bitrat | aa79d46aa459af0d46da380af6481f51369da4c4080a009028e83857dcd844f2

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/07/2024, 05:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
21434ba1af9e80e0bb9d4e49e643d269_JaffaCakes118.exe
Size 2.8MB
Sample240703-gefq7azelg
SHA256 aa79d46aa459af0d46da380af6481f51369da4c4080a009028e83857dcd844f2
MD5 21434ba1af9e80e0bb9d4e49e643d269
SHA1 c460ce1a3fd7c3c5af78ab01a18bc62bcf3a8c8b
SHA512 012a96b51ee1cefa86c0bfca56f0fe2a0e3d7ec061fa6868184234338dd5f2329bc0de2298d4a782c3e2bdb4bd665fd373adad6f28f26c2c6439972280d9d7b8
SSDEEP 49152:AS4o6fCn0IO2N7Sb/h0vQV2vMHZYd6GZC+8qBBVRlEt73LfsL6kVOSo3dAf2doBn:AG0aw/8HWZY/A+8qvfli7fsLHgSw7G5P
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

bitrat discovery trojan upx

Malware Config

Extracted

Family

bitrat

Version

1.34

curtisusa.hopto.org:5215

Attributes

communication_password
ee342c2505c08512ed898d3855498f1a
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat
Downloads MZ/PE file

Checks computer location settings 2 TTPs 7 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	Amazon Games UI.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	Amazon Games UI.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	21434ba1af9e80e0bb9d4e49e643d269_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	LIXVoWXPPCyc5Jy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	Amazon Games Services.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	Amazon Games UI.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	Amazon Games UI.exe

Executes dropped EXE 11 IoCs

pid	Process
416	LIXVoWXPPCyc5Jy.exe
2992	AmazonGamesSetup.exe
3400	Amazon Games Setup.exe
4960	Amazon Games.exe
3232	Amazon Games Services.exe
5004	Amazon Games UI.exe
424	Amazon Games UI.exe
4708	Amazon Games UI.exe
1176	Amazon Games UI.exe
3660	Amazon Games UI.exe
876	Amazon Games UI.exe

Loads dropped DLL 64 IoCs

pid	Process
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3280-316-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/3280-318-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/3280-317-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/3280-409-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/3280-421-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/3280-429-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/3280-525-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/3280-526-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/3280-1410-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/3280-1411-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/3280-1633-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/3280-1634-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/3280-1636-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/3280-1637-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/3280-1742-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/3280-1743-0x0000000000400000-0x00000000007E4000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
3280	MSBuild.exe
3280	MSBuild.exe
3280	MSBuild.exe
3280	MSBuild.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 416 set thread context of 3280	416	LIXVoWXPPCyc5Jy.exe	94

