amadey | 15229dcebe0701228fde02db680d4bb51f803f3f6b6e5a0c5dbf26f6fff206e0

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/09/2024, 01:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
15229dcebe0701228fde02db680d4bb51f803f3f6b6e5a0c5dbf26f6fff206e0.exe
Size 1.8MB
Sample240902-bdbg7axgrd
SHA256 15229dcebe0701228fde02db680d4bb51f803f3f6b6e5a0c5dbf26f6fff206e0
MD5 b23a126d9fa0fb4a8dc0ac3ddb0b3272
SHA1 ac11ca5683a5942539f7d9a50a5a31a4fa18e5fb
SHA512 8ee2711103b14a23ac97d45bbb81fc05cf2512eb70bfc506ca35c5efcc76f6d14ec7b5795ae6c4995e50edd6114d974d1afce610e75c1eaa8da56744b157d2a1
SSDEEP 49152:fa7ngGIcABweSN6gChLr5qugO/nR0LUrdz5NXcPnzEkZOrTwC4v:bakweyWLXgvYVHMPnz3ZOvwdv
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey stealc 0657d1 c7817d leva discovery evasion stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

0657d1

http://185.215.113.19

Attributes

install_dir
0d8f5eb8a7
install_file
explorti.exe
strings_key
6c55a5f34bb433fbd933a168577b1838
url_paths
/Vi9leo/index.php

rc4.plain

Extracted

Family

amadey

Version

4.41

Botnet

c7817d

http://31.41.244.10

Attributes

install_dir
0e8d0864aa
install_file
svoutse.exe
strings_key
5481b88a6ef75bcf21333988a4e47048
url_paths
/Dem7kTu/index.php

rc4.plain

Extracted

Family

stealc

Botnet

leva

http://185.215.113.100

Attributes

url_path
/e2b1563c6670f193.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Stealc
Stealc is an infostealer written in C++.
stealer stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 10 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	svoutse.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	bd25299d77.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	b9462df0a0.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	svoutse.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	svoutse.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	15229dcebe0701228fde02db680d4bb51f803f3f6b6e5a0c5dbf26f6fff206e0.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 20 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	bd25299d77.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	bd25299d77.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	15229dcebe0701228fde02db680d4bb51f803f3f6b6e5a0c5dbf26f6fff206e0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	b9462df0a0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	b9462df0a0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	15229dcebe0701228fde02db680d4bb51f803f3f6b6e5a0c5dbf26f6fff206e0.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	15229dcebe0701228fde02db680d4bb51f803f3f6b6e5a0c5dbf26f6fff206e0.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	explorti.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	explorti.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	svoutse.exe

Executes dropped EXE 10 IoCs

pid	Process
5008	explorti.exe
2640	explorti.exe
1568	svoutse.exe
1672	bd25299d77.exe
1384	b9462df0a0.exe
4944	c3a72a3fc8.exe
5416	explorti.exe
5448	svoutse.exe
3092	explorti.exe
3988	svoutse.exe

Identifies Wine through registry keys 2 TTPs 10 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Wine	svoutse.exe
Key opened	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Wine	bd25299d77.exe
Key opened	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Wine	b9462df0a0.exe
Key opened	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Wine	svoutse.exe
Key opened	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Wine	svoutse.exe
Key opened	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Wine	15229dcebe0701228fde02db680d4bb51f803f3f6b6e5a0c5dbf26f6fff206e0.exe
Key opened	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Wine	explorti.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x0007000000023504-88.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 10 IoCs

