amadey | hxxps://workupload[.]com/file/SaZEYKEFmA3

Analysis

max time kernel
146s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20230703-it
resource tags

arch:x64arch:x86image:win10v2004-20230703-itlocale:it-itos:windows10-2004-x64systemwindows
submitted
13-07-2023 10:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://workupload.com/file/SaZEYKEFmA3

Score

10^/10

amadey systembc vidar https://t.me/prescilliouns evasion persistence spyware stealer themida trojan

Malware Config

Extracted

Family

vidar

Version

4.7

Botnet

https://t.me/prescilliouns

https://t.me/eagl3z

https://steamcommunity.com/profiles/76561199159550234

Attributes

profile_id_v2
https://t.me/prescilliouns
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 Edg/114.0.1788.0 uacq

Extracted

Family

amadey

Version

3.85

45.9.74.164/b7djSDcPcZ/index.php

Extracted

Family

systembc

5.42.65.67:4298

localhost.exchange:4298

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

18323036165062766622.exejbruyer.exejbruyer.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	18323036165062766622.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	jbruyer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	jbruyer.exe

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

110 5236 rundll32.exe
Downloads MZ/PE file

flow	pid	process
110	5236	rundll32.exe

Checks BIOS information in registry 2 TTPs 6 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

jbruyer.exejbruyer.exe18323036165062766622.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	jbruyer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	jbruyer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	jbruyer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	18323036165062766622.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	18323036165062766622.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	jbruyer.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

18323036165062766622.exejbruyer.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Control Panel\International\Geo\Nation	18323036165062766622.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Control Panel\International\Geo\Nation	jbruyer.exe

Executes dropped EXE 5 IoCs

Processes:

Setup.exe18323036165062766622.exejbruyer.exestub_186.exejbruyer.exe

pid process

5480 Setup.exe
3952 18323036165062766622.exe
4976 jbruyer.exe
5384 stub_186.exe
4576 jbruyer.exe
Loads dropped DLL 4 IoCs

Processes:

MsBuild.exerundll32.exerundll32.exe

pid process

5720 MsBuild.exe
5720 MsBuild.exe
5220 rundll32.exe
5236 rundll32.exe

pid	process
5480	Setup.exe
3952	18323036165062766622.exe
4976	jbruyer.exe
5384	stub_186.exe
4576	jbruyer.exe

pid	process
5720	MsBuild.exe
5720	MsBuild.exe
5220	rundll32.exe
5236	rundll32.exe

Themida packer 23 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
C:\ProgramData\18323036165062766622.exe	themida
C:\ProgramData\18323036165062766622.exe	themida
C:\ProgramData\18323036165062766622.exe	themida
behavioral1/memory/3952-2816-0x0000000000FE0000-0x000000000153A000-memory.dmp	themida
behavioral1/memory/3952-2823-0x0000000000FE0000-0x000000000153A000-memory.dmp	themida
behavioral1/memory/3952-2824-0x0000000000FE0000-0x000000000153A000-memory.dmp	themida
behavioral1/memory/3952-2825-0x0000000000FE0000-0x000000000153A000-memory.dmp	themida
behavioral1/memory/3952-2826-0x0000000000FE0000-0x000000000153A000-memory.dmp	themida
C:\Users\Admin\AppData\Local\Temp\c2868ed41c\jbruyer.exe	themida
behavioral1/memory/3952-2836-0x0000000000FE0000-0x000000000153A000-memory.dmp	themida
behavioral1/memory/4976-2838-0x0000000000F20000-0x000000000147A000-memory.dmp	themida
C:\Users\Admin\AppData\Local\Temp\c2868ed41c\jbruyer.exe	themida
behavioral1/memory/4976-2844-0x0000000000F20000-0x000000000147A000-memory.dmp	themida
behavioral1/memory/4976-2845-0x0000000000F20000-0x000000000147A000-memory.dmp	themida
behavioral1/memory/4976-2846-0x0000000000F20000-0x000000000147A000-memory.dmp	themida
behavioral1/memory/4976-2847-0x0000000000F20000-0x000000000147A000-memory.dmp	themida
behavioral1/memory/4976-2876-0x0000000000F20000-0x000000000147A000-memory.dmp	themida
behavioral1/memory/4976-2902-0x0000000000F20000-0x000000000147A000-memory.dmp	themida
C:\Users\Admin\AppData\Local\Temp\c2868ed41c\jbruyer.exe	themida
behavioral1/memory/4576-2908-0x0000000000F20000-0x000000000147A000-memory.dmp	themida
behavioral1/memory/4576-2910-0x0000000000F20000-0x000000000147A000-memory.dmp	themida
behavioral1/memory/4576-2911-0x0000000000F20000-0x000000000147A000-memory.dmp	themida
behavioral1/memory/4576-2915-0x0000000000F20000-0x000000000147A000-memory.dmp	themida

Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

jbruyer.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\app64.dll = "rundll32 C:\\Users\\Admin\\AppData\\Local\\Temp\\1000001061\\app64.dll, rundll"	jbruyer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\stub_186.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000002051\\stub_186.exe"	jbruyer.exe

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

18323036165062766622.exejbruyer.exejbruyer.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	18323036165062766622.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	jbruyer.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	jbruyer.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

Processes:

