amadey | cbfe00fd53cc4f2f5063ffad4f6d2e87c290bfebb6ea024cffe039b3b4fabba3

Analysis

max time kernel
149s
max time network
145s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
19-06-2024 17:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cbfe00fd53cc4f2f5063ffad4f6d2e87c290bfebb6ea024cffe039b3b4fabba3.exe
Size

1.8MB
MD5

a207a26f59d89336a3f88e315100981c
SHA1

6788d0a73fbd8c77a441151d773a2e5f01cb6e96
SHA256

cbfe00fd53cc4f2f5063ffad4f6d2e87c290bfebb6ea024cffe039b3b4fabba3
SHA512

865fee8581bf804d1b122272a2072d05c570ea4cf31523c70748f59c1b1c0123f3d79ea59e6dc330a3c454daf20019017e53ca4d14cfbfbbe3bc81cc89aaab7a
SSDEEP

49152:cDn7+dURhNjTFOgI1dNW2mweZGx8RUxUCDMZg:G+qdjJ/IjNW2sZGxbVMm

Score

10^/10

amadey risepro 0e6740 e76b71 evasion persistence stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.21

Botnet

0e6740

http://147.45.47.155

Attributes

install_dir
9217037dc9
install_file
explortu.exe
strings_key
8e894a8a4a3d0da8924003a561cfb244
url_paths
/ku4Nor9/index.php

rc4.plain

Extracted

Family

risepro

147.45.47.126:58709

Extracted

Family

amadey

Version

8254624243

Botnet

e76b71

http://77.91.77.81

Attributes

install_dir
8254624243
install_file
axplong.exe
strings_key
90049e51fabf09df0d6748e0b271922e
url_paths
/Kiru9gu/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 11 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	8cbf603859.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explortu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explortu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explortu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	cbfe00fd53cc4f2f5063ffad4f6d2e87c290bfebb6ea024cffe039b3b4fabba3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explortu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explortu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	2568f3c3f8.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 22 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	cbfe00fd53cc4f2f5063ffad4f6d2e87c290bfebb6ea024cffe039b3b4fabba3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	cbfe00fd53cc4f2f5063ffad4f6d2e87c290bfebb6ea024cffe039b3b4fabba3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	2568f3c3f8.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2568f3c3f8.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	8cbf603859.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	8cbf603859.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explortu.exe

Executes dropped EXE 11 IoCs

pid	Process
3292	explortu.exe
2860	explortu.exe
3728	2568f3c3f8.exe
3716	8cbf603859.exe
1516	explortu.exe
3868	axplong.exe
4832	b1b0c36de4.exe
2100	axplong.exe
4468	explortu.exe
1652	explortu.exe
2784	axplong.exe

Identifies Wine through registry keys 2 TTPs 11 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Wine	cbfe00fd53cc4f2f5063ffad4f6d2e87c290bfebb6ea024cffe039b3b4fabba3.exe
Key opened	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Wine	2568f3c3f8.exe
Key opened	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Wine	explortu.exe
Key opened	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Wine	explortu.exe
Key opened	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Wine	explortu.exe
Key opened	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Wine	explortu.exe
Key opened	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Wine	8cbf603859.exe
Key opened	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Wine	explortu.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Windows\CurrentVersion\Run\8cbf603859.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000016001\\8cbf603859.exe"	explortu.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x0002000000025c92-117.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 11 IoCs

pid	Process
3884	cbfe00fd53cc4f2f5063ffad4f6d2e87c290bfebb6ea024cffe039b3b4fabba3.exe
3292	explortu.exe
2860	explortu.exe
3728	2568f3c3f8.exe
3716	8cbf603859.exe
1516	explortu.exe
3868	axplong.exe
2100	axplong.exe
4468	explortu.exe
1652	explortu.exe
2784	axplong.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3292 set thread context of 2860	3292	explortu.exe	78