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 18 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\amazon-games\ = "URL: Amazon Games Handler"	Amazon Games Services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\amazon-games\shell\open	Amazon Games Services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\amazon-games\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Amazon Games\\App\\Amazon Games.exe\" \"%1\""	Amazon Games Services.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\amazon-games\DefaultIcon	Amazon Games Services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\amazon-games\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Amazon Games\\App\\Amazon Games.exe"	Amazon Games Services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\amazon-games\shell	Amazon Games Services.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\amazon-games\ = "URL:Amazon Games Client Handler"	Amazon Games Services.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\amazon-games\URL Protocol	Amazon Games Services.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\amazon-games\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Amazon Games\\App\\Amazon Games.exe"	Amazon Games Services.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\amazon-games\shell	Amazon Games Services.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\amazon-games\shell\open	Amazon Games Services.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\amazon-games\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Amazon Games\\App\\Amazon Games.exe\" \"%1\""	Amazon Games Services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\amazon-games	Amazon Games Services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\amazon-games\URL Protocol	Amazon Games Services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\amazon-games\DefaultIcon	Amazon Games Services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\amazon-games\shell\open\command	Amazon Games Services.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\amazon-games	Amazon Games Services.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\amazon-games\shell\open\command	Amazon Games Services.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
992	schtasks.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
416	LIXVoWXPPCyc5Jy.exe
4960	Amazon Games.exe
4960	Amazon Games.exe
4960	Amazon Games.exe
4960	Amazon Games.exe
4960	Amazon Games.exe
4960	Amazon Games.exe
4960	Amazon Games.exe
4960	Amazon Games.exe
4960	Amazon Games.exe
4960	Amazon Games.exe
4960	Amazon Games.exe
4960	Amazon Games.exe
4960	Amazon Games.exe
4960	Amazon Games.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
4960	Amazon Games.exe
4960	Amazon Games.exe
4708	Amazon Games UI.exe
4708	Amazon Games UI.exe
1176	Amazon Games UI.exe
1176	Amazon Games UI.exe
3660	Amazon Games UI.exe
3660	Amazon Games UI.exe
876	Amazon Games UI.exe
876	Amazon Games UI.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	416	LIXVoWXPPCyc5Jy.exe
Token: SeShutdownPrivilege	3280	MSBuild.exe
Token: SeDebugPrivilege	3232	Amazon Games Services.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3232	Amazon Games Services.exe
5004	Amazon Games UI.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3280	MSBuild.exe
3280	MSBuild.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3664 wrote to memory of 416	3664	21434ba1af9e80e0bb9d4e49e643d269_JaffaCakes118.exe	80
PID 3664 wrote to memory of 416	3664	21434ba1af9e80e0bb9d4e49e643d269_JaffaCakes118.exe	80
PID 3664 wrote to memory of 416	3664	21434ba1af9e80e0bb9d4e49e643d269_JaffaCakes118.exe	80
PID 3664 wrote to memory of 2992	3664	21434ba1af9e80e0bb9d4e49e643d269_JaffaCakes118.exe	81
PID 3664 wrote to memory of 2992	3664	21434ba1af9e80e0bb9d4e49e643d269_JaffaCakes118.exe	81
PID 3664 wrote to memory of 2992	3664	21434ba1af9e80e0bb9d4e49e643d269_JaffaCakes118.exe	81
PID 2992 wrote to memory of 3400	2992	AmazonGamesSetup.exe	83
PID 2992 wrote to memory of 3400	2992	AmazonGamesSetup.exe	83
PID 2992 wrote to memory of 3400	2992	AmazonGamesSetup.exe	83
PID 416 wrote to memory of 992	416	LIXVoWXPPCyc5Jy.exe	92
PID 416 wrote to memory of 992	416	LIXVoWXPPCyc5Jy.exe	92
PID 416 wrote to memory of 992	416	LIXVoWXPPCyc5Jy.exe	92
PID 416 wrote to memory of 3280	416	LIXVoWXPPCyc5Jy.exe	94
PID 416 wrote to memory of 3280	416	LIXVoWXPPCyc5Jy.exe	94
PID 416 wrote to memory of 3280	416	LIXVoWXPPCyc5Jy.exe	94
PID 416 wrote to memory of 3280	416	LIXVoWXPPCyc5Jy.exe	94
PID 416 wrote to memory of 3280	416	LIXVoWXPPCyc5Jy.exe	94
PID 416 wrote to memory of 3280	416	LIXVoWXPPCyc5Jy.exe	94
PID 416 wrote to memory of 3280	416	LIXVoWXPPCyc5Jy.exe	94
PID 3400 wrote to memory of 4960	3400	Amazon Games Setup.exe	96
PID 3400 wrote to memory of 4960	3400	Amazon Games Setup.exe	96
PID 3400 wrote to memory of 4960	3400	Amazon Games Setup.exe	96
PID 4960 wrote to memory of 3232	4960	Amazon Games.exe	98
PID 4960 wrote to memory of 3232	4960	Amazon Games.exe	98
PID 4960 wrote to memory of 3232	4960	Amazon Games.exe	98
PID 4960 wrote to memory of 5004	4960	Amazon Games.exe	99
PID 4960 wrote to memory of 5004	4960	Amazon Games.exe	99
PID 4960 wrote to memory of 5004	4960	Amazon Games.exe	99
PID 5004 wrote to memory of 424	5004	Amazon Games UI.exe	100
PID 5004 wrote to memory of 424	5004	Amazon Games UI.exe	100
PID 5004 wrote to memory of 424	5004	Amazon Games UI.exe	100
PID 5004 wrote to memory of 424	5004	Amazon Games UI.exe	100
PID 5004 wrote to memory of 424	5004	Amazon Games UI.exe	100
PID 5004 wrote to memory of 424	5004	Amazon Games UI.exe	100
PID 5004 wrote to memory of 424	5004	Amazon Games UI.exe	100
PID 5004 wrote to memory of 424	5004	Amazon Games UI.exe	100
PID 5004 wrote to memory of 424	5004	Amazon Games UI.exe	100
PID 5004 wrote to memory of 424	5004	Amazon Games UI.exe	100
PID 5004 wrote to memory of 424	5004	Amazon Games UI.exe	100
PID 5004 wrote to memory of 424	5004	Amazon Games UI.exe	100
PID 5004 wrote to memory of 424	5004	Amazon Games UI.exe	100
PID 5004 wrote to memory of 424	5004	Amazon Games UI.exe	100
PID 5004 wrote to memory of 424	5004	Amazon Games UI.exe	100
PID 5004 wrote to memory of 424	5004	Amazon Games UI.exe	100
PID 5004 wrote to memory of 424	5004	Amazon Games UI.exe	100
PID 5004 wrote to memory of 424	5004	Amazon Games UI.exe	100
PID 5004 wrote to memory of 424	5004	Amazon Games UI.exe	100
PID 5004 wrote to memory of 424	5004	Amazon Games UI.exe	100
PID 5004 wrote to memory of 424	5004	Amazon Games UI.exe	100
PID 5004 wrote to memory of 424	5004	Amazon Games UI.exe	100
PID 5004 wrote to memory of 424	5004	Amazon Games UI.exe	100
PID 5004 wrote to memory of 424	5004	Amazon Games UI.exe	100
PID 5004 wrote to memory of 424	5004	Amazon Games UI.exe	100
PID 5004 wrote to memory of 424	5004	Amazon Games UI.exe	100
PID 5004 wrote to memory of 424	5004	Amazon Games UI.exe	100
PID 5004 wrote to memory of 424	5004	Amazon Games UI.exe	100
PID 5004 wrote to memory of 424	5004	Amazon Games UI.exe	100
PID 5004 wrote to memory of 424	5004	Amazon Games UI.exe	100
PID 5004 wrote to memory of 424	5004	Amazon Games UI.exe	100
PID 5004 wrote to memory of 424	5004	Amazon Games UI.exe	100
PID 5004 wrote to memory of 424	5004	Amazon Games UI.exe	100
PID 5004 wrote to memory of 424	5004	Amazon Games UI.exe	100
PID 5004 wrote to memory of 424	5004	Amazon Games UI.exe	100
PID 5004 wrote to memory of 424	5004	Amazon Games UI.exe	100

C:\Users\Admin\AppData\Local\Temp\21434ba1af9e80e0bb9d4e49e643d269_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\21434ba1af9e80e0bb9d4e49e643d269_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3664
- C:\Users\Admin\AppData\Local\Temp\LIXVoWXPPCyc5Jy.exe
  "C:\Users\Admin\AppData\Local\Temp\LIXVoWXPPCyc5Jy.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:416
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AGbGTkAzcl" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4DAE.tmp"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:992
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
    "{path}"
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:3280
- C:\Users\Admin\AppData\Local\Temp\AmazonGamesSetup.exe
  "C:\Users\Admin\AppData\Local\Temp\AmazonGamesSetup.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2992
- - C:\Users\Admin\AppData\Local\Temp\Amazon Games Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\Amazon Games Setup.exe" "/nopatch"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3400
  - - C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games.exe
      "C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games.exe" " /channelId=87d38116-4cbf-4af0-a371-a5b498975346"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:4960
    - - C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games Services\Amazon Games Services.exe
        
