bitrat | aa79d46aa459af0d46da380af6481f51369da4c4080a009028e83857dcd844f2

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03-07-2024 05:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

21434ba1af9e80e0bb9d4e49e643d269_JaffaCakes118.exe
Size

2.8MB
MD5

21434ba1af9e80e0bb9d4e49e643d269
SHA1

c460ce1a3fd7c3c5af78ab01a18bc62bcf3a8c8b
SHA256

aa79d46aa459af0d46da380af6481f51369da4c4080a009028e83857dcd844f2
SHA512

012a96b51ee1cefa86c0bfca56f0fe2a0e3d7ec061fa6868184234338dd5f2329bc0de2298d4a782c3e2bdb4bd665fd373adad6f28f26c2c6439972280d9d7b8
SSDEEP

49152:AS4o6fCn0IO2N7Sb/h0vQV2vMHZYd6GZC+8qBBVRlEt73LfsL6kVOSo3dAf2doBn:AG0aw/8HWZY/A+8qvfli7fsLHgSw7G5P

Score

10^/10

bitrat discovery trojan upx

Malware Config

Extracted

Family

bitrat

Version

1.34

curtisusa.hopto.org:5215

Attributes

communication_password
ee342c2505c08512ed898d3855498f1a
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat
Downloads MZ/PE file

Checks computer location settings 2 TTPs 7 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	Amazon Games UI.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	Amazon Games UI.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	21434ba1af9e80e0bb9d4e49e643d269_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	LIXVoWXPPCyc5Jy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	Amazon Games Services.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	Amazon Games UI.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	Amazon Games UI.exe

Executes dropped EXE 11 IoCs

pid	Process
416	LIXVoWXPPCyc5Jy.exe
2992	AmazonGamesSetup.exe
3400	Amazon Games Setup.exe
4960	Amazon Games.exe
3232	Amazon Games Services.exe
5004	Amazon Games UI.exe
424	Amazon Games UI.exe
4708	Amazon Games UI.exe
1176	Amazon Games UI.exe
3660	Amazon Games UI.exe
876	Amazon Games UI.exe

Loads dropped DLL 64 IoCs

pid	Process
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3280-316-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/3280-318-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/3280-317-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/3280-409-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/3280-421-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/3280-429-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/3280-525-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/3280-526-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/3280-1410-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/3280-1411-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/3280-1633-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/3280-1634-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/3280-1636-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/3280-1637-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/3280-1742-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/3280-1743-0x0000000000400000-0x00000000007E4000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
3280	MSBuild.exe
3280	MSBuild.exe
3280	MSBuild.exe
3280	MSBuild.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 416 set thread context of 3280	416	LIXVoWXPPCyc5Jy.exe	94