18323036165062766622.exejbruyer.exejbruyer.exe

pid process

3952 18323036165062766622.exe
4976 jbruyer.exe
4576 jbruyer.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

Setup.exe

description pid process target process

PID 5480 set thread context of 5720 5480 Setup.exe MsBuild.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
3952	18323036165062766622.exe
4976	jbruyer.exe
4576	jbruyer.exe

description	pid	process	target process
PID 5480 set thread context of 5720	5480	Setup.exe	MsBuild.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

MsBuild.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MsBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MsBuild.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3824 schtasks.exe

pid	process
3824	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 3 IoCs

Processes:

powershell.exe7zFM.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	7zFM.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	7zFM.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

Processes:

powershell.exemsedge.exemsedge.exeidentity_helper.exemsedge.exeMsBuild.exe18323036165062766622.exejbruyer.exestub_186.exejbruyer.exe

pid	process
4828	powershell.exe
4828	powershell.exe
1428	msedge.exe
1428	msedge.exe
1344	msedge.exe
1344	msedge.exe
4044	identity_helper.exe
4044	identity_helper.exe
4512	msedge.exe
4512	msedge.exe
5720	MsBuild.exe
5720	MsBuild.exe
5720	MsBuild.exe
5720	MsBuild.exe
5720	MsBuild.exe
5720	MsBuild.exe
3952	18323036165062766622.exe
3952	18323036165062766622.exe
4976	jbruyer.exe
4976	jbruyer.exe
5384	stub_186.exe
5384	stub_186.exe
4576	jbruyer.exe
4576	jbruyer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

msedge.exe

pid process

1344 msedge.exe
1344 msedge.exe
1344 msedge.exe
1344 msedge.exe
1344 msedge.exe
1344 msedge.exe
1344 msedge.exe
1344 msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

powershell.exe7zFM.exeSetup.exe

description	pid	process
Token: SeDebugPrivilege	4828	powershell.exe
Token: SeRestorePrivilege	3684	7zFM.exe
Token: 35	3684	7zFM.exe
Token: SeSecurityPrivilege	3684	7zFM.exe
Token: SeDebugPrivilege	5480	Setup.exe

Suspicious use of FindShellTrayWindow 44 IoCs

Processes:

msedge.exe7zFM.exe18323036165062766622.exe

pid	process
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
3684	7zFM.exe
3684	7zFM.exe
3952	18323036165062766622.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe
1344	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1344 wrote to memory of 1072	1344	msedge.exe	msedge.exe
PID 1344 wrote to memory of 1072	1344	msedge.exe	msedge.exe
PID 1344 wrote to memory of 3560	1344	msedge.exe	msedge.exe
PID 1344 wrote to memory of 3560	1344	msedge.exe	msedge.exe
PID 1344 wrote to memory of 3560	1344	msedge.exe	msedge.exe
PID 1344 wrote to memory of 3560	1344	msedge.exe	msedge.exe
PID 1344 wrote to memory of 3560	1344	msedge.exe	msedge.exe
PID 1344 wrote to memory of 3560	1344	msedge.exe	msedge.exe
PID 1344 wrote to memory of 3560	1344	msedge.exe	msedge.exe
PID 1344 wrote to memory of 3560	1344	msedge.exe	msedge.exe
PID 1344 wrote to memory of 3560	1344	msedge.exe	msedge.exe
PID 1344 wrote to memory of 3560	1344	msedge.exe	msedge.exe
PID 1344 wrote to memory of 3560	1344	msedge.exe	msedge.exe
PID 1344 wrote to memory of 3560	1344	msedge.exe	msedge.exe
PID 1344 wrote to memory of 3560	1344	msedge.exe	msedge.exe
PID 1344 wrote to memory of 3560	1344	msedge.exe	msedge.exe
PID 1344 wrote to memory of 3560	1344	msedge.exe	msedge.exe
PID 1344 wrote to memory of 3560	1344	msedge.exe	msedge.exe
PID 1344 wrote to memory of 3560	1344	msedge.exe	msedge.exe
PID 1344 wrote to memory of 3560	1344	msedge.exe	msedge.exe
PID 1344 wrote to memory of 3560	1344	msedge.exe	msedge.exe
PID 1344 wrote to memory of 3560	1344	msedge.exe	msedge.exe
PID 1344 wrote to memory of 3560	1344	msedge.exe	msedge.exe
PID 1344 wrote to memory of 3560	1344	msedge.exe	msedge.exe
PID 1344 wrote to memory of 3560	1344	msedge.exe	msedge.exe
PID 1344 wrote to memory of 3560	1344	msedge.exe	msedge.exe
PID 1344 wrote to memory of 3560	1344	msedge.exe	msedge.exe
PID 1344 wrote to memory of 3560	1344	msedge.exe	msedge.exe
PID 1344 wrote to memory of 3560	1344	msedge.exe	msedge.exe
PID 1344 wrote to memory of 3560	1344	msedge.exe	msedge.exe
PID 1344 wrote to memory of 3560	1344	msedge.exe	msedge.exe
PID 1344 wrote to memory of 3560	1344	msedge.exe	msedge.exe
PID 1344 wrote to memory of 3560	1344	msedge.exe	msedge.exe
PID 1344 wrote to memory of 3560	1344	msedge.exe	msedge.exe
PID 1344 wrote to memory of 3560	1344	msedge.exe	msedge.exe
PID 1344 wrote to memory of 3560	1344	msedge.exe	msedge.exe
PID 1344 wrote to memory of 3560	1344	msedge.exe	msedge.exe
PID 1344 wrote to memory of 3560	1344	msedge.exe	msedge.exe
PID 1344 wrote to memory of 3560	1344	msedge.exe	msedge.exe
PID 1344 wrote to memory of 3560	1344	msedge.exe	msedge.exe
PID 1344 wrote to memory of 3560	1344	msedge.exe	msedge.exe
PID 1344 wrote to memory of 3560	1344	msedge.exe	msedge.exe
PID 1344 wrote to memory of 1428	1344	msedge.exe	msedge.exe
PID 1344 wrote to memory of 1428	1344	msedge.exe	msedge.exe
PID 1344 wrote to memory of 1432	1344	msedge.exe	msedge.exe
PID 1344 wrote to memory of 1432	1344	msedge.exe	msedge.exe
PID 1344 wrote to memory of 1432	1344	msedge.exe	msedge.exe
PID 1344 wrote to memory of 1432	1344	msedge.exe	msedge.exe
PID 1344 wrote to memory of 1432	1344	msedge.exe	msedge.exe
PID 1344 wrote to memory of 1432	1344	msedge.exe	msedge.exe
PID 1344 wrote to memory of 1432	1344	msedge.exe	msedge.exe
PID 1344 wrote to memory of 1432	1344	msedge.exe	msedge.exe
PID 1344 wrote to memory of 1432	1344	msedge.exe	msedge.exe
PID 1344 wrote to memory of 1432	1344	msedge.exe	msedge.exe
PID 1344 wrote to memory of 1432	1344	msedge.exe	msedge.exe
PID 1344 wrote to memory of 1432	1344	msedge.exe	msedge.exe
PID 1344 wrote to memory of 1432	1344	msedge.exe	msedge.exe
PID 1344 wrote to memory of 1432	1344	msedge.exe	msedge.exe
PID 1344 wrote to memory of 1432	1344	msedge.exe	msedge.exe
PID 1344 wrote to memory of 1432	1344	msedge.exe	msedge.exe
PID 1344 wrote to memory of 1432	1344	msedge.exe	msedge.exe
PID 1344 wrote to memory of 1432	1344	msedge.exe	msedge.exe
PID 1344 wrote to memory of 1432	1344	msedge.exe	msedge.exe
PID 1344 wrote to memory of 1432	1344	msedge.exe	msedge.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell start shell:Appsfolder\Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge https://workupload.com/file/SaZEYKEFmA3
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4828