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explortu.job	cbfe00fd53cc4f2f5063ffad4f6d2e87c290bfebb6ea024cffe039b3b4fabba3.exe
File created	C:\Windows\Tasks\axplong.job	2568f3c3f8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133632934872871091"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3107365284-1576850094-161165143-1000\{DDAA82EE-BC9A-4944-B8B5-B56E9CDDC6E4}	chrome.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
3884	cbfe00fd53cc4f2f5063ffad4f6d2e87c290bfebb6ea024cffe039b3b4fabba3.exe
3884	cbfe00fd53cc4f2f5063ffad4f6d2e87c290bfebb6ea024cffe039b3b4fabba3.exe
3292	explortu.exe
3292	explortu.exe
2860	explortu.exe
2860	explortu.exe
3728	2568f3c3f8.exe
3728	2568f3c3f8.exe
3716	8cbf603859.exe
3716	8cbf603859.exe
1516	explortu.exe
1516	explortu.exe
3868	axplong.exe
3868	axplong.exe
3496	chrome.exe
3496	chrome.exe
2100	axplong.exe
2100	axplong.exe
4468	explortu.exe
4468	explortu.exe
1652	explortu.exe
1652	explortu.exe
2784	axplong.exe
2784	axplong.exe
2552	chrome.exe
2552	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe
Token: SeShutdownPrivilege	3496	chrome.exe
Token: SeCreatePagefilePrivilege	3496	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3728	2568f3c3f8.exe
4832	b1b0c36de4.exe
4832	b1b0c36de4.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
4832	b1b0c36de4.exe
3496	chrome.exe
4832	b1b0c36de4.exe
3496	chrome.exe
4832	b1b0c36de4.exe
4832	b1b0c36de4.exe
4832	b1b0c36de4.exe
4832	b1b0c36de4.exe
4832	b1b0c36de4.exe
4832	b1b0c36de4.exe
4832	b1b0c36de4.exe
4832	b1b0c36de4.exe
4832	b1b0c36de4.exe
4832	b1b0c36de4.exe
4832	b1b0c36de4.exe
4832	b1b0c36de4.exe
4832	b1b0c36de4.exe
4832	b1b0c36de4.exe
4832	b1b0c36de4.exe
4832	b1b0c36de4.exe
4832	b1b0c36de4.exe
4832	b1b0c36de4.exe
4832	b1b0c36de4.exe
4832	b1b0c36de4.exe
4832	b1b0c36de4.exe
4832	b1b0c36de4.exe
4832	b1b0c36de4.exe
4832	b1b0c36de4.exe
4832	b1b0c36de4.exe
4832	b1b0c36de4.exe
4832	b1b0c36de4.exe
4832	b1b0c36de4.exe
4832	b1b0c36de4.exe
4832	b1b0c36de4.exe
4832	b1b0c36de4.exe
4832	b1b0c36de4.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
4832	b1b0c36de4.exe
4832	b1b0c36de4.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
3496	chrome.exe
4832	b1b0c36de4.exe
4832	b1b0c36de4.exe
4832	b1b0c36de4.exe
4832	b1b0c36de4.exe
4832	b1b0c36de4.exe
4832	b1b0c36de4.exe
4832	b1b0c36de4.exe
4832	b1b0c36de4.exe
4832	b1b0c36de4.exe
4832	b1b0c36de4.exe
4832	b1b0c36de4.exe
4832	b1b0c36de4.exe
4832	b1b0c36de4.exe
4832	b1b0c36de4.exe
4832	b1b0c36de4.exe
4832	b1b0c36de4.exe
4832	b1b0c36de4.exe
4832	b1b0c36de4.exe
4832	b1b0c36de4.exe
4832	b1b0c36de4.exe
4832	b1b0c36de4.exe
4832	b1b0c36de4.exe
4832	b1b0c36de4.exe
4832	b1b0c36de4.exe
4832	b1b0c36de4.exe
4832	b1b0c36de4.exe
4832	b1b0c36de4.exe
4832	b1b0c36de4.exe
4832	b1b0c36de4.exe
4832	b1b0c36de4.exe
4832	b1b0c36de4.exe
4832	b1b0c36de4.exe
4832	b1b0c36de4.exe
4832	b1b0c36de4.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3884 wrote to memory of 3292	3884	cbfe00fd53cc4f2f5063ffad4f6d2e87c290bfebb6ea024cffe039b3b4fabba3.exe	77
PID 3884 wrote to memory of 3292	3884	cbfe00fd53cc4f2f5063ffad4f6d2e87c290bfebb6ea024cffe039b3b4fabba3.exe	77
PID 3884 wrote to memory of 3292	3884	cbfe00fd53cc4f2f5063ffad4f6d2e87c290bfebb6ea024cffe039b3b4fabba3.exe	77