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 18 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\amazon-games\ = "URL: Amazon Games Handler"	Amazon Games Services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\amazon-games\shell\open	Amazon Games Services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\amazon-games\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Amazon Games\\App\\Amazon Games.exe\" \"%1\""	Amazon Games Services.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\amazon-games\DefaultIcon	Amazon Games Services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\amazon-games\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Amazon Games\\App\\Amazon Games.exe"	Amazon Games Services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\amazon-games\shell	Amazon Games Services.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\amazon-games\ = "URL:Amazon Games Client Handler"	Amazon Games Services.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\amazon-games\URL Protocol	Amazon Games Services.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\amazon-games\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Amazon Games\\App\\Amazon Games.exe"	Amazon Games Services.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\amazon-games\shell	Amazon Games Services.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\amazon-games\shell\open	Amazon Games Services.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\amazon-games\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Amazon Games\\App\\Amazon Games.exe\" \"%1\""	Amazon Games Services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\amazon-games	Amazon Games Services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\amazon-games\URL Protocol	Amazon Games Services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\amazon-games\DefaultIcon	Amazon Games Services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\amazon-games\shell\open\command	Amazon Games Services.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\amazon-games	Amazon Games Services.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\amazon-games\shell\open\command	Amazon Games Services.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
992	schtasks.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
416	LIXVoWXPPCyc5Jy.exe
4960	Amazon Games.exe
4960	Amazon Games.exe
4960	Amazon Games.exe
4960	Amazon Games.exe
4960	Amazon Games.exe
4960	Amazon Games.exe
4960	Amazon Games.exe
4960	Amazon Games.exe
4960	Amazon Games.exe
4960	Amazon Games.exe
4960	Amazon Games.exe
4960	Amazon Games.exe
4960	Amazon Games.exe
4960	Amazon Games.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
3232	Amazon Games Services.exe
4960	Amazon Games.exe
4960	Amazon Games.exe
4708	Amazon Games UI.exe
4708	Amazon Games UI.exe
1176	Amazon Games UI.exe
1176	Amazon Games UI.exe
3660	Amazon Games UI.exe
3660	Amazon Games UI.exe
876	Amazon Games UI.exe
876	Amazon Games UI.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	416	LIXVoWXPPCyc5Jy.exe
Token: SeShutdownPrivilege	3280	MSBuild.exe
Token: SeDebugPrivilege	3232	Amazon Games Services.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3232	Amazon Games Services.exe
5004	Amazon Games UI.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3280	MSBuild.exe
3280	MSBuild.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3664 wrote to memory of 416	3664	21434ba1af9e80e0bb9d4e49e643d269_JaffaCakes118.exe	80
PID 3664 wrote to memory of 416	3664	21434ba1af9e80e0bb9d4e49e643d269_JaffaCakes118.exe	80
PID 3664 wrote to memory of 416	3664	21434ba1af9e80e0bb9d4e49e643d269_JaffaCakes118.exe	80
PID 3664 wrote to memory of 2992	3664	21434ba1af9e80e0bb9d4e49e643d269_JaffaCakes118.exe	81
PID 3664 wrote to memory of 2992	3664	21434ba1af9e80e0bb9d4e49e643d269_JaffaCakes118.exe	81
PID 3664 wrote to memory of 2992	3664	21434ba1af9e80e0bb9d4e49e643d269_JaffaCakes118.exe	81
PID 2992 wrote to memory of 3400	2992	AmazonGamesSetup.exe	83
PID 2992 wrote to memory of 3400	2992	AmazonGamesSetup.exe	83
PID 2992 wrote to memory of 3400	2992	AmazonGamesSetup.exe	83
PID 416 wrote to memory of 992	416	LIXVoWXPPCyc5Jy.exe	92
PID 416 wrote to memory of 992	416	LIXVoWXPPCyc5Jy.exe	92
PID 416 wrote to memory of 992	416	LIXVoWXPPCyc5Jy.exe	92
PID 416 wrote to memory of 3280	416	LIXVoWXPPCyc5Jy.exe	94
PID 416 wrote to memory of 3280	416	LIXVoWXPPCyc5Jy.exe	94
PID 416 wrote to memory of 3280	416	LIXVoWXPPCyc5Jy.exe	94
PID 416 wrote to memory of 3280	416	LIXVoWXPPCyc5Jy.exe	94
PID 416 wrote to memory of 3280	416	LIXVoWXPPCyc5Jy.exe	94
PID 416 wrote to memory of 3280	416	LIXVoWXPPCyc5Jy.exe	94
PID 416 wrote to memory of 3280	416	LIXVoWXPPCyc5Jy.exe	94
PID 3400 wrote to memory of 4960	3400	Amazon Games Setup.exe	96
PID 3400 wrote to memory of 4960	3400	Amazon Games Setup.exe	96
PID 3400 wrote to memory of 4960	3400	Amazon Games Setup.exe	96
PID 4960 wrote to memory of 3232	4960	Amazon Games.exe	98
PID 4960 wrote to memory of 3232	4960	Amazon Games.exe	98
PID 4960 wrote to memory of 3232	4960	Amazon Games.exe	98
PID 4960 wrote to memory of 5004	4960	Amazon Games.exe	99
PID 4960 wrote to memory of 5004	4960	Amazon Games.exe	99
PID 4960 wrote to memory of 5004	4960	Amazon Games.exe	99
PID 5004 wrote to memory of 424	5004	Amazon Games UI.exe	100
PID 5004 wrote to memory of 424	5004	Amazon Games UI.exe	100
PID 5004 wrote to memory of 424	5004	Amazon Games UI.exe	100
PID 5004 wrote to memory of 424	5004	Amazon Games UI.exe	100
PID 5004 wrote to memory of 424	5004	Amazon Games UI.exe	100
PID 5004 wrote to memory of 424	5004	Amazon Games UI.exe	100
PID 5004 wrote to memory of 424	5004	Amazon Games UI.exe	100
PID 5004 wrote to memory of 424	5004	Amazon Games UI.exe	100
PID 5004 wrote to memory of 424	5004	Amazon Games UI.exe	100
PID 5004 wrote to memory of 424	5004	Amazon Games UI.exe	100
PID 5004 wrote to memory of 424	5004	Amazon Games UI.exe	100
PID 5004 wrote to memory of 424	5004	Amazon Games UI.exe	100
PID 5004 wrote to memory of 424	5004	Amazon Games UI.exe	100
PID 5004 wrote to memory of 424	5004	Amazon Games UI.exe	100
PID 5004 wrote to memory of 424	5004	Amazon Games UI.exe	100
PID 5004 wrote to memory of 424	5004	Amazon Games UI.exe	100
PID 5004 wrote to memory of 424	5004	Amazon Games UI.exe	100
PID 5004 wrote to memory of 424	5004	Amazon Games UI.exe	100
PID 5004 wrote to memory of 424	5004	Amazon Games UI.exe	100
PID 5004 wrote to memory of 424	5004	Amazon Games UI.exe	100
PID 5004 wrote to memory of 424	5004	Amazon Games UI.exe	100
PID 5004 wrote to memory of 424	5004	Amazon Games UI.exe	100
PID 5004 wrote to memory of 424	5004	Amazon Games UI.exe	100
PID 5004 wrote to memory of 424	5004	Amazon Games UI.exe	100
PID 5004 wrote to memory of 424	5004	Amazon Games UI.exe	100
PID 5004 wrote to memory of 424	5004	Amazon Games UI.exe	100
PID 5004 wrote to memory of 424	5004	Amazon Games UI.exe	100
PID 5004 wrote to memory of 424	5004	Amazon Games UI.exe	100
PID 5004 wrote to memory of 424	5004	Amazon Games UI.exe	100
PID 5004 wrote to memory of 424	5004	Amazon Games UI.exe	100
PID 5004 wrote to memory of 424	5004	Amazon Games UI.exe	100
PID 5004 wrote to memory of 424	5004	Amazon Games UI.exe	100
PID 5004 wrote to memory of 424	5004	Amazon Games UI.exe	100
PID 5004 wrote to memory of 424	5004	Amazon Games UI.exe	100
PID 5004 wrote to memory of 424	5004	Amazon Games UI.exe	100
PID 5004 wrote to memory of 424	5004	Amazon Games UI.exe	100