        "C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games Services\Amazon Games Services.exe" "/appIpcName=AgsLaunch-App-Pipe-4960-1" "/coreProcessIpc=CoreProcess-Desktop-4960-1" " /channelId=87d38116-4cbf-4af0-a371-a5b498975346"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        
        PID:3232
    - - C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games UI\Amazon Games UI.exe
        
        "C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games UI\Amazon Games UI.exe" "--appIpcName=AgsLaunch-App-Pipe-4960-1"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:5004
      - C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games UI\Amazon Games UI.exe
        
        "C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games UI\Amazon Games UI.exe" --type=gpu-process --field-trial-handle=1732,531994406252625094,15175762749655003858,131072 --disable-features=SpareRendererForSitePerProcess --enable-gpu-rasterization --gpu-preferences=KAAAAAAAAADgAAAwAAAAAAAAYAAAAAAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=4824797387329804 --mojo-platform-channel-handle=1744 --ignored=" --type=renderer " /prefetch:2
        6⤵
        Executes dropped EXE
        
        PID:424
      - C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games UI\Amazon Games UI.exe
        
        "C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games UI\Amazon Games UI.exe" --type=utility --field-trial-handle=1732,531994406252625094,15175762749655003858,131072 --disable-features=SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --standard-schemes=sonic --secure-schemes=sonic --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --service-request-channel-token=13390588264669485887 --mojo-platform-channel-handle=1900 /prefetch:8
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:4708
      - C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games UI\Amazon Games UI.exe
        
        "C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games UI\Amazon Games UI.exe" --type=renderer --field-trial-handle=1732,531994406252625094,15175762749655003858,131072 --disable-features=SpareRendererForSitePerProcess --lang=en-US --standard-schemes=sonic --secure-schemes=sonic --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --app-user-model-id=Amazon.AmazonGamesApp --app-path="C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games UI\resources\app.asar" --enable-experimental-web-platform-features --no-sandbox --no-zygote --preload="C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games UI\resources\app.asar\preload.js" --background-color=#000 --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --service-request-channel-token=15985284081460852978 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2508 /prefetch:1
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:1176
      - C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games UI\Amazon Games UI.exe
        
        "C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games UI\Amazon Games UI.exe" --type=renderer --field-trial-handle=1732,531994406252625094,15175762749655003858,131072 --disable-features=SpareRendererForSitePerProcess --lang=en-US --standard-schemes=sonic --secure-schemes=sonic --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --app-user-model-id=Amazon.AmazonGamesApp --app-path="C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games UI\resources\app.asar" --enable-experimental-web-platform-features --no-sandbox --no-zygote --preload="C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games UI\resources\app.asar\preload.js" --background-color=#000 --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --service-request-channel-token=8357101216230068294 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2648 /prefetch:1
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:3660
      - C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games UI\Amazon Games UI.exe
        
        "C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games UI\Amazon Games UI.exe" --type=renderer --field-trial-handle=1732,531994406252625094,15175762749655003858,131072 --disable-features=SpareRendererForSitePerProcess --lang=en-US --standard-schemes=sonic --secure-schemes=sonic --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --app-user-model-id=Amazon.AmazonGamesApp --app-path="C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games UI\resources\app.asar" --no-sandbox --no-zygote --context-isolation --background-color=#fff --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --service-request-channel-token=17917153989176371979 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2808 /prefetch:1
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:876

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Amazon Games Services.dll

Path C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games Services\Amazon Games Services.dll
Size 289KB
SHA256 fb14d7eea78cc81b6a97d1372e5684643b2003e89f22d0ebfa4fa190209e0c59
MD5 e2baa50942a4fb2f3058312285871443
SHA1 7eece50e0157fecb52b40b5166d339224ae55529
SHA512 66e5204760d9777edcbc9371ddd85dd89a385bc8d8a9e051c44a5e37e1799d3721446ef833717dd455edd797ed7ab04651307fafea0c96ed04bd31c2c12455a0
SSDEEP 6144:02hKkPcwlIm9yJVlSeOP8eeIRZ9+G3OOOOqhWmsReOPEeeIRZ9+G3OOOOlKB:025PjEB+yaZ9+G3OOOO8EU+KaZ9+G3OD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Amazon Games Services.exe

Path C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games Services\Amazon Games Services.exe
Size 164KB
SHA256 e5f08df41f06926a4202e6da0fd9eb1bd4db49ebfb8feccbf4d646ea58f5a31d
MD5 4a2243a493b4cccce8253c3c98466e52
SHA1 0540a62674a7c445f8608844a181c213b8872b7b
SHA512 699b3c304f5f8d77eaf88284e9b798a954b08acc0b93ff7ee3930d20c51a6cda145fb3154e9c83d75f8da8af5c06cf6c4d548706237c9e7960de6bbca23bd6bd
SSDEEP 3072:wcppoT630Frl88/mCsViJwB7MSkYTWGseOPseeIICZ9+G3OOOOxRVrV9/o:wcpGOIrGeaZkYTmeOPseeIRZ9+G3OOOT
MD5 SHA1 SHA512 SSDEEP