PID 3292 wrote to memory of 2860	3292	explortu.exe	78
PID 3292 wrote to memory of 2860	3292	explortu.exe	78
PID 3292 wrote to memory of 2860	3292	explortu.exe	78
PID 3292 wrote to memory of 2860	3292	explortu.exe	78
PID 3292 wrote to memory of 2860	3292	explortu.exe	78
PID 3292 wrote to memory of 2860	3292	explortu.exe	78
PID 3292 wrote to memory of 2860	3292	explortu.exe	78
PID 3292 wrote to memory of 2860	3292	explortu.exe	78
PID 3292 wrote to memory of 2860	3292	explortu.exe	78
PID 3292 wrote to memory of 2860	3292	explortu.exe	78
PID 3292 wrote to memory of 2860	3292	explortu.exe	78
PID 3292 wrote to memory of 2860	3292	explortu.exe	78
PID 3292 wrote to memory of 3728	3292	explortu.exe	79
PID 3292 wrote to memory of 3728	3292	explortu.exe	79
PID 3292 wrote to memory of 3728	3292	explortu.exe	79
PID 3292 wrote to memory of 3716	3292	explortu.exe	80
PID 3292 wrote to memory of 3716	3292	explortu.exe	80
PID 3292 wrote to memory of 3716	3292	explortu.exe	80
PID 3728 wrote to memory of 3868	3728	2568f3c3f8.exe	82
PID 3728 wrote to memory of 3868	3728	2568f3c3f8.exe	82
PID 3728 wrote to memory of 3868	3728	2568f3c3f8.exe	82
PID 3292 wrote to memory of 4832	3292	explortu.exe	83
PID 3292 wrote to memory of 4832	3292	explortu.exe	83
PID 3292 wrote to memory of 4832	3292	explortu.exe	83
PID 4832 wrote to memory of 3496	4832	b1b0c36de4.exe	84
PID 4832 wrote to memory of 3496	4832	b1b0c36de4.exe	84
PID 3496 wrote to memory of 3940	3496	chrome.exe	87
PID 3496 wrote to memory of 3940	3496	chrome.exe	87
PID 3496 wrote to memory of 820	3496	chrome.exe	88
PID 3496 wrote to memory of 820	3496	chrome.exe	88
PID 3496 wrote to memory of 820	3496	chrome.exe	88
PID 3496 wrote to memory of 820	3496	chrome.exe	88
PID 3496 wrote to memory of 820	3496	chrome.exe	88
PID 3496 wrote to memory of 820	3496	chrome.exe	88
PID 3496 wrote to memory of 820	3496	chrome.exe	88
PID 3496 wrote to memory of 820	3496	chrome.exe	88
PID 3496 wrote to memory of 820	3496	chrome.exe	88
PID 3496 wrote to memory of 820	3496	chrome.exe	88
PID 3496 wrote to memory of 820	3496	chrome.exe	88
PID 3496 wrote to memory of 820	3496	chrome.exe	88
PID 3496 wrote to memory of 820	3496	chrome.exe	88
PID 3496 wrote to memory of 820	3496	chrome.exe	88
PID 3496 wrote to memory of 820	3496	chrome.exe	88
PID 3496 wrote to memory of 820	3496	chrome.exe	88
PID 3496 wrote to memory of 820	3496	chrome.exe	88
PID 3496 wrote to memory of 820	3496	chrome.exe	88
PID 3496 wrote to memory of 820	3496	chrome.exe	88
PID 3496 wrote to memory of 820	3496	chrome.exe	88
PID 3496 wrote to memory of 820	3496	chrome.exe	88
PID 3496 wrote to memory of 820	3496	chrome.exe	88
PID 3496 wrote to memory of 820	3496	chrome.exe	88
PID 3496 wrote to memory of 820	3496	chrome.exe	88
PID 3496 wrote to memory of 820	3496	chrome.exe	88
PID 3496 wrote to memory of 820	3496	chrome.exe	88
PID 3496 wrote to memory of 820	3496	chrome.exe	88
PID 3496 wrote to memory of 820	3496	chrome.exe	88
PID 3496 wrote to memory of 820	3496	chrome.exe	88
PID 3496 wrote to memory of 820	3496	chrome.exe	88
PID 3496 wrote to memory of 820	3496	chrome.exe	88
PID 3496 wrote to memory of 2660	3496	chrome.exe	89
PID 3496 wrote to memory of 2660	3496	chrome.exe	89