C:\Users\Admin\AppData\Local\Temp\21434ba1af9e80e0bb9d4e49e643d269_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\21434ba1af9e80e0bb9d4e49e643d269_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3664
- C:\Users\Admin\AppData\Local\Temp\LIXVoWXPPCyc5Jy.exe
  "C:\Users\Admin\AppData\Local\Temp\LIXVoWXPPCyc5Jy.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:416
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AGbGTkAzcl" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4DAE.tmp"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:992
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
    "{path}"
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:3280
- C:\Users\Admin\AppData\Local\Temp\AmazonGamesSetup.exe
  "C:\Users\Admin\AppData\Local\Temp\AmazonGamesSetup.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2992
- - C:\Users\Admin\AppData\Local\Temp\Amazon Games Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\Amazon Games Setup.exe" "/nopatch"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3400
  - - C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games.exe
      "C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games.exe" " /channelId=87d38116-4cbf-4af0-a371-a5b498975346"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:4960
    - - C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games Services\Amazon Games Services.exe
        
        "C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games Services\Amazon Games Services.exe" "/appIpcName=AgsLaunch-App-Pipe-4960-1" "/coreProcessIpc=CoreProcess-Desktop-4960-1" " /channelId=87d38116-4cbf-4af0-a371-a5b498975346"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        
        PID:3232
    - - C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games UI\Amazon Games UI.exe
        
        "C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games UI\Amazon Games UI.exe" "--appIpcName=AgsLaunch-App-Pipe-4960-1"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:5004
      - C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games UI\Amazon Games UI.exe
        
        "C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games UI\Amazon Games UI.exe" --type=gpu-process --field-trial-handle=1732,531994406252625094,15175762749655003858,131072 --disable-features=SpareRendererForSitePerProcess --enable-gpu-rasterization --gpu-preferences=KAAAAAAAAADgAAAwAAAAAAAAYAAAAAAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=4824797387329804 --mojo-platform-channel-handle=1744 --ignored=" --type=renderer " /prefetch:2
        6⤵
        Executes dropped EXE
        
        PID:424
      - C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games UI\Amazon Games UI.exe
        
        "C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games UI\Amazon Games UI.exe" --type=utility --field-trial-handle=1732,531994406252625094,15175762749655003858,131072 --disable-features=SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --standard-schemes=sonic --secure-schemes=sonic --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --service-request-channel-token=13390588264669485887 --mojo-platform-channel-handle=1900 /prefetch:8
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:4708
      - C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games UI\Amazon Games UI.exe
        
        "C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games UI\Amazon Games UI.exe" --type=renderer --field-trial-handle=1732,531994406252625094,15175762749655003858,131072 --disable-features=SpareRendererForSitePerProcess --lang=en-US --standard-schemes=sonic --secure-schemes=sonic --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --app-user-model-id=Amazon.AmazonGamesApp --app-path="C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games UI\resources\app.asar" --enable-experimental-web-platform-features --no-sandbox --no-zygote --preload="C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games UI\resources\app.asar\preload.js" --background-color=#000 --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --service-request-channel-token=15985284081460852978 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2508 /prefetch:1
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:1176
      - C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games UI\Amazon Games UI.exe
        