pid	Process
4716	15229dcebe0701228fde02db680d4bb51f803f3f6b6e5a0c5dbf26f6fff206e0.exe
5008	explorti.exe
2640	explorti.exe
1568	svoutse.exe
1672	bd25299d77.exe
1384	b9462df0a0.exe
5448	svoutse.exe
5416	explorti.exe
3988	svoutse.exe
3092	explorti.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explorti.job	15229dcebe0701228fde02db680d4bb51f803f3f6b6e5a0c5dbf26f6fff206e0.exe
File created	C:\Windows\Tasks\svoutse.job	explorti.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svoutse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c3a72a3fc8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	15229dcebe0701228fde02db680d4bb51f803f3f6b6e5a0c5dbf26f6fff206e0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorti.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorti.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bd25299d77.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b9462df0a0.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
5060	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
2616	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
4716	15229dcebe0701228fde02db680d4bb51f803f3f6b6e5a0c5dbf26f6fff206e0.exe
4716	15229dcebe0701228fde02db680d4bb51f803f3f6b6e5a0c5dbf26f6fff206e0.exe
5008	explorti.exe
5008	explorti.exe
2640	explorti.exe
2640	explorti.exe
1568	svoutse.exe
1568	svoutse.exe
1672	bd25299d77.exe
1672	bd25299d77.exe
1384	b9462df0a0.exe
1384	b9462df0a0.exe
1300	msedge.exe
1300	msedge.exe
4060	msedge.exe
4060	msedge.exe
5844	identity_helper.exe
5844	identity_helper.exe
5448	svoutse.exe
5448	svoutse.exe
5416	explorti.exe
5416	explorti.exe
3988	svoutse.exe
3988	svoutse.exe
3092	explorti.exe
3092	explorti.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4944	c3a72a3fc8.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 29 IoCs

pid	Process
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2616	taskkill.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2640	explorti.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4060	msedge.exe
4060	msedge.exe
4944	c3a72a3fc8.exe
4060	msedge.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe
4944	c3a72a3fc8.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4716 wrote to memory of 5008	4716	15229dcebe0701228fde02db680d4bb51f803f3f6b6e5a0c5dbf26f6fff206e0.exe	86
PID 4716 wrote to memory of 5008	4716	15229dcebe0701228fde02db680d4bb51f803f3f6b6e5a0c5dbf26f6fff206e0.exe	86
PID 4716 wrote to memory of 5008	4716	15229dcebe0701228fde02db680d4bb51f803f3f6b6e5a0c5dbf26f6fff206e0.exe	86
PID 5008 wrote to memory of 4724	5008	explorti.exe	88
PID 5008 wrote to memory of 4724	5008	explorti.exe	88
PID 5008 wrote to memory of 4724	5008	explorti.exe	88
PID 4724 wrote to memory of 2616	4724	cmd.exe	90
PID 4724 wrote to memory of 2616	4724	cmd.exe	90
PID 4724 wrote to memory of 2616	4724	cmd.exe	90
PID 4724 wrote to memory of 5060	4724	cmd.exe	92
PID 4724 wrote to memory of 5060	4724	cmd.exe	92
PID 4724 wrote to memory of 5060	4724	cmd.exe	92
PID 4724 wrote to memory of 2640	4724	cmd.exe	93
PID 4724 wrote to memory of 2640	4724	cmd.exe	93
PID 4724 wrote to memory of 2640	4724	cmd.exe	93
PID 2640 wrote to memory of 1568	2640	explorti.exe	96
PID 2640 wrote to memory of 1568	2640	explorti.exe	96
PID 2640 wrote to memory of 1568	2640	explorti.exe	96
PID 1568 wrote to memory of 1672	1568	svoutse.exe	98
PID 1568 wrote to memory of 1672	1568	svoutse.exe	98
PID 1568 wrote to memory of 1672	1568	svoutse.exe	98
PID 1568 wrote to memory of 1384	1568	svoutse.exe	100
PID 1568 wrote to memory of 1384	1568	svoutse.exe	100
PID 1568 wrote to memory of 1384	1568	svoutse.exe	100
PID 1568 wrote to memory of 4944	1568	svoutse.exe	101
PID 1568 wrote to memory of 4944	1568	svoutse.exe	101
PID 1568 wrote to memory of 4944	1568	svoutse.exe	101
PID 4944 wrote to memory of 4060	4944	c3a72a3fc8.exe	102
PID 4944 wrote to memory of 4060	4944	c3a72a3fc8.exe	102
PID 4060 wrote to memory of 3412	4060	msedge.exe	103
PID 4060 wrote to memory of 3412	4060	msedge.exe	103
PID 4060 wrote to memory of 4932	4060	msedge.exe	104
PID 4060 wrote to memory of 4932	4060	msedge.exe	104
PID 4060 wrote to memory of 4932	4060	msedge.exe	104
PID 4060 wrote to memory of 4932	4060	msedge.exe	104
PID 4060 wrote to memory of 4932	4060	msedge.exe	104
PID 4060 wrote to memory of 4932	4060	msedge.exe	104
PID 4060 wrote to memory of 4932	4060	msedge.exe	104
PID 4060 wrote to memory of 4932	4060	msedge.exe	104
PID 4060 wrote to memory of 4932	4060	msedge.exe	104
PID 4060 wrote to memory of 4932	4060	msedge.exe	104
PID 4060 wrote to memory of 4932	4060	msedge.exe	104
PID 4060 wrote to memory of 4932	4060	msedge.exe	104
PID 4060 wrote to memory of 4932	4060	msedge.exe	104
PID 4060 wrote to memory of 4932	4060	msedge.exe	104
PID 4060 wrote to memory of 4932	4060	msedge.exe	104
PID 4060 wrote to memory of 4932	4060	msedge.exe	104
PID 4060 wrote to memory of 4932	4060	msedge.exe	104
PID 4060 wrote to memory of 4932	4060	msedge.exe	104
PID 4060 wrote to memory of 4932	4060	msedge.exe	104
PID 4060 wrote to memory of 4932	4060	msedge.exe	104
PID 4060 wrote to memory of 4932	4060	msedge.exe	104
PID 4060 wrote to memory of 4932	4060	msedge.exe	104
PID 4060 wrote to memory of 4932	4060	msedge.exe	104
PID 4060 wrote to memory of 4932	4060	msedge.exe	104
PID 4060 wrote to memory of 4932	4060	msedge.exe	104
PID 4060 wrote to memory of 4932	4060	msedge.exe	104
PID 4060 wrote to memory of 4932	4060	msedge.exe	104
PID 4060 wrote to memory of 4932	4060	msedge.exe	104
PID 4060 wrote to memory of 4932	4060	msedge.exe	104
PID 4060 wrote to memory of 4932	4060	msedge.exe	104
PID 4060 wrote to memory of 4932	4060	msedge.exe	104
PID 4060 wrote to memory of 4932	4060	msedge.exe	104
PID 4060 wrote to memory of 4932	4060	msedge.exe	104