Submit Download

Amazon.Auth.Map.dll

Path C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games Services\Amazon.Auth.Map.dll
Size 100KB
SHA256 4bd3f9bc9ebade987f7b64d2b7b5a914f7a777b4b67411fb037c1d1a401120c9
MD5 a20ea784957d2daa8c89ce83d1a6224e
SHA1 885155614b56c9461c47f2172803829927a92162
SHA512 b96e4b46e75b6bd1268920f3ab718f917f5afdbcd76e4c7d43dbab7adf08611e5019da21807dd5371610590f7b88437abb2fd679ecf8d58a965f3256b4570cf2
SSDEEP 1536:3c0cXTmb3U1ig2MRHixMazKuW8Ey5B24a68+Ww/ob/7UUxE:s1KU1i0RH+LzR4y64a68+Ww/ob/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

Amazon.Common.dll

Path C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games Services\Amazon.Common.dll
Size 178KB
SHA256 cd069bb34716cfdb31467e5925250800b3e4566696216df000d5eb2655d289a1
MD5 6a5f1db67f427d30dfa2ddf12e907953
SHA1 5041bb87cadd4a9937850bfb04294617b2aa1632
SHA512 5b3a8ef05ec9cf601f21003c18bd0d60ac29450c6d0f6da5b04c6ce17197ca5fd4ef9cb1377dd830cc2ee057ed462e6a13911deadb71f920e08345222002c901
SSDEEP 3072:SPcVttmgwpaDHnqoKCmaaAwViI7NKg5OM//n+ixC3Wf4TFuVrd0P66Qr+F47/D:SCtJeuHxoAwQSJnIzQK477
MD5 SHA1 SHA512 SSDEEP

Submit Download

Amazon.Fuel.AppCore.dll

Path C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games Services\Amazon.Fuel.AppCore.dll
Size 26KB
SHA256 21c3889fb04db3ed95ccfa18b7b77e24ef97a6ca6ca8781f92a8869b7bb342c8
MD5 21a482329ab443843691680022b04741
SHA1 f37ef6d7f91ac8f45675185b208f3ce5924784e1
SHA512 95e3e5b55ffddcaa6cd8c105c73b2d9a13e4f5ec2c10865ee0eeb828dc5473597fb73223f61d034136a642024193af37554a70f3d637eb96e369471512da9b28
SSDEEP 384:hCS5tZQaa/+j9QLPqqcKoADZSf+VIYiRUxErAM+o/8E9VF0Ny6U:hCcQaY+RM+Aa/YiyxErAMxkEP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Amazon.Fuel.Common.dll

Path C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games Services\Amazon.Fuel.Common.dll
Size 375KB
SHA256 02e03da5c121355ed9503b2f5c458ad9fd302e5f98737b0802d2f685f19c6207
MD5 2ef56d199c95016f8e2fa2924563a63b
SHA1 80b6c705c69415400d3f9d6c3c551d0a754a1036
SHA512 79f8d40bb000949496f66ca84290e4d7de263e240ef0ab3dab2ac9cbb0c5d670165d443cc6f933a8735513e316eb925c9b11c531767a7382dbaf08e19c71874b
SSDEEP 6144:Trb1qwoHOjm+sPTHlKH5tgUTSFxhn6c1aRC3c7FPvQoKrPA30T4B42KgTzi:TrRJjmbDw7PvLK1gT2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Amazon.Fuel.Plugin.Metrics.dll

Path C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games Services\Amazon.Fuel.Plugin.Metrics.dll
Size 54KB
SHA256 b02c64cc1d2698596b17eadb13583ce2fbacf94e5f4a7e4c2c0595f67a7779a1
MD5 2ebb58b9ff3e79c22cb1e0f39dd69373
SHA1 89174178783948fbe351f44d2114fd774c7ba8e0
SHA512 58fe4887760f9ed0a3aa80d4061d42beb9c65839225021b51b80073ca3b401c358533ce7e23fcac668a45387f0f7b73a750aeb23a52a1a1b2013a4cd88bd3ab5
SSDEEP 768:CzdmfILf1K0FWYTiiGYuWURfrut2q7ir2lYxhctG4x/YiyxEoAMxkE9j:edmfILE0LkWU5siZheGc/7UDx1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Amazon.Fuel.Plugin.PlatformServices_Windows.dll

Path C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games Services\Amazon.Fuel.Plugin.PlatformServices_Windows.dll
Size 83KB
SHA256 78309315b32c18cb21b132eec113871ba700663f76586fc85f8fd68bb8a4cb49
MD5 054a4785c69ac8bf092d9520aa958990
SHA1 0ad7f3b54d5d186c66489d71f5149df7ed650244
SHA512 4d0ee80bbd7ded67566b4b9d309f7dfd8f3afe768631df0c84e8c3849436fd189fa4ef979b13da0d685e1550c0a0deadcc508d70e18bde7a78b15a37e27ee540
SSDEEP 1536:dSmKfypWls+FESFEmK6xcrTKIRKP6L7pxenb11z3bcNCK+ROZR56s6/7Ui6xK:dSmKapWls+FERh6xcda+7pxenb1A+QYd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Amazon.Radium.dll

Path C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games Services\Amazon.Radium.dll
Size 742KB
SHA256 93f6eefed273692794908e749da072e70c5e158b584b9ef09d4184e56dfb94ac
MD5 68e5cc898e4d20903f328a8cb5cb4b20
SHA1 384419d5f5b5456021d4840083cdd07d75069401
SHA512 1d93c9be02e52a33b9d9a561938e8c87b024223585d2498bf1ffa70cee5b7bfa2f0a4ce0718bd8341cb399a865ebf00d5a9b8b8d59630e5a26df2068352dd86f
SSDEEP 12288:KMATzkDj7PDaxY0yJRZ6v7YBnrmYDZuo/f:wzkDnPDNJddmYDZT3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Autofac.dll