        "C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games UI\Amazon Games UI.exe" --type=renderer --field-trial-handle=1732,531994406252625094,15175762749655003858,131072 --disable-features=SpareRendererForSitePerProcess --lang=en-US --standard-schemes=sonic --secure-schemes=sonic --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --app-user-model-id=Amazon.AmazonGamesApp --app-path="C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games UI\resources\app.asar" --enable-experimental-web-platform-features --no-sandbox --no-zygote --preload="C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games UI\resources\app.asar\preload.js" --background-color=#000 --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --service-request-channel-token=8357101216230068294 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2648 /prefetch:1
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:3660
      - C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games UI\Amazon Games UI.exe
        
        "C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games UI\Amazon Games UI.exe" --type=renderer --field-trial-handle=1732,531994406252625094,15175762749655003858,131072 --disable-features=SpareRendererForSitePerProcess --lang=en-US --standard-schemes=sonic --secure-schemes=sonic --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --app-user-model-id=Amazon.AmazonGamesApp --app-path="C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games UI\resources\app.asar" --no-sandbox --no-zygote --context-isolation --background-color=#fff --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --service-request-channel-token=17917153989176371979 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2808 /prefetch:1
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:876

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games Services\Amazon Games Services.dll

Filesize
289KB

MD5
e2baa50942a4fb2f3058312285871443

SHA1
7eece50e0157fecb52b40b5166d339224ae55529

SHA256
fb14d7eea78cc81b6a97d1372e5684643b2003e89f22d0ebfa4fa190209e0c59

SHA512
66e5204760d9777edcbc9371ddd85dd89a385bc8d8a9e051c44a5e37e1799d3721446ef833717dd455edd797ed7ab04651307fafea0c96ed04bd31c2c12455a0

Download Submit
C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games Services\Amazon Games Services.exe

Filesize
164KB

MD5
4a2243a493b4cccce8253c3c98466e52

SHA1
0540a62674a7c445f8608844a181c213b8872b7b

SHA256
e5f08df41f06926a4202e6da0fd9eb1bd4db49ebfb8feccbf4d646ea58f5a31d

SHA512
699b3c304f5f8d77eaf88284e9b798a954b08acc0b93ff7ee3930d20c51a6cda145fb3154e9c83d75f8da8af5c06cf6c4d548706237c9e7960de6bbca23bd6bd

Download Submit
C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games Services\Amazon.Auth.Map.dll

Filesize
100KB

MD5
a20ea784957d2daa8c89ce83d1a6224e

SHA1
885155614b56c9461c47f2172803829927a92162

SHA256
4bd3f9bc9ebade987f7b64d2b7b5a914f7a777b4b67411fb037c1d1a401120c9

SHA512
b96e4b46e75b6bd1268920f3ab718f917f5afdbcd76e4c7d43dbab7adf08611e5019da21807dd5371610590f7b88437abb2fd679ecf8d58a965f3256b4570cf2

Download Submit
C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games Services\Amazon.Common.dll

Filesize
178KB

MD5
6a5f1db67f427d30dfa2ddf12e907953

SHA1
5041bb87cadd4a9937850bfb04294617b2aa1632

SHA256
cd069bb34716cfdb31467e5925250800b3e4566696216df000d5eb2655d289a1

SHA512
5b3a8ef05ec9cf601f21003c18bd0d60ac29450c6d0f6da5b04c6ce17197ca5fd4ef9cb1377dd830cc2ee057ed462e6a13911deadb71f920e08345222002c901

Download Submit
C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games Services\Amazon.Fuel.AppCore.dll

Filesize
26KB

MD5
21a482329ab443843691680022b04741

SHA1
f37ef6d7f91ac8f45675185b208f3ce5924784e1

SHA256
21c3889fb04db3ed95ccfa18b7b77e24ef97a6ca6ca8781f92a8869b7bb342c8

SHA512
95e3e5b55ffddcaa6cd8c105c73b2d9a13e4f5ec2c10865ee0eeb828dc5473597fb73223f61d034136a642024193af37554a70f3d637eb96e369471512da9b28

Download Submit
C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games Services\Amazon.Fuel.Common.dll

Filesize
375KB

MD5
2ef56d199c95016f8e2fa2924563a63b

SHA1
80b6c705c69415400d3f9d6c3c551d0a754a1036

SHA256
02e03da5c121355ed9503b2f5c458ad9fd302e5f98737b0802d2f685f19c6207

SHA512
79f8d40bb000949496f66ca84290e4d7de263e240ef0ab3dab2ac9cbb0c5d670165d443cc6f933a8735513e316eb925c9b11c531767a7382dbaf08e19c71874b