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-redirect=Windows.Launch https://workupload.com/file/SaZEYKEFmA3
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1344

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffef53146f8,0x7ffef5314708,0x7ffef5314718
2⤵
PID:1072

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2232,199356787235991473,9701242057450088555,131072 --lang=it --service-sandbox-type=utility --mojo-platform-channel-handle=2652 /prefetch:8
2⤵
PID:1432

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2232,199356787235991473,9701242057450088555,131072 --lang=it --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1428

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2232,199356787235991473,9701242057450088555,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2244 /prefetch:2
2⤵
PID:3560

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,199356787235991473,9701242057450088555,131072 --lang=it --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
2⤵
PID:4048

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,199356787235991473,9701242057450088555,131072 --lang=it --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
2⤵
PID:728

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2232,199356787235991473,9701242057450088555,131072 --lang=it --service-sandbox-type=none --mojo-platform-channel-handle=5232 /prefetch:8
2⤵
PID:4512

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2232,199356787235991473,9701242057450088555,131072 --lang=it --service-sandbox-type=none --mojo-platform-channel-handle=5232 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4044

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,199356787235991473,9701242057450088555,131072 --lang=it --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
2⤵
PID:4688

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,199356787235991473,9701242057450088555,131072 --lang=it --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
2⤵
PID:1356

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,199356787235991473,9701242057450088555,131072 --lang=it --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
2⤵
PID:4112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,199356787235991473,9701242057450088555,131072 --lang=it --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
2⤵
PID:2240

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,199356787235991473,9701242057450088555,131072 --lang=it --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:1
2⤵
PID:3596

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2232,199356787235991473,9701242057450088555,131072 --lang=it --service-sandbox-type=collections --mojo-platform-channel-handle=5336 /prefetch:8
2⤵
PID:4444

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2232,199356787235991473,9701242057450088555,131072 --lang=it --service-sandbox-type=none --mojo-platform-channel-handle=6040 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4512

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,199356787235991473,9701242057450088555,131072 --lang=it --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3492 /prefetch:1
2⤵
PID:4472

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3052

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:888

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1412

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\New_Version_Setup_2024_Use_PassKey.rar"
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3684

C:\Users\Admin\Desktop\test\Setup.exe
"C:\Users\Admin\Desktop\test\Setup.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:5480

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe"
2⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:5720

C:\ProgramData\18323036165062766622.exe
"C:\ProgramData\18323036165062766622.exe"
3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:3952

C:\Users\Admin\AppData\Local\Temp\c2868ed41c\jbruyer.exe
"C:\Users\Admin\AppData\Local\Temp\c2868ed41c\jbruyer.exe"
4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4976