Path C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games Services\Autofac.dll
Size 324KB
SHA256 fa0a4a0a4336e5bbe21b52d3465395d9ca774abba5160a6bc7222c66e98873d1
MD5 dd58451c5f3fdbbd11bf565a330b39dc
SHA1 2f01c5c406b19661c157aaa6a667e05edefd907f
SHA512 66703d60678b7afbdc7421d0120f36b8ab9907fa823025964fb8ec000efe930047e3d8d6a31a9edb3667a20f85294b4693b1d8d1823377ec9b634afc537f8279
SSDEEP 6144:QQW7LiNPkCvYaoedXi76u2BULd77XxSf1:TMiNQedS7r2o7i1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Clients.Amazon.SushiEel.dll

Path C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games Services\Clients.Amazon.SushiEel.dll
Size 32KB
SHA256 64b7fc18b8eb94504c42f7c1e94f952dde6355e6385f3bd57faefe5d72c6a42f
MD5 def1264207064c93c506d93f68e00d1b
SHA1 922d3562ae1658aedcb03257a6c8d000eb72b4b4
SHA512 5f063df63b3c3760fc3b8ff0dffcc99820d04c8c13b30413acc85354bca1975147939481a2e92976ea281139c9a11a92c3000388168327764d58831dec45d287
SSDEEP 384:TijL5DiPJRAriulvbh/oYdz7ytatB7tNNcKQ+8ZSf+VIYiRUxE9WGAM+o/8E9VFd:oCArvlj6YdzBLJa+b/YiyxEYGAMxkETz
MD5 SHA1 SHA512 SSDEEP

Submit Download

PresentationFramework.dll

Path C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games Services\PresentationFramework.dll
Size 14.2MB
SHA256 3dc0ddd44a4475e62c2a97172e0721f07f4f1f5d163fe4e77dd999043ba05734
MD5 21d518f466d3815df618253efb11a09b
SHA1 5ac9d1dc00bace95006ca44b8cb4a559219a522b
SHA512 d96aeb4727ca6c2d818c5c17341e5625481774a330c66533670d6507d7dc267b2b66e01fd9b43dc4aafaba4ec766b71217fdd14c73c3f518ca8351822552b8f6
SSDEEP 196608:MXW+chKmUnxeQcrT1wpnfWrnE2jU7bMkM2grKSybsFcsCaLNx8rzPrla:7+chXqxeQcrTapjTlsF/mr
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.Collections.dll

Path C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games Services\System.Collections.dll
Size 249KB
SHA256 8745aabaaa043e6d456b2b4d7864089bed544eb5204fc733b575e977b52b916f
MD5 44b5aeddba5aa88a23e330cb37feb578
SHA1 5443d16d862a64c090a40f5c3dd2083868d17360
SHA512 4bff95f4d1a928de5927d6c354fca12f48a701ad44f8713457ead8f271cef19216b39d731399709fb628aa4562ce461a2fa98878be61d0f493b6e6bfb74c8170
SSDEEP 3072:zTCjDeWwv1ilwk9ZxHsXoLb4j0hbaRQb/EcLoITZe69saCVFRiSibFxpgQ2lEwqG:KgUTcSaY/BosZe69saCti3bFxpOlE4
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.IO.FileSystem.AccessControl.dll

Path C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games Services\System.IO.FileSystem.AccessControl.dll
Size 80KB
SHA256 8b837830416fb89021876d89010d84fb5b16c768b23cca017050fedac71c8024
MD5 2e189293fe78fc4fd452a19ef1beda88
SHA1 3d25f9de87ef1ded11cc5f06e865e249be000f0d
SHA512 66262806f3a76e6db816832d87400354b037106073931f453ab56b16ef859c86421db5307e72f139067e82aa63561bb3d5fb47aef1f56837d0dabde5eb5e34ae
SSDEEP 1536:gVkibxVCvFdKQ6bChCn/msABpL8eHp9bTR2bztPpVuDzVM:gVk6ng6bvnusQB8eHp9bTW9mi
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.Private.CoreLib.dll

Path C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games Services\System.Private.CoreLib.dll
Size 8.2MB
SHA256 5064262dc838d4fdd458a70312f6945f56e153519fa4d6808b34738018753625
MD5 d3cfe3422fb4d5a93c1cf9807debd230
SHA1 41a3f27c2e812b24bdf269c9c590b300404bd5d9
SHA512 e659f1290ce7b139d89eafea18d879ee029d82d361d9b3aa511b63aadc00a73f1821505e61633fe2aefcc8d73016471336b88ecf17d15c8aff9c5ac1299db21e
SSDEEP 98304:UzV2tmt0FnrIK8ImFGiwLjHDC7PX3si5gupWfb+ZVo9lqRM6h:UsmFGiCjW7/yupWfyZVaUMu
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.Runtime.dll

Path C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games Services\System.Runtime.dll
Size 42KB
SHA256 36764292c645fbbc92c31ecb3338f26093ac0f7e69f5c8f9b817b7b6f9f49ce2
MD5 2a2145894b1e24529c3ec57fe204bd07
SHA1 0cfb1d48f6bfebe85abce1443193ad8f818318dd
SHA512 7c2ace08599763e6f2105ad30c7d9df1b38ac9febb7816d98957960a6c3138e2978614b084d82a36bb495bf0d2e135fd660ea1c906efd3aa4ebef4104f717da1
SSDEEP 768:bZYK594bQRi0RVbLM9p9N7a59JapLmuNEkfuI8Z289zA:bZYK594bQRJY9bNs9Jm6uNEkfujFzA
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.Xaml.dll