Download Submit
C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games Services\Amazon.Fuel.Plugin.Metrics.dll

Filesize
54KB

MD5
2ebb58b9ff3e79c22cb1e0f39dd69373

SHA1
89174178783948fbe351f44d2114fd774c7ba8e0

SHA256
b02c64cc1d2698596b17eadb13583ce2fbacf94e5f4a7e4c2c0595f67a7779a1

SHA512
58fe4887760f9ed0a3aa80d4061d42beb9c65839225021b51b80073ca3b401c358533ce7e23fcac668a45387f0f7b73a750aeb23a52a1a1b2013a4cd88bd3ab5

Download Submit
C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games Services\Amazon.Fuel.Plugin.PlatformServices_Windows.dll

Filesize
83KB

MD5
054a4785c69ac8bf092d9520aa958990

SHA1
0ad7f3b54d5d186c66489d71f5149df7ed650244

SHA256
78309315b32c18cb21b132eec113871ba700663f76586fc85f8fd68bb8a4cb49

SHA512
4d0ee80bbd7ded67566b4b9d309f7dfd8f3afe768631df0c84e8c3849436fd189fa4ef979b13da0d685e1550c0a0deadcc508d70e18bde7a78b15a37e27ee540

Download Submit
C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games Services\Amazon.Radium.dll

Filesize
742KB

MD5
68e5cc898e4d20903f328a8cb5cb4b20

SHA1
384419d5f5b5456021d4840083cdd07d75069401

SHA256
93f6eefed273692794908e749da072e70c5e158b584b9ef09d4184e56dfb94ac

SHA512
1d93c9be02e52a33b9d9a561938e8c87b024223585d2498bf1ffa70cee5b7bfa2f0a4ce0718bd8341cb399a865ebf00d5a9b8b8d59630e5a26df2068352dd86f

Download Submit
C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games Services\Autofac.dll

Filesize
324KB

MD5
dd58451c5f3fdbbd11bf565a330b39dc

SHA1
2f01c5c406b19661c157aaa6a667e05edefd907f

SHA256
fa0a4a0a4336e5bbe21b52d3465395d9ca774abba5160a6bc7222c66e98873d1

SHA512
66703d60678b7afbdc7421d0120f36b8ab9907fa823025964fb8ec000efe930047e3d8d6a31a9edb3667a20f85294b4693b1d8d1823377ec9b634afc537f8279

Download Submit
C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games Services\Clients.Amazon.SushiEel.dll

Filesize
32KB

MD5
def1264207064c93c506d93f68e00d1b

SHA1
922d3562ae1658aedcb03257a6c8d000eb72b4b4

SHA256
64b7fc18b8eb94504c42f7c1e94f952dde6355e6385f3bd57faefe5d72c6a42f

SHA512
5f063df63b3c3760fc3b8ff0dffcc99820d04c8c13b30413acc85354bca1975147939481a2e92976ea281139c9a11a92c3000388168327764d58831dec45d287

Download Submit
C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games Services\PresentationFramework.dll

Filesize
14.2MB

MD5
21d518f466d3815df618253efb11a09b

SHA1
5ac9d1dc00bace95006ca44b8cb4a559219a522b

SHA256
3dc0ddd44a4475e62c2a97172e0721f07f4f1f5d163fe4e77dd999043ba05734

SHA512
d96aeb4727ca6c2d818c5c17341e5625481774a330c66533670d6507d7dc267b2b66e01fd9b43dc4aafaba4ec766b71217fdd14c73c3f518ca8351822552b8f6

Download Submit
C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games Services\System.Collections.dll

Filesize
249KB

MD5
44b5aeddba5aa88a23e330cb37feb578

SHA1
5443d16d862a64c090a40f5c3dd2083868d17360

SHA256
8745aabaaa043e6d456b2b4d7864089bed544eb5204fc733b575e977b52b916f

SHA512
4bff95f4d1a928de5927d6c354fca12f48a701ad44f8713457ead8f271cef19216b39d731399709fb628aa4562ce461a2fa98878be61d0f493b6e6bfb74c8170

Download Submit
C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games Services\System.IO.FileSystem.AccessControl.dll

Filesize
80KB

MD5
2e189293fe78fc4fd452a19ef1beda88

SHA1
3d25f9de87ef1ded11cc5f06e865e249be000f0d

SHA256
8b837830416fb89021876d89010d84fb5b16c768b23cca017050fedac71c8024

SHA512
66262806f3a76e6db816832d87400354b037106073931f453ab56b16ef859c86421db5307e72f139067e82aa63561bb3d5fb47aef1f56837d0dabde5eb5e34ae