C:\Users\Admin\AppData\Local\Temp\cbfe00fd53cc4f2f5063ffad4f6d2e87c290bfebb6ea024cffe039b3b4fabba3.exe
"C:\Users\Admin\AppData\Local\Temp\cbfe00fd53cc4f2f5063ffad4f6d2e87c290bfebb6ea024cffe039b3b4fabba3.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3884
- C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
  "C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3292
- - C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
    "C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    PID:2860
- - C:\Users\Admin\1000015002\2568f3c3f8.exe
    "C:\Users\Admin\1000015002\2568f3c3f8.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3728
  - - C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
      "C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious behavior: EnumeratesProcesses
      PID:3868
- - C:\Users\Admin\AppData\Local\Temp\1000016001\8cbf603859.exe
    "C:\Users\Admin\AppData\Local\Temp\1000016001\8cbf603859.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    PID:3716
- - C:\Users\Admin\AppData\Local\Temp\1000017001\b1b0c36de4.exe
    "C:\Users\Admin\AppData\Local\Temp\1000017001\b1b0c36de4.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4832
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
      4⤵
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:3496
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe1c3dab58,0x7ffe1c3dab68,0x7ffe1c3dab78
        5⤵
        
        PID:3940
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1720 --field-trial-handle=1812,i,2620601837426857653,9907985539194413323,131072 /prefetch:2
        5⤵
        
        PID:820
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1992 --field-trial-handle=1812,i,2620601837426857653,9907985539194413323,131072 /prefetch:8
        5⤵
        
        PID:2660
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2168 --field-trial-handle=1812,i,2620601837426857653,9907985539194413323,131072 /prefetch:8
        5⤵
        
        PID:2452
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2944 --field-trial-handle=1812,i,2620601837426857653,9907985539194413323,131072 /prefetch:1
        5⤵
        
        PID:2276
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2964 --field-trial-handle=1812,i,2620601837426857653,9907985539194413323,131072 /prefetch:1
        5⤵
        
        PID:3972
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4152 --field-trial-handle=1812,i,2620601837426857653,9907985539194413323,131072 /prefetch:1
        5⤵
        
        PID:1608
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3852 --field-trial-handle=1812,i,2620601837426857653,9907985539194413323,131072 /prefetch:1
        5⤵
        
        PID:1976
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4392 --field-trial-handle=1812,i,2620601837426857653,9907985539194413323,131072 /prefetch:8
        5⤵
        
        PID:3592
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4404 --field-trial-handle=1812,i,2620601837426857653,9907985539194413323,131072 /prefetch:8
        5⤵
        Modifies registry class
        
        PID:984
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4768 --field-trial-handle=1812,i,2620601837426857653,9907985539194413323,131072 /prefetch:8
        5⤵
        
        PID:3092
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4764 --field-trial-handle=1812,i,2620601837426857653,9907985539194413323,131072 /prefetch:8
        5⤵
        
        PID:2436
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4956 --field-trial-handle=1812,i,2620601837426857653,9907985539194413323,131072 /prefetch:8
        5⤵
        
        PID:4984
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1492 --field-trial-handle=1812,i,2620601837426857653,9907985539194413323,131072 /prefetch:2
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2552

C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1516

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:2436

C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2100

C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4468

C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1652

C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\1000015002\2568f3c3f8.exe

Filesize
1.8MB

MD5
f6106931f2165ce50e2c3d397bc4b8c4

SHA1
3f46a57dabb1c111b04d3b2bd24164baf51dd71b

SHA256
095fb8bd5665a2a96a60f29dca5e3c7e267658d8eb619cb2c1b0f5fa2c86b884

SHA512
b92808b837776e06b665410b28cf1bb0118cac2a3b654946fcd40fa2bbd424539212074aac81290d19d470ea52de8b1f62811f0612e1978a265d919002ef59df

