86000-memory.dmp

                            Filesize

                            5.3MB

                          • memory/4408-47-0x0000000000350000-0x000000000080A000-memory.dmp

                            Filesize

                            4.7MB

                          • memory/4408-48-0x0000000077D54000-0x0000000077D56000-memory.dmp

                            Filesize

                            8KB

                          • memory/4408-61-0x0000000000350000-0x000000000080A000-memory.dmp

                            Filesize

                            4.7MB