Download Submit
C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games Services\System.Private.CoreLib.dll

Filesize
8.2MB

MD5
d3cfe3422fb4d5a93c1cf9807debd230

SHA1
41a3f27c2e812b24bdf269c9c590b300404bd5d9

SHA256
5064262dc838d4fdd458a70312f6945f56e153519fa4d6808b34738018753625

SHA512
e659f1290ce7b139d89eafea18d879ee029d82d361d9b3aa511b63aadc00a73f1821505e61633fe2aefcc8d73016471336b88ecf17d15c8aff9c5ac1299db21e

Download Submit
C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games Services\System.Runtime.dll

Filesize
42KB

MD5
2a2145894b1e24529c3ec57fe204bd07

SHA1
0cfb1d48f6bfebe85abce1443193ad8f818318dd

SHA256
36764292c645fbbc92c31ecb3338f26093ac0f7e69f5c8f9b817b7b6f9f49ce2

SHA512
7c2ace08599763e6f2105ad30c7d9df1b38ac9febb7816d98957960a6c3138e2978614b084d82a36bb495bf0d2e135fd660ea1c906efd3aa4ebef4104f717da1

Download Submit
C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games Services\System.Xaml.dll

Filesize
1.2MB

MD5
88f8ecfe3166e18f2b41d8b17fcbb482

SHA1
898e6ac7466fb2f81fb96094b859e5577f3b5b22

SHA256
88047cae06586b8f2d2c54e3229d0bf19ee1e224aa96c26358bd89c22834922f

SHA512
067375d27b28023a342b0d6b9e91e041d9bda9514075cd5efca8214b530afcf1ff75229f4498c1a6362368642865389fffe961431d2470cf01c1ec3bc07db764

Download Submit
C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games Services\WindowsBase.dll

Filesize
1.9MB

MD5
0f7a6e65d184213c41fa4b3e39fcbda6

SHA1
f0825f4c1ca0d37367ff02f66a4b3c93053a102f

SHA256
996e60b5d8e2109d6dc69e6e29462188f61fa4c70db2edf54070ea5174a206b0

SHA512
91671c769e77c8ae6da3a3cd5a6f7f8f208c02a39f7f9bd2076b3ace23c96b681b8ae5e28de2fb9878819ac633bf46cf0bbc81fceb9ec5f7af8e4b6a99a7149b

Download Submit
C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games Services\clrjit.dll

Filesize
1.0MB

MD5
e127d23181160e02391e628192b1d08a

SHA1
642c16276a9dc0c216e677be97df4e4aeb2836a6

SHA256
ce9037b6998a8171cb53cfa3725cc9bddd95ceba7fe4f9fd9fb43ac667ce4601

SHA512
7a557a26eb0442d79da66b34ff70c37d4e5d26c757493c58127265876c9c2d2da1e6cb9b70680ee4dbf3773dcb55b575010fc72b5528263f957b20f867d71465

Download Submit
C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games Services\coreclr.dll

Filesize
4.0MB

MD5
99004b84b758edc90f90671221152667

SHA1
9a22738517dac9fc717d6f9324a24aeee6dc93e6

SHA256
ab0ee337d10c8225134603f1dc5f70631fc7a3dc49500e254efca7c60b145f67

SHA512
662c00d3bcf76eb8fb603a681ca029824ca1bb65064790da405e95db6c363ebe9cf897f8420b5f79b6653eed17aebcf81e4dfe81652f0dbe674ba4fd54c9adb0

Download Submit
C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games Services\hostfxr.dll

Filesize
248KB

MD5
1bc17073c940e2cb486d4c5a361c5df4

SHA1
218c6cfac172af7477039761ba03de0a899a3e29

SHA256
50a853d23c8d2832da1183abd20ae446585cebcd902858f3bd0181fa4bf3c6b6

SHA512
ace997a3e1460ba387d9a051384f981f872b6470652c64abb344a4a2c55e19388870989e6104bcae8b168df8c62d34c43853d61b9940ffff19d582f76a2ec7a5

Download Submit
C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games Services\hostpolicy.dll

Filesize
249KB

MD5
da0f874eeee4c0f45cd0a9bd044c7db7

SHA1
c7edd0703429c6f49f7bae3a43366ef99e051d7f

SHA256
4f3934c1bcac7827078702d9ef21ecd4af5652595a115bc578d026bb03b60bd8

SHA512
c6577c80375fcc406d110254120e1d37a450ad2114b0c72a14045ee0dc064d7e3208ff599832d0ae6445c002b0993cee808153a83d47a21105f2f84cdd2aef16

Download Submit
C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games UI\resources\static\public\core\minimal-981e9cdf8f1733c5922e.css