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN jbruyer.exe /TR "C:\Users\Admin\AppData\Local\Temp\c2868ed41c\jbruyer.exe" /F
5⤵
- Creates scheduled task(s)
PID:3824

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "jbruyer.exe" /P "Admin:N"&&CACLS "jbruyer.exe" /P "Admin:R" /E&&echo Y|CACLS "..\c2868ed41c" /P "Admin:N"&&CACLS "..\c2868ed41c" /P "Admin:R" /E&&Exit
5⤵
PID:2380

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
6⤵
PID:4568

C:\Windows\SysWOW64\cacls.exe
CACLS "jbruyer.exe" /P "Admin:N"
6⤵
PID:4720

C:\Windows\SysWOW64\cacls.exe
CACLS "jbruyer.exe" /P "Admin:R" /E
6⤵
PID:452

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
6⤵
PID:2792

C:\Windows\SysWOW64\cacls.exe
CACLS "..\c2868ed41c" /P "Admin:N"
6⤵
PID:32

C:\Windows\SysWOW64\cacls.exe
CACLS "..\c2868ed41c" /P "Admin:R" /E
6⤵
PID:3808

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Local\Temp\1000001061\app64.dll, rundll
5⤵
- Loads dropped DLL
PID:5220

C:\Windows\system32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Local\Temp\1000001061\app64.dll, rundll
6⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:5236

C:\Users\Admin\AppData\Local\Temp\1000002051\stub_186.exe
"C:\Users\Admin\AppData\Local\Temp\1000002051\stub_186.exe"
5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5384

C:\Windows\SysWOW64\ftp.exe
"C:\Windows\SysWOW64\ftp.exe"
6⤵
PID:4212

C:\Users\Admin\AppData\Local\Temp\c2868ed41c\jbruyer.exe
C:\Users\Admin\AppData\Local\Temp\c2868ed41c\jbruyer.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4576

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\18323036165062766622.exe
Filesize
5.2MB

MD5
5c64ac5873dd0874d460b752defa48ba

SHA1
35cc5084728dd6373d68ba78391ec2f516759b36

SHA256
eb24aebcbea0b16f08ef20d1b9ae3d7d5062dbe993891b4b1362d4f866179567

SHA512
b381063a58520598328264a9af8da6eca434209930aa51964691d4064fa0204ae5d94115ce740ea10a6b6401d7c4bafe10614aab9a505b35d22f930eace9ce4a

Download Submit
C:\ProgramData\18323036165062766622.exe
Filesize
5.2MB

MD5
5c64ac5873dd0874d460b752defa48ba

SHA1
35cc5084728dd6373d68ba78391ec2f516759b36

SHA256
eb24aebcbea0b16f08ef20d1b9ae3d7d5062dbe993891b4b1362d4f866179567

SHA512
b381063a58520598328264a9af8da6eca434209930aa51964691d4064fa0204ae5d94115ce740ea10a6b6401d7c4bafe10614aab9a505b35d22f930eace9ce4a

Download Submit
C:\ProgramData\18323036165062766622.exe
Filesize
5.2MB

MD5
5c64ac5873dd0874d460b752defa48ba

SHA1
35cc5084728dd6373d68ba78391ec2f516759b36

SHA256
eb24aebcbea0b16f08ef20d1b9ae3d7d5062dbe993891b4b1362d4f866179567

SHA512
b381063a58520598328264a9af8da6eca434209930aa51964691d4064fa0204ae5d94115ce740ea10a6b6401d7c4bafe10614aab9a505b35d22f930eace9ce4a

Download Submit
C:\ProgramData\mozglue.dll
Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\ProgramData\nss3.dll
Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
fc99b0086d7714fd471ed4acc862ccc0

SHA1
39a3c43c97f778d67413a023d66e8e930d0e2314

SHA256
45ef01f81605bfd96126d5520c5aa0304c7fa7d5fdb3e4d5b2dd2bf84e2afd96

SHA512
c308fa3eda9235d67a506a5f058fefb9a769ec01d7b0d4f5a2397892cc4f8155301c55c1fac23bebacdd087ab3f47f1eacc9ff88eff4115a7d67aa7b1d6581a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
120B

MD5
9608de55eb5912b92831e9157e6474d4

SHA1
c97931c528f4cf069baaed0550a2bc2cdbbb4374

SHA256
7edac1c73139c98d00d97b718675b7cca3ee0ff0672abee427173c0d7c51e412

SHA512
a4a817242fb17453249a1fb03ede2cc736289f889e617ad3b122575ab53a58125ae6649e5491791b8a187d50d4f8f9b84cd5cf8cc75fbdd47abcd97bd6caf30f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies
Filesize
20KB

MD5
70b87746ae9734473c2e49fe0473647c

SHA1
cea6929fc5cf16450f8b587eda6988bac89b757a

SHA256
7bebbcc82a07e2f83fd0412cb2f859dfa3592467f5ec3fe3f401ac3f5b2424c9

SHA512
b8509f96d5eaf9b141b6c1f5418b98cbdec076c65d1dffe75402ca9d20d91bb9adb117da84530a6e6a038e650b3a3f274316cc895fbc2b02bc80807a3dd7e839