Path C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games Services\System.Xaml.dll
Size 1.2MB
SHA256 88047cae06586b8f2d2c54e3229d0bf19ee1e224aa96c26358bd89c22834922f
MD5 88f8ecfe3166e18f2b41d8b17fcbb482
SHA1 898e6ac7466fb2f81fb96094b859e5577f3b5b22
SHA512 067375d27b28023a342b0d6b9e91e041d9bda9514075cd5efca8214b530afcf1ff75229f4498c1a6362368642865389fffe961431d2470cf01c1ec3bc07db764
SSDEEP 12288:kcVaVxUNCoYVycXR0KkosWOM/U4h20c6TOILHoe/Ww4B2gvzcy0R8Ql3UPZ1Klh7:dk4NCOcXOKqM/UCkIL3iwZX4zY
MD5 SHA1 SHA512 SSDEEP

Submit Download

WindowsBase.dll

Path C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games Services\WindowsBase.dll
Size 1.9MB
SHA256 996e60b5d8e2109d6dc69e6e29462188f61fa4c70db2edf54070ea5174a206b0
MD5 0f7a6e65d184213c41fa4b3e39fcbda6
SHA1 f0825f4c1ca0d37367ff02f66a4b3c93053a102f
SHA512 91671c769e77c8ae6da3a3cd5a6f7f8f208c02a39f7f9bd2076b3ace23c96b681b8ae5e28de2fb9878819ac633bf46cf0bbc81fceb9ec5f7af8e4b6a99a7149b
SSDEEP 24576:AMAkC32RhNUEIxCDX2lAjjtmby4mle9Zk8knB504OiCkYYNHFfwKLJblk:D+m7OEIomEjtey4mlsk8eCkJ/e
MD5 SHA1 SHA512 SSDEEP

Submit Download

clrjit.dll

Path C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games Services\clrjit.dll
Size 1.0MB
SHA256 ce9037b6998a8171cb53cfa3725cc9bddd95ceba7fe4f9fd9fb43ac667ce4601
MD5 e127d23181160e02391e628192b1d08a
SHA1 642c16276a9dc0c216e677be97df4e4aeb2836a6
SHA512 7a557a26eb0442d79da66b34ff70c37d4e5d26c757493c58127265876c9c2d2da1e6cb9b70680ee4dbf3773dcb55b575010fc72b5528263f957b20f867d71465
SSDEEP 24576:rU2/adyAVDgfdlD6dHn6knysk5JJu36zRNnO1Ru7:YGyNgFodH64ysD3yS1k
MD5 SHA1 SHA512 SSDEEP

Submit Download

coreclr.dll

Path C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games Services\coreclr.dll
Size 4.0MB
SHA256 ab0ee337d10c8225134603f1dc5f70631fc7a3dc49500e254efca7c60b145f67
MD5 99004b84b758edc90f90671221152667
SHA1 9a22738517dac9fc717d6f9324a24aeee6dc93e6
SHA512 662c00d3bcf76eb8fb603a681ca029824ca1bb65064790da405e95db6c363ebe9cf897f8420b5f79b6653eed17aebcf81e4dfe81652f0dbe674ba4fd54c9adb0
SSDEEP 98304:/sSGRWoVqZVb17QmDjBBoPOyTXQPU5ep/x5:/sIoVqzb1xj4OyT9sP5
MD5 SHA1 SHA512 SSDEEP

Submit Download

hostfxr.dll

Path C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games Services\hostfxr.dll
Size 248KB
SHA256 50a853d23c8d2832da1183abd20ae446585cebcd902858f3bd0181fa4bf3c6b6
MD5 1bc17073c940e2cb486d4c5a361c5df4
SHA1 218c6cfac172af7477039761ba03de0a899a3e29
SHA512 ace997a3e1460ba387d9a051384f981f872b6470652c64abb344a4a2c55e19388870989e6104bcae8b168df8c62d34c43853d61b9940ffff19d582f76a2ec7a5
SSDEEP 3072:L7F4bFWlIdkBC/eNIQDBUGHXPTVB4bDCF5ABYwRMRIJFGyWDsJC1dEPBQvEFwSD+:L7F4Mi/iXtH7f5ABYwi67C1dKQ3SSzrT
MD5 SHA1 SHA512 SSDEEP

Submit Download

hostpolicy.dll

Path C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games Services\hostpolicy.dll
Size 249KB
SHA256 4f3934c1bcac7827078702d9ef21ecd4af5652595a115bc578d026bb03b60bd8
MD5 da0f874eeee4c0f45cd0a9bd044c7db7
SHA1 c7edd0703429c6f49f7bae3a43366ef99e051d7f
SHA512 c6577c80375fcc406d110254120e1d37a450ad2114b0c72a14045ee0dc064d7e3208ff599832d0ae6445c002b0993cee808153a83d47a21105f2f84cdd2aef16
SSDEEP 3072:SPITqvTBjyShEojqj74EXpCkFwgZT96ClSyQpoabqobHQYPGguJ/FwuR793qf:SPIKTceEwqj8spCkhZTPSlBbGgQ+uDQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

minimal-981e9cdf8f1733c5922e.css

Path C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games UI\resources\static\public\core\minimal-981e9cdf8f1733c5922e.css
Size 334KB
SHA256 577281d9bbccbef71522e3f9f930ebf0d91fb26c0459f75172910cc43e25a2b4
MD5 e3a0425c4d9a25d022c49bdeeb15c42d
SHA1 1faf1cc8abf9bc351827551d7d4548a4edc6a29e
SHA512 35fa151affdab631cec1ab3fa810a5c14ddaf1be7dada2a9d3a48e9305acad63f7dd70303e15fc5b822f1e002562963986b84334cfb6657106cb06220cc46ab3
SSDEEP 1536:bdzUl/56zz+Elyn9IPETu8wdKsnVxWp3ew7a8+YXsDkWPvzT:4wdKsnVSk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Amazon Games.exe