Filesize
334KB

MD5
e3a0425c4d9a25d022c49bdeeb15c42d

SHA1
1faf1cc8abf9bc351827551d7d4548a4edc6a29e

SHA256
577281d9bbccbef71522e3f9f930ebf0d91fb26c0459f75172910cc43e25a2b4

SHA512
35fa151affdab631cec1ab3fa810a5c14ddaf1be7dada2a9d3a48e9305acad63f7dd70303e15fc5b822f1e002562963986b84334cfb6657106cb06220cc46ab3

Download Submit
C:\Users\Admin\AppData\Local\Amazon Games\App\Amazon Games.exe

Filesize
1.6MB

MD5
31c680c73261d867169c9859b0235fc4

SHA1
5a94d51dfe4c37acebc1b51d995ea1fcc8ab5f76

SHA256
cd4de592833fb5bc3ff1897cecb02cd0b24b4db6b9b09649c444388ca4425921

SHA512
d2f85d52108ee936743e5fc2e81a124d241b223bf4f10d10c807dc00146b537a757c9f6e5451b91f605b6245e4335544d4e1e80def515d219afb17794f41cb07

Download Submit
C:\Users\Admin\AppData\Local\Amazon Games\App\config\version

Filesize
40B

MD5
ac80959767118c54bd66e4eff3eaf60f

SHA1
52cdc9f40933aa7d6c27210357c65c06c71dad5e

SHA256
def0a05bebba79a57b937b999515541560d78df25f0f5cc46abb9724dd016390

SHA512
9b12269bd3af14c794e9ed958341bff6e3c58d009a5f6ec851a3ae52383b860f37dcd579ba79f6e21365ccfeb453228d751576fec818681e5cdd0b4f3a6293e6

Download Submit
C:\Users\Admin\AppData\Local\Amazon Games\Data\Electron\Session Storage\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Amazon Games\Data\Electron\Session Storage\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Amazon Games\Data\Games\Sql\CommonData.sqlite

Filesize
28KB

MD5
fb0948531d6670dbab44abdcfc79335b

SHA1
4fbebb3510ca0a5446fd89153d2af95bb1b52f6f

SHA256
0e67f05bbffde815066f3a357ffb082dd33b94cc37478baa4da7b0a401009c06

SHA512
f06f49127de89ba173a33c28fbe5e44786283cb2e9b8f07af08b1263d0cb67e82f2913eae2756d6393182459c9b3bb2fa3857404d331f49fac139132778c2c20

Download Submit
C:\Users\Admin\AppData\Local\Amazon Games\Data\Logs\ElectronMain\ElectronMain-2024-07-03-05-45-12.log

Filesize
3KB

MD5
ea6a89866a965ab52a3e23eb18914cca

SHA1
bf3adb55f3977dcedc3a7b04228651e61aacab24

SHA256
0e044f24e209765440eb5528fd075f94bd526b2a4e30d928bfee6463f25f0d55

SHA512
2eb1b05b643f91a475e4f93da1d67e724822c98dca72b3a5843d59a1f0463ae2b9eeb58b5dd9db9eb42a8fb88e93f08972f5791106ccb05f46d11e7152770f99

Download Submit
C:\Users\Admin\AppData\Local\Amazon Games\Data\Logs\ElectronMain\ElectronMain-2024-07-03-05-45-12.log

Filesize
4KB

MD5
419feb0911942d35ea815b7c0670b2f5

SHA1
68d913aee0d4f3e5d26df0ba5ddf5e160cad8227

SHA256
7b0fb4db1eccafb738e43e794b7e82e63029d091666c634505868ba313d22957

SHA512
61d5f2e09507d3ce48ba7339536fd9de5365c98ecce22e2f599a21d0a9b4e3c78a3a31069aa1e7e10b7a6bf20c039513e321a8b3aaa243336ba5fa4ae24bba58

Download Submit
C:\Users\Admin\AppData\Local\Amazon Games\Data\Logs\Native\Install_2024-07-03_05-42_0.log

Filesize
1KB

MD5
2ac94e180656f5f5a0c35a7536b9cdf1

SHA1
d5ae1553e37af0d6818a58c021b697d75b0fed0f

SHA256
ba7c230da6b1b39431eb496799d5314c6ec4b813a04bd9bc6c0458c1add3b7cd

SHA512
d585f135ca45f3cd0139b847e3902daaf34e753de780ff0ef7ba5f664f8e8cc156ce3b4f78c902af899f96b9a90ca25f7053d6a476e3de13b81d0969552f6e8c

Download Submit
C:\Users\Admin\AppData\Local\Amazon Games\Data\Logs\Native\Live-Install_2024-07-03_05-42_0.log