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Filesize
124KB

MD5
3b496ef368a7e4d3f06125a4150cdaf5

SHA1
0054c1cf7de00859aaefb40d5147d770a4f45a67

SHA256
6394eb1e08248be44e47c964ca3648655a4663ec9d6668587aa71e8483a43c61

SHA512
829f06b15680bb986c4e9ac5bf6c699ec584adb9c9d4137822ec702d4532879902219e5e48299b25b9b9ac49a625b9fb7734e011e9b9f50f57d882cdf0c04f51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
7c4a05882b5c62cee4d8768552d71ce4

SHA1
c2315f74c4480afe897ef00898b8f77e64fb4674

SHA256
d0d3eead41b7009764b0a836929a15767f27d344f2db7cf57e9610b58224112b

SHA512
6bd478221ef0ff0f8075dddfcc858d562d105006f826df33a1d795b5f67cf9ba3b2144dabab8ded6f2267cb6ee4eb2a8526523dd1ae375ec005f785bf4fca848

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
2d7565e89068d8e9e96a3ca81b417bc1

SHA1
02a329f8a167458a37e9f183e7b1dfad46306ec6

SHA256
60d7f93fcaeefe2721ab975c071112e847bcca3f99d8f73830af6973147012ea

SHA512
06077258fcada3ec6ae527808eaaea199ddf6bc692f57318dc0afe506a07404986f6c31d5f1090a9b010f320978ff3456273e812768290e813fe0022123b115c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
6c568d3c4872e7436bd97df0917ee1ba

SHA1
20a72c71b1ebd5f6faf8f45063f3c053c463bb3f

SHA256
b05dc5fe3bd2e856ff523901b54e28f8c46900c032b53a85da68bd4db8f2ceb6

SHA512
969819b74f198d1e0c5b67082a5c957b541726c273ef10f3cf3aac1bfad7ceeabf16ad9cc9d4b9a8a718a1e7c2625a358aeb77582afd86b35f98a39c3d008485

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
3ef3c8b353057450a3dcdae0c64b8f65

SHA1
de0115052a3907111065165b428cca9830a1654d

SHA256
def2507c8a99853cd752bf1277c05a5fd01636c5fb34d7e46038688f89e246ab

SHA512
b9dd926d2e53997b4640de31e813e0a3f978d81266cb14843c44671b3efda7531423f38811a0ad1cd7906dd07168104120f51fd3bb60c8f9f2872ca6b6ea8f32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Filesize
24KB

MD5
96f00bbd6a174879c58220f95f0115f5

SHA1
d3d7f82b0bf27daf1b3903bfe050c2d05422050f

SHA256
644442e740a8c0bb20f712f6f84f5bf4a81bb29d4e9446b2832ca65618961107

SHA512
e7c5e90eb85aee7b81b9c163f618ad3789a48b256040f6f00eee7fce52c60e1ff491bf0538b9c846fb115b73163710e46a45ce056e3b41ca59d88c421502ccea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
13KB

MD5
b728f863a99f3cad9414768a37f12820

SHA1
4c9547e026b0c46da8677b82449df11ffccfdbaa

SHA256
cc225e16fbabc8e62e754e904a17ff4049ebc5b6109e1c824a1c8d08c4e36515

SHA512
793be5ce9a60b699afe7897022690e9dce4c90a25d95d32bcde03066145427710ad3ce5cfb7d53541324ddbe3a765efde7e639e1120934ca36fbb5ac3f7ec523

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
33bdcac0f95a188880d3ac46625b31c7

SHA1
de48d925b317644e1b2fcc2f319f1cbc4b2eda25

SHA256
78e2541c52dc2ab36326023c7baf984b61ed2efcb14ca4f2fea96f9c7c26bd65

SHA512
531956c0185a2699d890ed300a0fb869582d77764c8852c45cc4712d02ecb31b220f5b7f102ff395b840d2ab9ee8ad43a2a45fb9c7ce495b1f794433dd1c6ab9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
7f788465e5b23c06860ec62bdeacbb51

SHA1
e896650eb7b989ef9b3b798027c9014cbe2a8160

SHA256
b4693fb6f9238a9524003ba07229d8ddeeab749b59d99921aa4ca6d4517f0499

SHA512
a94ad121de17674f5c9308d8601b024fd74ef60ec3b05ce65c2f32eb53b5cde6b8b4aa713ae7bcf57a00c3309239b399b1b9f8de31b5f423ca5f1967b6e9d395

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000001061\app64.dll
Filesize
3.4MB

MD5
4aa7e4b29ba9c9c9a44ed8c096758956

SHA1
253c8ec8609c83bd5e801b9c0bba98342ccabe1d

SHA256
ff095e003a2c682f621f38fb626de2634479216803a401a144650b5fb24b9c7c

SHA512
b7d81efedd2a3284be3d85bdfadf03ce2e2c13b413aaca0e7b5a475ee66c1ce92322c2735a1c7bf834f50f2b1aa3bb951c36ca9d59c8e7a95745aa2300a54da8

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000001061\app64.dll
Filesize
3.4MB

MD5
4aa7e4b29ba9c9c9a44ed8c096758956

SHA1
253c8ec8609c83bd5e801b9c0bba98342ccabe1d

SHA256
ff095e003a2c682f621f38fb626de2634479216803a401a144650b5fb24b9c7c

SHA512
b7d81efedd2a3284be3d85bdfadf03ce2e2c13b413aaca0e7b5a475ee66c1ce92322c2735a1c7bf834f50f2b1aa3bb951c36ca9d59c8e7a95745aa2300a54da8