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
4807c92f8d479b08a2ab8c2064c14188

SHA1
4a3acd60828e7bf43a38d36b81c30d62039a8019

SHA256
05271e6ea9ded28e2fc7750150fd2d73b115b4a9f61ad1834c409322096df1a1

SHA512
7a060797e576467acc1ab1e95a3646fa89f015e4560adad7d5869910b11d4b1a879a136137b018042e064a46697039618544624be738fd1a8e4f7541b780a9a5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
196eb849823d11649d3353c0cc51a9b8

SHA1
6fe5f27557964ec078a7d1821b2e98c23ddd0333

SHA256
3e7ced7dad7dba11d5308902567aab3507096306061782e415eb10e4a5b69744

SHA512
1aacb0b38b748d98fadaa6aba8949799c6fce9a7989192b4515777135c7206f46d52e5a75190f74e25869c6b617734f9b220970cf92cc7b38a595cebe8e84b2b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
572f38eb5d468d157cc2f0d53ea3da21

SHA1
2a42b9ebb516801767d77b4f97366010ad85b89d

SHA256
0ddd8730c5c0d131e6dd0a6af5af93d12d09a092fc4f6d0ad356c042cc5f3aea

SHA512
b893698bb274e6653b2d3faec8d56f2c9e49bd365943c30eaca749fd91bca0b8dc973386c99ade4657ad1546d6828795b3b84f416115dbc50e555b2b604bd5d0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
524B

MD5
99c876f552fe328f52a16c85ce42c2a6

SHA1
321bfd732e2dc1de2191540ce0f03da79f58761a

SHA256
a25a01d804ffe93f7b5425ef066509e59ebf3362396deca1016d64b393159912

SHA512
40e2b53566cfc9c5cbd9d785b56c15635948d52ad641318b0d2752962bc19ea7036fb8fa8400d59328a56f6b4ac9b63e39101b95da2995098e9fcc211366132f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
524B

MD5
b845fce1059c489de9c2a4f6c603e4aa

SHA1
2ea0fb086139e30e6d1dfcf5e2b5f42bee782d7f

SHA256
6bbd43c18b2d99e50828a167d918f94b383cca7bef5053ac1ec44c431fa59cb7

SHA512
193c242489706426edfe3900ef08704c02248c6982c653aaf186070a5978f7d475fea534dfdd6e98aa6edc8b383316cbdab0b5039db9c32fd63060a826dd40b8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
524B

MD5
7620104d63d6f6c7fa3dfdee61408e62

SHA1
9a64dc9a0f81ffd479d8b0e9e90d743861c0095d

SHA256
07b8ba32de113099aff1afed50a12a00ebda077369af5611a52822e9d94dfb0c

SHA512
3f0eeee8c17c412215b2bc60b8f11b36a2549a91151b454aa5ab5ad7cf64ee1c05cfe41f498386d84780c8f0da705b88a600b2a2350aadfea8019ed29175004a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
9204463384da8c512c2a60c9db2f584f

SHA1
f64adf84aff0195295e60272a4d727d51c8455c5

SHA256
6136121ae7702d083c2a0a9743aeec21a7b961672635de9d8ba3e2efd4e1910d

SHA512
435d2bfcb0ed79904664753aedfffe1f7cadaa3638fdc5660372ee2eff51f5a3f2914ec7bab667e4829dfc2d84983f1fcacdfe0d9d67bcb8ce31fc5894c8fc39

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
16KB

MD5
4fd9390b72e529e279675d3ff017061b

SHA1
c85169c3df083a46bff4f5e42c76372328ff4963

SHA256
226ecb5d0764e00448f09261296f17cfb6ff99641bf9b16fd67c4d1a5e78327a

SHA512
3dd825c0a39e14c779b5e244fa9f18c5b67cd26709551dc0385da8f0dc51dda60065ffe14ba1b6ab556ea69aeb88aa1ff0680d14b6fb4e35e32bedc1f063ba70

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
269KB

MD5
e8028a9397b241cca8d78015eee13623

SHA1
dd8a37106df80a8ee07c2f79a7d4b57c35a733cd

SHA256
442be0da7979e088b76f0210cc83c816c78705d7a95b045644e4bc4adf6d3682

SHA512
892b69013e7f53f7d2025205b7335af4c6d3ba766538b3cc0a7db2f1f88adc4f5b59a0ce0a8638fb5177ca559d1deb5f507850d6377a5ab28e349c5d8e40310b