C:\Users\Admin\AppData\Local\Temp\15229dcebe0701228fde02db680d4bb51f803f3f6b6e5a0c5dbf26f6fff206e0.exe
"C:\Users\Admin\AppData\Local\Temp\15229dcebe0701228fde02db680d4bb51f803f3f6b6e5a0c5dbf26f6fff206e0.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4716
- C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
  "C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Checks computer location settings
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5008
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k "taskkill /f /im "explorti.exe" && timeout 1 && del "explorti.exe" && ren 0657d1 explorti.exe && C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe && Exit"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4724
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "explorti.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2616
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 1
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:5060
  - - C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
      C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Checks computer location settings
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:2640
    - - C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Checks computer location settings
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1568
      - C:\Users\Admin\AppData\Roaming\1000026000\bd25299d77.exe
        
        "C:\Users\Admin\AppData\Roaming\1000026000\bd25299d77.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1672
      - C:\Users\Admin\AppData\Roaming\1000027000\b9462df0a0.exe
        
        "C:\Users\Admin\AppData\Roaming\1000027000\b9462df0a0.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1384
      - C:\Users\Admin\AppData\Local\Temp\1000028001\c3a72a3fc8.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000028001\c3a72a3fc8.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:4944
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
        7⤵
        Enumerates system info in registry
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:4060
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff82d846f8,0x7fff82d84708,0x7fff82d84718
        8⤵
        
        PID:3412
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,10494763177773377578,17054791483027041240,131072 --disable-features=TranslateUI --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
        8⤵
        
        PID:4932
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,10494763177773377578,17054791483027041240,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1300
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,10494763177773377578,17054791483027041240,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
        8⤵
        
        PID:648
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10494763177773377578,17054791483027041240,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
        8⤵
        
        PID:756
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10494763177773377578,17054791483027041240,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
        8⤵
        
        PID:3828
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10494763177773377578,17054791483027041240,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3096 /prefetch:1
        8⤵
        
        PID:4852
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10494763177773377578,17054791483027041240,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2824 /prefetch:1
        8⤵
        
        PID:1468
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10494763177773377578,17054791483027041240,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4212 /prefetch:1
        8⤵
        