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000001061\app64.dll
Filesize
3.4MB

MD5
4aa7e4b29ba9c9c9a44ed8c096758956

SHA1
253c8ec8609c83bd5e801b9c0bba98342ccabe1d

SHA256
ff095e003a2c682f621f38fb626de2634479216803a401a144650b5fb24b9c7c

SHA512
b7d81efedd2a3284be3d85bdfadf03ce2e2c13b413aaca0e7b5a475ee66c1ce92322c2735a1c7bf834f50f2b1aa3bb951c36ca9d59c8e7a95745aa2300a54da8

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000001061\app64.dll
Filesize
3.4MB

MD5
4aa7e4b29ba9c9c9a44ed8c096758956

SHA1
253c8ec8609c83bd5e801b9c0bba98342ccabe1d

SHA256
ff095e003a2c682f621f38fb626de2634479216803a401a144650b5fb24b9c7c

SHA512
b7d81efedd2a3284be3d85bdfadf03ce2e2c13b413aaca0e7b5a475ee66c1ce92322c2735a1c7bf834f50f2b1aa3bb951c36ca9d59c8e7a95745aa2300a54da8

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000002051\stub_186.exe
Filesize
3.7MB

MD5
0f3a69075e511390b5fdb4687f47ea0b

SHA1
53de378df43435b0260d053243b1f75f63a3df85

SHA256
693cace37b4b6fed2ca67906c7a4b1c11273110561a207a222aa4e62fb4a184a

SHA512
d2ab99d50e30d3c3edea49480ceae1f45516f673ec7cc67499ec155f488b31a9e071ebca8d75d73f57ce08d7370396c7d074b41b37e66c1591f8774cbace965f

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000002051\stub_186.exe
Filesize
3.7MB

MD5
0f3a69075e511390b5fdb4687f47ea0b

SHA1
53de378df43435b0260d053243b1f75f63a3df85

SHA256
693cace37b4b6fed2ca67906c7a4b1c11273110561a207a222aa4e62fb4a184a

SHA512
d2ab99d50e30d3c3edea49480ceae1f45516f673ec7cc67499ec155f488b31a9e071ebca8d75d73f57ce08d7370396c7d074b41b37e66c1591f8774cbace965f

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000002051\stub_186.exe
Filesize
3.7MB

MD5
0f3a69075e511390b5fdb4687f47ea0b

SHA1
53de378df43435b0260d053243b1f75f63a3df85

SHA256
693cace37b4b6fed2ca67906c7a4b1c11273110561a207a222aa4e62fb4a184a

SHA512
d2ab99d50e30d3c3edea49480ceae1f45516f673ec7cc67499ec155f488b31a9e071ebca8d75d73f57ce08d7370396c7d074b41b37e66c1591f8774cbace965f

Download Submit
C:\Users\Admin\AppData\Local\Temp\420546310613
Filesize
81KB

MD5
53997599b1fac19ebf364e8b4c69b2de

SHA1
7ad467d0326cfa3cbbf0ab553a9ed63640304d29

SHA256
a32594bf05650f439c702d03bbd5a4dbe9a005b7e1c922c849fed44202c5a49d

SHA512
2ab1b8b3c52f901953ea3871d4a4f33a7d8ea881758d995472839168020ef9bae8cda30b23e13595dd920a716d98940f0410f52a4513c20150393e91f7e9c1be

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5ca34mi5.y4p.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\c2868ed41c\jbruyer.exe
Filesize
5.2MB

MD5
5c64ac5873dd0874d460b752defa48ba

SHA1
35cc5084728dd6373d68ba78391ec2f516759b36

SHA256
eb24aebcbea0b16f08ef20d1b9ae3d7d5062dbe993891b4b1362d4f866179567

SHA512
b381063a58520598328264a9af8da6eca434209930aa51964691d4064fa0204ae5d94115ce740ea10a6b6401d7c4bafe10614aab9a505b35d22f930eace9ce4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\c2868ed41c\jbruyer.exe
Filesize
5.2MB

MD5
5c64ac5873dd0874d460b752defa48ba

SHA1
35cc5084728dd6373d68ba78391ec2f516759b36

SHA256
eb24aebcbea0b16f08ef20d1b9ae3d7d5062dbe993891b4b1362d4f866179567

SHA512
b381063a58520598328264a9af8da6eca434209930aa51964691d4064fa0204ae5d94115ce740ea10a6b6401d7c4bafe10614aab9a505b35d22f930eace9ce4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\c2868ed41c\jbruyer.exe
Filesize
5.2MB

MD5
5c64ac5873dd0874d460b752defa48ba

SHA1
35cc5084728dd6373d68ba78391ec2f516759b36

SHA256
eb24aebcbea0b16f08ef20d1b9ae3d7d5062dbe993891b4b1362d4f866179567

SHA512
b381063a58520598328264a9af8da6eca434209930aa51964691d4064fa0204ae5d94115ce740ea10a6b6401d7c4bafe10614aab9a505b35d22f930eace9ce4a