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000016001\8cbf603859.exe

Filesize
2.4MB

MD5
61fc31f6ba43ffd19bd9aa007bfbe540

SHA1
55e68c9e25ba8d33b1df954480c5b93adb085915

SHA256
dc6c5e2b5b0076ffa5924b66aa48f60726be4faadfcf904cef423ac40d26b640

SHA512
73c74619313f3dea6216d8607111814e336e6d8d7951ddb45410241825e5915bb10f799b042e4addcac1af60157eedd09cdd2d75e5611129a93a8ead09378366

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000017001\b1b0c36de4.exe

Filesize
1.1MB

MD5
1b49f30920755e778e89c79ab874213d

SHA1
1bb66fda925a044ce0d9ac0dd1e0aef1524257c5

SHA256
92d1df500f4217d86de8690c3a67ddd2e6dcc59cd5a6541d09451124bb50282a

SHA512
1b76e7d477f3de18661b2dfcbc88cf746cf77d64a41ef4f80f74d271ad745ce69471c350e193b8a11b26197a50346c59f67a30147e7d63522bf3fa3517052851

Download Submit
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe

Filesize
1.8MB

MD5
a207a26f59d89336a3f88e315100981c

SHA1
6788d0a73fbd8c77a441151d773a2e5f01cb6e96

SHA256
cbfe00fd53cc4f2f5063ffad4f6d2e87c290bfebb6ea024cffe039b3b4fabba3

SHA512
865fee8581bf804d1b122272a2072d05c570ea4cf31523c70748f59c1b1c0123f3d79ea59e6dc330a3c454daf20019017e53ca4d14cfbfbbe3bc81cc89aaab7a