Filesize
696KB

MD5
9c5d71840e5cf919aa65794e117bea57

SHA1
075fef6f3c79eedadc2b4659076db5e0ef38bd98

SHA256
3646a73800124398b950d1e38c74e3a409d4ab3f2c9c3a3e65893693ce8441c0

SHA512
14411d2b210d42aa98e22afec1244233e2e3570c944df323c9b64b58d2bac6df7b18c4fa2607c0d93327aebf6ceb86930ddf16f227fbe2291d148d80f3901163

Download Submit
C:\Users\Admin\AppData\Local\Temp\Amazon Games Setup.exe

Filesize
1.9MB

MD5
3f1a9950778e30d7e742506da20c0c14

SHA1
e61f35b01bd30aeb144b9136b52239956e0f1d7e

SHA256
f6e6eb9e27a83689960f2438d86512092db2532c97d460e9b2e6a23834fa48f3

SHA512
43f84f1d28bf6ebbf338970c20ecbb153bdbf4d199d036136663c26a504d6ad454dc18cb108e90b4329c74b483e82b513462e119d1f8df01b2e926e123c38808

Download Submit
C:\Users\Admin\AppData\Local\Temp\AmazonGamesSetup.exe

Filesize
1.8MB

MD5
02be3726c0a90958a3c30577d3b3a131

SHA1
bedbab8bd74a9d7313ba32ca033c81ec32c04706

SHA256
1a99f1054e51fe86416c59e5c526d69776fdabd7bb9831dbaab8582322121c7a

SHA512
662eaa8d3b112ef981d27832a2a46b0ecb55e2d1dcf49fe1fbd134e3c4e02758bc9ad3db2e25f53fc174e2083dd278967f405a768fdd814612c9a43bc6d1c713

Download Submit
C:\Users\Admin\AppData\Local\Temp\LIXVoWXPPCyc5Jy.exe

Filesize
2.5MB

MD5
cef6d09b553a93f81942da9838b1ac57

SHA1
c32fbf54b54dadabbae600645c417c163234daf5

SHA256
d9aa21479a1a55d57839aee6310cd6853b2bc5215337aa72316a96f7be7ff3e5

SHA512
05ed612b7d2e14b034a391d45b578e0eda2b52be3b8eeccb3534872de61d05d95b4b3e7f10bfa01ef6913d29a24404c8cf635c804f9fbe2820321078d1007928

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp4DAE.tmp

Filesize
1KB

MD5
37f35ccf14d19067b8953f28b0ee3b9d

SHA1
411bf26b63d94725a88413f1c070eda836db0a65

SHA256
41514b92588462a8ecdf9c8b6a8caf063e17d26820ad3aa2ac2d5250924459c0

SHA512
fd331c16198ed03fc1f3800064cddeef29c19222eee41678781d9bb4bb3d13181a46f4fb6be528c597ee5fbd1a861dde1cd0e35724a32c33d3a8a483721da2bd

Download Submit
memory/416-350-0x0000000073320000-0x00000000738D1000-memory.dmp

Filesize
5.7MB

Download
memory/416-20-0x0000000073322000-0x0000000073323000-memory.dmp

Filesize
4KB

Download
memory/416-22-0x0000000073320000-0x00000000738D1000-memory.dmp

Filesize
5.7MB

Download
memory/416-36-0x0000000073320000-0x00000000738D1000-memory.dmp

Filesize
5.7MB

Download
memory/416-37-0x0000000073320000-0x00000000738D1000-memory.dmp

Filesize
5.7MB

Download
memory/416-264-0x0000000073320000-0x00000000738D1000-memory.dmp

Filesize
5.7MB

Download
memory/3280-1411-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/3280-316-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/3280-525-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/3280-438-0x0000000073F40000-0x0000000073F79000-memory.dmp

Filesize
228KB

Download
memory/3280-429-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/3280-421-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/3280-414-0x0000000073E80000-0x0000000073EB9000-memory.dmp

Filesize
228KB

Download
memory/3280-409-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/3280-533-0x0000000073F40000-0x0000000073F79000-memory.dmp

Filesize
228KB

Download
memory/3280-317-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/3280-318-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/3280-526-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/3280-1410-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/3280-1638-0x0000000073F40000-0x0000000073F79000-memory.dmp

Filesize
228KB

Download
memory/3280-1434-0x0000000073F40000-0x0000000073F79000-memory.dmp

Filesize
228KB

Download
memory/3280-1742-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/3280-1743-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/3280-1744-0x000000006D410000-0x000000006D449000-memory.dmp

Filesize
228KB

Download
memory/3280-1633-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/3280-1634-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/3280-1635-0x0000000073F40000-0x0000000073F79000-memory.dmp

Filesize
228KB

Download
memory/3280-1636-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/3280-1637-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download