Download Submit
C:\Users\Admin\Desktop\test\Setup.exe
Filesize
2.5MB

MD5
ff6b04e73e7d24162e9bf830ef495b04

SHA1
15bf389c222bd079a587c6669f2283b3971cc56d

SHA256
3b20ec2bdef46b382bbc9ac52438c4db531cf6577d5811ca92b98855a1be9821

SHA512
5fedad2d47c29eede80f99cb6f94c7e9e2ebf2b633e8c94a88c83eb50bcd721b06153e33a7aea508dd7c6681b9fbef07b1402d5b1432e25ff83984c2ff0fcdf8

Download Submit
C:\Users\Admin\Desktop\test\Setup.exe
Filesize
2.5MB

MD5
ff6b04e73e7d24162e9bf830ef495b04

SHA1
15bf389c222bd079a587c6669f2283b3971cc56d

SHA256
3b20ec2bdef46b382bbc9ac52438c4db531cf6577d5811ca92b98855a1be9821

SHA512
5fedad2d47c29eede80f99cb6f94c7e9e2ebf2b633e8c94a88c83eb50bcd721b06153e33a7aea508dd7c6681b9fbef07b1402d5b1432e25ff83984c2ff0fcdf8

Download Submit
C:\Users\Admin\Downloads\New_Version_Setup_2024_Use_PassKey.rar
Filesize
22.4MB

MD5
fd3634d156fd918133313761493a1e52

SHA1
11cf13329b3a2459f7ed2b746314448d60974846

SHA256
f18950f722c42566c711f7a3508e90ddd323a6379cfaa9190c384464b4def314

SHA512
c21c59a5b4b80001856585ab7eeec808a5d93c3667f1c452ea7e97a9dd88b697ea7857b526323918b762780e6eb1a5f52355c736e535119271d94e0e43dc3ce6

Download Submit
C:\Users\Admin\Downloads\Non confermato 47053.crdownload
Filesize
22.4MB

MD5
fd3634d156fd918133313761493a1e52

SHA1
11cf13329b3a2459f7ed2b746314448d60974846

SHA256
f18950f722c42566c711f7a3508e90ddd323a6379cfaa9190c384464b4def314

SHA512
c21c59a5b4b80001856585ab7eeec808a5d93c3667f1c452ea7e97a9dd88b697ea7857b526323918b762780e6eb1a5f52355c736e535119271d94e0e43dc3ce6

Download Submit
\??\pipe\LOCAL\crashpad_1344_IJWIPWJCGLQYNTZR
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/3952-2836-0x0000000000FE0000-0x000000000153A000-memory.dmp