Download Submit
memory/1516-134-0x0000000000F60000-0x0000000001418000-memory.dmp

Filesize
4.7MB

Download
memory/1516-98-0x0000000000F60000-0x0000000001418000-memory.dmp

Filesize
4.7MB

Download
memory/1652-304-0x0000000000F60000-0x0000000001418000-memory.dmp

Filesize
4.7MB

Download
memory/1652-295-0x0000000000F60000-0x0000000001418000-memory.dmp

Filesize
4.7MB

Download
memory/2100-251-0x00000000009A0000-0x0000000000E57000-memory.dmp

Filesize
4.7MB

Download
memory/2100-246-0x00000000009A0000-0x0000000000E57000-memory.dmp

Filesize
4.7MB

Download
memory/2784-297-0x00000000009A0000-0x0000000000E57000-memory.dmp

Filesize
4.7MB

Download
memory/2784-306-0x00000000009A0000-0x0000000000E57000-memory.dmp

Filesize
4.7MB

Download
memory/2860-45-0x0000000000400000-0x00000000009EA000-memory.dmp

Filesize
5.9MB

Download
memory/2860-51-0x0000000000400000-0x00000000009EA000-memory.dmp

Filesize
5.9MB

Download
memory/2860-57-0x0000000000400000-0x00000000009EA000-memory.dmp

Filesize
5.9MB

Download
memory/2860-56-0x0000000000400000-0x00000000009EA000-memory.dmp

Filesize
5.9MB

Download
memory/2860-54-0x0000000000400000-0x00000000009EA000-memory.dmp

Filesize
5.9MB

Download
memory/2860-52-0x0000000000400000-0x00000000009EA000-memory.dmp

Filesize
5.9MB

Download
memory/2860-49-0x0000000000400000-0x00000000009EA000-memory.dmp

Filesize
5.9MB

Download
memory/2860-48-0x0000000000400000-0x00000000009EA000-memory.dmp

Filesize
5.9MB

Download
memory/2860-47-0x0000000000400000-0x00000000009EA000-memory.dmp

Filesize
5.9MB

Download
memory/2860-44-0x0000000000400000-0x00000000009EA000-memory.dmp

Filesize
5.9MB

Download
memory/2860-42-0x0000000000400000-0x00000000009EA000-memory.dmp

Filesize
5.9MB

Download
memory/2860-43-0x0000000000400000-0x00000000009EA000-memory.dmp

Filesize
5.9MB

Download
memory/2860-41-0x0000000000400000-0x00000000009EA000-memory.dmp

Filesize
5.9MB

Download
memory/2860-40-0x0000000000400000-0x00000000009EA000-memory.dmp

Filesize
5.9MB

Download
memory/2860-38-0x0000000000400000-0x00000000009EA000-memory.dmp

Filesize
5.9MB

Download
memory/2860-37-0x0000000000400000-0x00000000009EA000-memory.dmp

Filesize
5.9MB

Download
memory/2860-35-0x0000000000400000-0x00000000009EA000-memory.dmp

Filesize
5.9MB

Download
memory/2860-55-0x0000000000400000-0x00000000009EA000-memory.dmp

Filesize
5.9MB

Download
memory/2860-34-0x0000000000400000-0x00000000009EA000-memory.dmp

Filesize
5.9MB

Download
memory/2860-31-0x0000000000400000-0x00000000009EA000-memory.dmp

Filesize
5.9MB

Download
memory/2860-30-0x0000000000400000-0x00000000009EA000-memory.dmp

Filesize
5.9MB

Download
memory/2860-33-0x0000000000400000-0x00000000009EA000-memory.dmp

Filesize
5.9MB

Download
memory/2860-24-0x0000000000400000-0x00000000009EA000-memory.dmp

Filesize
5.9MB

Download
memory/2860-27-0x0000000000400000-0x00000000009EA000-memory.dmp

Filesize
5.9MB

Download
memory/2860-53-0x0000000000400000-0x00000000009EA000-memory.dmp

Filesize
5.9MB

Download
memory/2860-58-0x0000000000400000-0x00000000009EA000-memory.dmp

Filesize
5.9MB

Download
memory/2860-28-0x0000000000F60000-0x0000000001418000-memory.dmp

Filesize
4.7MB

Download
memory/2860-50-0x0000000000400000-0x00000000009EA000-memory.dmp

Filesize
5.9MB

Download
memory/2860-29-0x0000000000400000-0x00000000009EA000-memory.dmp

Filesize
5.9MB

Download
memory/2860-32-0x0000000000400000-0x00000000009EA000-memory.dmp

Filesize
5.9MB

Download
memory/2860-46-0x0000000000400000-0x00000000009EA000-memory.dmp

Filesize
5.9MB

Download
memory/2860-36-0x0000000000400000-0x00000000009EA000-memory.dmp

Filesize
5.9MB

Download
memory/2860-39-0x0000000000400000-0x00000000009EA000-memory.dmp

Filesize
5.9MB

Download
memory/3292-75-0x0000000000F60000-0x0000000001418000-memory.dmp

Filesize
4.7MB

Download
memory/3292-179-0x0000000000F60000-0x0000000001418000-memory.dmp

Filesize
4.7MB

Download
memory/3292-74-0x0000000000F60000-0x0000000001418000-memory.dmp

Filesize
4.7MB

Download
memory/3292-21-0x0000000000F60000-0x0000000001418000-memory.dmp