Path C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games.exe
Size 1.6MB
SHA256 cd4de592833fb5bc3ff1897cecb02cd0b24b4db6b9b09649c444388ca4425921
MD5 31c680c73261d867169c9859b0235fc4
SHA1 5a94d51dfe4c37acebc1b51d995ea1fcc8ab5f76
SHA512 d2f85d52108ee936743e5fc2e81a124d241b223bf4f10d10c807dc00146b537a757c9f6e5451b91f605b6245e4335544d4e1e80def515d219afb17794f41cb07
SSDEEP 49152:pTxjy1pHYffcWnSRSqO6Kbzya64k+UOJYv86k:njy/YSQqO6KV6k
MD5 SHA1 SHA512 SSDEEP

Submit Download

version

Path C:\Users\Admin\AppData\Local\Amazon Games\App\config\version
Size 40B
SHA256 def0a05bebba79a57b937b999515541560d78df25f0f5cc46abb9724dd016390
MD5 ac80959767118c54bd66e4eff3eaf60f
SHA1 52cdc9f40933aa7d6c27210357c65c06c71dad5e
SHA512 9b12269bd3af14c794e9ed958341bff6e3c58d009a5f6ec851a3ae52383b860f37dcd579ba79f6e21365ccfeb453228d751576fec818681e5cdd0b4f3a6293e6
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Amazon Games\Data\Electron\Session Storage\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Amazon Games\Data\Electron\Session Storage\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CommonData.sqlite

Path C:\Users\Admin\AppData\Local\Amazon Games\Data\Games\Sql\CommonData.sqlite
Size 28KB
SHA256 0e67f05bbffde815066f3a357ffb082dd33b94cc37478baa4da7b0a401009c06
MD5 fb0948531d6670dbab44abdcfc79335b
SHA1 4fbebb3510ca0a5446fd89153d2af95bb1b52f6f
SHA512 f06f49127de89ba173a33c28fbe5e44786283cb2e9b8f07af08b1263d0cb67e82f2913eae2756d6393182459c9b3bb2fa3857404d331f49fac139132778c2c20
SSDEEP 24:TLxOk9SP9O5aISVvVzvVzxVzyVznS+8Vz/vVzKeee:Tc6c9OjmN3unW/N
MD5 SHA1 SHA512 SSDEEP

Submit Download

ElectronMain-2024-07-03-05-45-12.log

Path C:\Users\Admin\AppData\Local\Amazon Games\Data\Logs\ElectronMain\ElectronMain-2024-07-03-05-45-12.log
Size 3KB
SHA256 0e044f24e209765440eb5528fd075f94bd526b2a4e30d928bfee6463f25f0d55
MD5 ea6a89866a965ab52a3e23eb18914cca
SHA1 bf3adb55f3977dcedc3a7b04228651e61aacab24
SHA512 2eb1b05b643f91a475e4f93da1d67e724822c98dca72b3a5843d59a1f0463ae2b9eeb58b5dd9db9eb42a8fb88e93f08972f5791106ccb05f46d11e7152770f99
MD5 SHA1 SHA512

Submit Download

ElectronMain-2024-07-03-05-45-12.log

Path C:\Users\Admin\AppData\Local\Amazon Games\Data\Logs\ElectronMain\ElectronMain-2024-07-03-05-45-12.log
Size 4KB
SHA256 7b0fb4db1eccafb738e43e794b7e82e63029d091666c634505868ba313d22957
MD5 419feb0911942d35ea815b7c0670b2f5
SHA1 68d913aee0d4f3e5d26df0ba5ddf5e160cad8227
SHA512 61d5f2e09507d3ce48ba7339536fd9de5365c98ecce22e2f599a21d0a9b4e3c78a3a31069aa1e7e10b7a6bf20c039513e321a8b3aaa243336ba5fa4ae24bba58
SSDEEP 96:o/19CumhXrJoIso7SNB1haKZGsDJs8l+aqFTfTdi:mZmhXWo7c10KZDu8l+ZTo
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install_2024-07-03_05-42_0.log

Path C:\Users\Admin\AppData\Local\Amazon Games\Data\Logs\Native\Install_2024-07-03_05-42_0.log
Size 1KB
SHA256 ba7c230da6b1b39431eb496799d5314c6ec4b813a04bd9bc6c0458c1add3b7cd
MD5 2ac94e180656f5f5a0c35a7536b9cdf1
SHA1 d5ae1553e37af0d6818a58c021b697d75b0fed0f
SHA512 d585f135ca45f3cd0139b847e3902daaf34e753de780ff0ef7ba5f664f8e8cc156ce3b4f78c902af899f96b9a90ca25f7053d6a476e3de13b81d0969552f6e8c
MD5 SHA1 SHA512

Submit Download

Live-Install_2024-07-03_05-42_0.log

Path C:\Users\Admin\AppData\Local\Amazon Games\Data\Logs\Native\Live-Install_2024-07-03_05-42_0.log
Size 696KB
SHA256 3646a73800124398b950d1e38c74e3a409d4ab3f2c9c3a3e65893693ce8441c0
MD5 9c5d71840e5cf919aa65794e117bea57
SHA1 075fef6f3c79eedadc2b4659076db5e0ef38bd98
SHA512 14411d2b210d42aa98e22afec1244233e2e3570c944df323c9b64b58d2bac6df7b18c4fa2607c0d93327aebf6ceb86930ddf16f227fbe2291d148d80f3901163
SSDEEP 3072:ysWt73HHXcQf5a4p6axz0UNAKwEU844h1kHHcE1zPlfp1/yLsEmUfmTbioSs/XxM:y21uOLC
MD5 SHA1 SHA512 SSDEEP