Filesize
5.4MB

Download
memory/3952-2822-0x00000000773C4000-0x00000000773C6000-memory.dmp

Filesize
8KB

Download
memory/3952-2818-0x0000000076430000-0x0000000076520000-memory.dmp

Filesize
960KB

Download
memory/3952-2816-0x0000000000FE0000-0x000000000153A000-memory.dmp

Filesize
5.4MB

Download
memory/3952-2821-0x0000000076430000-0x0000000076520000-memory.dmp

Filesize
960KB

Download
memory/3952-2820-0x0000000076430000-0x0000000076520000-memory.dmp

Filesize
960KB

Download
memory/3952-2823-0x0000000000FE0000-0x000000000153A000-memory.dmp

Filesize
5.4MB

Download
memory/3952-2824-0x0000000000FE0000-0x000000000153A000-memory.dmp

Filesize
5.4MB

Download
memory/3952-2825-0x0000000000FE0000-0x000000000153A000-memory.dmp

Filesize
5.4MB

Download
memory/3952-2840-0x0000000076430000-0x0000000076520000-memory.dmp

Filesize
960KB

Download
memory/3952-2826-0x0000000000FE0000-0x000000000153A000-memory.dmp

Filesize
5.4MB

Download
memory/3952-2819-0x0000000076430000-0x0000000076520000-memory.dmp

Filesize
960KB

Download
memory/4576-2905-0x0000000076430000-0x0000000076520000-memory.dmp

Filesize
960KB

Download
memory/4576-2914-0x0000000076430000-0x0000000076520000-memory.dmp

Filesize
960KB

Download
memory/4576-2906-0x0000000076430000-0x0000000076520000-memory.dmp

Filesize
960KB

Download
memory/4576-2911-0x0000000000F20000-0x000000000147A000-memory.dmp

Filesize
5.4MB

Download
memory/4576-2910-0x0000000000F20000-0x000000000147A000-memory.dmp

Filesize
5.4MB

Download
memory/4576-2907-0x0000000076430000-0x0000000076520000-memory.dmp

Filesize
960KB

Download
memory/4576-2909-0x0000000076430000-0x0000000076520000-memory.dmp

Filesize
960KB

Download
memory/4576-2908-0x0000000000F20000-0x000000000147A000-memory.dmp

Filesize
5.4MB

Download
memory/4576-2915-0x0000000000F20000-0x000000000147A000-memory.dmp

Filesize
5.4MB

Download
memory/4828-148-0x0000025272990000-0x00000252729A0000-memory.dmp

Filesize
64KB

Download
memory/4828-146-0x00007FFEFDEE0000-0x00007FFEFE9A1000-memory.dmp

Filesize
10.8MB

Download
memory/4828-147-0x0000025272990000-0x00000252729A0000-memory.dmp

Filesize
64KB

Download
memory/4828-145-0x0000025273660000-0x0000025273762000-memory.dmp

Filesize
1.0MB

Download
memory/4828-149-0x0000025272990000-0x00000252729A0000-memory.dmp

Filesize
64KB

Download
memory/4828-144-0x00000252724E0000-0x00000252724F0000-memory.dmp

Filesize
64KB

Download
memory/4828-139-0x0000025272890000-0x00000252728B2000-memory.dmp

Filesize
136KB

Download
memory/4828-153-0x00007FFEFDEE0000-0x00007FFEFE9A1000-memory.dmp

Filesize
10.8MB

Download
memory/4828-133-0x00000252728F0000-0x0000025272972000-memory.dmp

Filesize
520KB

Download
memory/4976-2844-0x0000000000F20000-0x000000000147A000-memory.dmp

Filesize
5.4MB

Download
memory/4976-2876-0x0000000000F20000-0x000000000147A000-memory.dmp

Filesize
5.4MB

Download
memory/4976-2902-0x0000000000F20000-0x000000000147A000-memory.dmp

Filesize
5.4MB

Download
memory/4976-2901-0x0000000076430000-0x0000000076520000-memory.dmp

Filesize
960KB

Download
memory/4976-2881-0x0000000076430000-0x0000000076520000-memory.dmp

Filesize
960KB

Download
memory/4976-2879-0x0000000076430000-0x0000000076520000-memory.dmp

Filesize
960KB

Download
memory/4976-2878-0x0000000076430000-0x0000000076520000-memory.dmp

Filesize
960KB

Download
memory/4976-2842-0x0000000076430000-0x0000000076520000-memory.dmp

Filesize
960KB

Download
memory/4976-2841-0x0000000076430000-0x0000000076520000-memory.dmp

Filesize
960KB

Download
memory/4976-2847-0x0000000000F20000-0x000000000147A000-memory.dmp

Filesize
5.4MB

Download
memory/4976-2846-0x0000000000F20000-0x000000000147A000-memory.dmp

Filesize
5.4MB

Download
memory/4976-2838-0x0000000000F20000-0x000000000147A000-memory.dmp

Filesize
5.4MB

Download
memory/4976-2845-0x0000000000F20000-0x000000000147A000-memory.dmp

Filesize
5.4MB

Download
memory/4976-2839-0x0000000076430000-0x0000000076520000-memory.dmp

Filesize
960KB

Download
memory/4976-2843-0x0000000076430000-0x0000000076520000-memory.dmp

Filesize
960KB

Download
memory/5236-2875-0x00007FFEFE060000-0x00007FFEFE599000-memory.dmp

Filesize
5.2MB

Download
memory/5480-2707-0x0000000005180000-0x0000000005195000-memory.dmp

Filesize
84KB

Download
memory/5480-2691-0x0000000005180000-0x0000000005195000-memory.dmp

Filesize
84KB

Download
memory/5480-2711-0x0000000005180000-0x0000000005195000-memory.dmp

Filesize
84KB

Download
memory/5480-2714-0x00000000051B0000-0x00000000051B1000-memory.dmp

Filesize
4KB

Download
memory/5480-2683-0x0000000074000000-0x00000000747B0000-memory.dmp

Filesize
7.7MB

Download
memory/5480-2684-0x00000000005A0000-0x0000000000830000-memory.dmp

Filesize
2.6MB

Download
memory/5480-2709-0x0000000005180000-0x0000000005195000-memory.dmp

Filesize
84KB

Download
memory/5480-2685-0x00000000051C0000-0x00000000051D0000-memory.dmp

Filesize
64KB

Download
memory/5480-2705-0x0000000005180000-0x0000000005195000-memory.dmp

Filesize
84KB

Download
memory/5480-2703-0x0000000005180000-0x0000000005195000-memory.dmp

Filesize
84KB

Download
memory/5480-2701-0x0000000005180000-0x0000000005195000-memory.dmp

Filesize
84KB

Download
memory/5480-2686-0x0000000005150000-0x0000000005151000-memory.dmp

Filesize
4KB

Download
memory/5480-2719-0x0000000074000000-0x00000000747B0000-memory.dmp

Filesize
7.7MB

Download
memory/5480-2687-0x0000000005270000-0x000000000530C000-memory.dmp

Filesize
624KB

Download
memory/5480-2688-0x0000000074000000-0x00000000747B0000-memory.dmp

Filesize
7.7MB

Download
memory/5480-2689-0x00000000051C0000-0x00000000051D0000-memory.dmp

Filesize
64KB

Download
memory/5480-2699-0x0000000005180000-0x0000000005195000-memory.dmp

Filesize
84KB

Download
memory/5480-2697-0x0000000005180000-0x0000000005195000-memory.dmp

Filesize
84KB

Download
memory/5480-2695-0x0000000005180000-0x0000000005195000-memory.dmp

Filesize
84KB

Download
memory/5480-2690-0x0000000005180000-0x0000000005195000-memory.dmp

Filesize
84KB

Download
memory/5480-2713-0x0000000005180000-0x0000000005195000-memory.dmp

Filesize
84KB

Download
memory/5480-2693-0x0000000005180000-0x0000000005195000-memory.dmp

Filesize
84KB

Download
memory/5720-2814-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/5720-2804-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/5720-2803-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/5720-2730-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/5720-2720-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/5720-2718-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/5720-2817-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/5720-2717-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/5720-2715-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download