Filesize
4.7MB

Download
memory/3292-188-0x0000000000F60000-0x0000000001418000-memory.dmp

Filesize
4.7MB

Download
memory/3292-111-0x0000000000F60000-0x0000000001418000-memory.dmp

Filesize
4.7MB

Download
memory/3292-253-0x0000000000F60000-0x0000000001418000-memory.dmp

Filesize
4.7MB

Download
memory/3292-282-0x0000000000F60000-0x0000000001418000-memory.dmp

Filesize
4.7MB

Download
memory/3292-225-0x0000000000F60000-0x0000000001418000-memory.dmp

Filesize
4.7MB

Download
memory/3292-279-0x0000000000F60000-0x0000000001418000-memory.dmp

Filesize
4.7MB

Download
memory/3292-181-0x0000000000F60000-0x0000000001418000-memory.dmp

Filesize
4.7MB

Download
memory/3292-215-0x0000000000F60000-0x0000000001418000-memory.dmp

Filesize
4.7MB

Download
memory/3292-20-0x0000000000F60000-0x0000000001418000-memory.dmp

Filesize
4.7MB

Download
memory/3292-19-0x0000000000F61000-0x0000000000F8F000-memory.dmp

Filesize
184KB

Download
memory/3292-243-0x0000000000F60000-0x0000000001418000-memory.dmp

Filesize
4.7MB

Download
memory/3292-18-0x0000000000F60000-0x0000000001418000-memory.dmp

Filesize
4.7MB

Download
memory/3292-240-0x0000000000F60000-0x0000000001418000-memory.dmp

Filesize
4.7MB

Download
memory/3292-228-0x0000000000F60000-0x0000000001418000-memory.dmp

Filesize
4.7MB

Download
memory/3716-229-0x0000000000760000-0x0000000000D74000-memory.dmp

Filesize
6.1MB

Download
memory/3716-216-0x0000000000760000-0x0000000000D74000-memory.dmp

Filesize
6.1MB

Download
memory/3716-226-0x0000000000760000-0x0000000000D74000-memory.dmp

Filesize
6.1MB

Download
memory/3716-95-0x0000000000760000-0x0000000000D74000-memory.dmp

Filesize
6.1MB

Download
memory/3716-280-0x0000000000760000-0x0000000000D74000-memory.dmp

Filesize
6.1MB

Download
memory/3716-241-0x0000000000760000-0x0000000000D74000-memory.dmp

Filesize
6.1MB

Download
memory/3716-189-0x0000000000760000-0x0000000000D74000-memory.dmp

Filesize
6.1MB

Download
memory/3716-245-0x0000000000760000-0x0000000000D74000-memory.dmp

Filesize
6.1MB

Download
memory/3716-218-0x0000000000760000-0x0000000000D74000-memory.dmp

Filesize
6.1MB

Download
memory/3716-254-0x0000000000760000-0x0000000000D74000-memory.dmp

Filesize
6.1MB

Download
memory/3728-76-0x00000000000A0000-0x0000000000557000-memory.dmp

Filesize
4.7MB

Download
memory/3728-108-0x00000000000A0000-0x0000000000557000-memory.dmp

Filesize
4.7MB

Download
memory/3868-190-0x00000000009A0000-0x0000000000E57000-memory.dmp

Filesize
4.7MB

Download
memory/3868-224-0x00000000009A0000-0x0000000000E57000-memory.dmp

Filesize
4.7MB

Download
memory/3868-239-0x00000000009A0000-0x0000000000E57000-memory.dmp

Filesize
4.7MB

Download
memory/3868-227-0x00000000009A0000-0x0000000000E57000-memory.dmp

Filesize
4.7MB

Download
memory/3868-248-0x00000000009A0000-0x0000000000E57000-memory.dmp

Filesize
4.7MB

Download
memory/3868-217-0x00000000009A0000-0x0000000000E57000-memory.dmp

Filesize
4.7MB

Download
memory/3868-269-0x00000000009A0000-0x0000000000E57000-memory.dmp

Filesize
4.7MB

Download
memory/3868-112-0x00000000009A0000-0x0000000000E57000-memory.dmp

Filesize
4.7MB

Download
memory/3868-242-0x00000000009A0000-0x0000000000E57000-memory.dmp

Filesize
4.7MB

Download
memory/3868-281-0x00000000009A0000-0x0000000000E57000-memory.dmp

Filesize
4.7MB

Download
memory/3884-0-0x0000000000EA0000-0x0000000001358000-memory.dmp

Filesize
4.7MB

Download
memory/3884-15-0x0000000000EA0000-0x0000000001358000-memory.dmp

Filesize
4.7MB

Download
memory/3884-5-0x0000000000EA0000-0x0000000001358000-memory.dmp

Filesize
4.7MB

Download
memory/3884-3-0x0000000000EA0000-0x0000000001358000-memory.dmp

Filesize
4.7MB

Download
memory/3884-2-0x0000000000EA1000-0x0000000000ECF000-memory.dmp

Filesize
184KB

Download
memory/3884-1-0x00000000770E6000-0x00000000770E8000-memory.dmp

Filesize
8KB

Download
memory/4468-249-0x0000000000F60000-0x0000000001418000-memory.dmp

Filesize
4.7MB

Download
memory/4468-252-0x0000000000F60000-0x0000000001418000-memory.dmp

Filesize
4.7MB

Download