Submit Download

Amazon Games Setup.exe

Path C:\Users\Admin\AppData\Local\Temp\Amazon Games Setup.exe
Size 1.9MB
SHA256 f6e6eb9e27a83689960f2438d86512092db2532c97d460e9b2e6a23834fa48f3
MD5 3f1a9950778e30d7e742506da20c0c14
SHA1 e61f35b01bd30aeb144b9136b52239956e0f1d7e
SHA512 43f84f1d28bf6ebbf338970c20ecbb153bdbf4d199d036136663c26a504d6ad454dc18cb108e90b4329c74b483e82b513462e119d1f8df01b2e926e123c38808
SSDEEP 49152:H6Rcbb4ybn8UqTPqOIXxqLYeKYKS6Nk+tuskTrf:H6ibnn8GBqUeGxuP
MD5 SHA1 SHA512 SSDEEP

Submit Download

AmazonGamesSetup.exe

Path C:\Users\Admin\AppData\Local\Temp\AmazonGamesSetup.exe
Size 1.8MB
SHA256 1a99f1054e51fe86416c59e5c526d69776fdabd7bb9831dbaab8582322121c7a
MD5 02be3726c0a90958a3c30577d3b3a131
SHA1 bedbab8bd74a9d7313ba32ca033c81ec32c04706
SHA512 662eaa8d3b112ef981d27832a2a46b0ecb55e2d1dcf49fe1fbd134e3c4e02758bc9ad3db2e25f53fc174e2083dd278967f405a768fdd814612c9a43bc6d1c713
SSDEEP 49152:G/mvl+01HHWra6IjgKDlUzIzsBKLxYqJKevCnuueO+0D17gM8s:bvUAnWrBq1ABzH
MD5 SHA1 SHA512 SSDEEP

Submit Download

LIXVoWXPPCyc5Jy.exe

Path C:\Users\Admin\AppData\Local\Temp\LIXVoWXPPCyc5Jy.exe
Size 2.5MB
SHA256 d9aa21479a1a55d57839aee6310cd6853b2bc5215337aa72316a96f7be7ff3e5
MD5 cef6d09b553a93f81942da9838b1ac57
SHA1 c32fbf54b54dadabbae600645c417c163234daf5
SHA512 05ed612b7d2e14b034a391d45b578e0eda2b52be3b8eeccb3534872de61d05d95b4b3e7f10bfa01ef6913d29a24404c8cf635c804f9fbe2820321078d1007928
SSDEEP 49152:SoSto6fCl0KeaNs68/bXvlM28MTVTc6hhCkJNV8VicCFiO1:S9+0P9/rBRVTpIkJN+YcLO
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp4DAE.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp4DAE.tmp
Size 1KB
SHA256 41514b92588462a8ecdf9c8b6a8caf063e17d26820ad3aa2ac2d5250924459c0
MD5 37f35ccf14d19067b8953f28b0ee3b9d
SHA1 411bf26b63d94725a88413f1c070eda836db0a65
SHA512 fd331c16198ed03fc1f3800064cddeef29c19222eee41678781d9bb4bb3d13181a46f4fb6be528c597ee5fbd1a861dde1cd0e35724a32c33d3a8a483721da2bd
MD5 SHA1 SHA512

Submit Download

memory/416-350-0x0000000073320000-0x00000000738D1000-memory.dmp

Download

memory/416-20-0x0000000073322000-0x0000000073323000-memory.dmp

Download

memory/416-22-0x0000000073320000-0x00000000738D1000-memory.dmp

Download

memory/416-36-0x0000000073320000-0x00000000738D1000-memory.dmp

Download

memory/416-37-0x0000000073320000-0x00000000738D1000-memory.dmp

Download

memory/416-264-0x0000000073320000-0x00000000738D1000-memory.dmp

Download

memory/3280-1411-0x0000000000400000-0x00000000007E4000-memory.dmp

Download

memory/3280-316-0x0000000000400000-0x00000000007E4000-memory.dmp

Download

memory/3280-525-0x0000000000400000-0x00000000007E4000-memory.dmp

Download

memory/3280-438-0x0000000073F40000-0x0000000073F79000-memory.dmp

Download

memory/3280-429-0x0000000000400000-0x00000000007E4000-memory.dmp

Download

memory/3280-421-0x0000000000400000-0x00000000007E4000-memory.dmp

Download

memory/3280-414-0x0000000073E80000-0x0000000073EB9000-memory.dmp

Download

memory/3280-409-0x0000000000400000-0x00000000007E4000-memory.dmp

Download

memory/3280-533-0x0000000073F40000-0x0000000073F79000-memory.dmp

Download

memory/3280-317-0x0000000000400000-0x00000000007E4000-memory.dmp

Download

memory/3280-318-0x0000000000400000-0x00000000007E4000-memory.dmp

Download

memory/3280-526-0x0000000000400000-0x00000000007E4000-memory.dmp

Download

memory/3280-1410-0x0000000000400000-0x00000000007E4000-memory.dmp

Download

memory/3280-1638-0x0000000073F40000-0x0000000073F79000-memory.dmp

Download

memory/3280-1434-0x0000000073F40000-0x0000000073F79000-memory.dmp

Download

memory/3280-1742-0x0000000000400000-0x00000000007E4000-memory.dmp

Download

memory/3280-1743-0x0000000000400000-0x00000000007E4000-memory.dmp

Download

memory/3280-1744-0x000000006D410000-0x000000006D449000-memory.dmp

Download

memory/3280-1633-0x0000000000400000-0x00000000007E4000-memory.dmp

Download

memory/3280-1634-0x0000000000400000-0x00000000007E4000-memory.dmp

Download

memory/3280-1635-0x0000000073F40000-0x0000000073F79000-memory.dmp

Download

memory/3280-1636-0x0000000000400000-0x00000000007E4000-memory.dmp

Download

memory/3280-1637-0x0000000000400000-0x00000000007E4000-memory.dmp

Download