        PID:1604
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10494763177773377578,17054791483027041240,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4328 /prefetch:1
        8⤵
        
        PID:4832
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10494763177773377578,17054791483027041240,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3868 /prefetch:1
        8⤵
        
        PID:3472
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10494763177773377578,17054791483027041240,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4616 /prefetch:1
        8⤵
        
        PID:3308
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10494763177773377578,17054791483027041240,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:1
        8⤵
        
        PID:2244
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10494763177773377578,17054791483027041240,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:1
        8⤵
        
        PID:4624
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10494763177773377578,17054791483027041240,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
        8⤵
        
        PID:2340
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10494763177773377578,17054791483027041240,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
        8⤵
        
        PID:4464
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10494763177773377578,17054791483027041240,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
        8⤵
        
        PID:2900
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10494763177773377578,17054791483027041240,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4476 /prefetch:1
        8⤵
        
        PID:3248
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10494763177773377578,17054791483027041240,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
        8⤵
        
        PID:2424
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10494763177773377578,17054791483027041240,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
        8⤵
        
        PID:4872
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10494763177773377578,17054791483027041240,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
        8⤵
        
        PID:5076
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10494763177773377578,17054791483027041240,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:1
        8⤵
        
        PID:4016
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10494763177773377578,17054791483027041240,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2624 /prefetch:1
        8⤵
        
        PID:5316
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10494763177773377578,17054791483027041240,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4448 /prefetch:1
        8⤵
        
        PID:5328
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10494763177773377578,17054791483027041240,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6744 /prefetch:1
        8⤵
        
        PID:5364
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10494763177773377578,17054791483027041240,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6724 /prefetch:1
        8⤵
        
        PID:5624
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10494763177773377578,17054791483027041240,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
        8⤵
        
        PID:5660
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10494763177773377578,17054791483027041240,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3904 /prefetch:1
        8⤵
        
        PID:5672
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10494763177773377578,17054791483027041240,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
        8⤵
        
        PID:5712
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10494763177773377578,17054791483027041240,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6848 /prefetch:1
        8⤵
        
        PID:5892
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10494763177773377578,17054791483027041240,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7536 /prefetch:1
        8⤵
        
        PID:5988
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10494763177773377578,17054791483027041240,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7768 /prefetch:1
        8⤵
        
        PID:6012
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10494763177773377578,17054791483027041240,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7696 /prefetch:1
        8⤵
        
        PID:3976
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,10494763177773377578,17054791483027041240,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5636 /prefetch:8
        8⤵
        
        PID:6016
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,10494763177773377578,17054791483027041240,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5636 /prefetch:8
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5844
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,10494763177773377578,17054791483027041240,131072 --disable-features=TranslateUI --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1196 /prefetch:2
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4168

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5124

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5372

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5416

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5448

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3988

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat
Size 152B
SHA256 e76dea8978eed307ecdafbfdf9933862f5460b38d3156c764754275a168827e1
MD5 59215734f1bd789381ec7d5bfc60e60f
SHA1 d85269c6295701b463c59d5e1b820eb026fdf002
SHA512 ef36c9388b21904937784f17d49ea0668339fdb21c245997d2f6b4228ada1b4c87faf55e20ae25017c51bbd65326b5c04e5e2bd63087d5c5394077aa83e024d5
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat
Size 152B
SHA256 f82ec283b5ac4843165508173bb2ea3a950a12a64dd75fb8f34c4887c395dfa2
MD5 33916a8f5ba01a088f73faba4a19ee79
SHA1 0b39106cf5510182772d72d4af6a1b46e489c026
SHA512 818c5cf46f55cf9671b4b7a7797b03aa47b3887cd137aadc2b6616019517d64636f453c6b1a0585e87506c3f9f1140edf71f3ab6696d2da959723c55d0694959
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat
Size 152B
SHA256 16c270f6e43b35b5e291be6d51efb006c65b8e983b976d2afbfaedeba16010ea
MD5 045de626e67da515747619e2ed64689b
SHA1 11a8203ab8038a95decaef41e7a83b1abccd8c76
SHA512 ff795530ddc69045db24c947cec49c9a61f496abeadb713c074f9a07c22131691219398294ebdf5ea6e5cdefd5d23c75be2abaef64257b367f7d00ffd9361020
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Microsoft Edge.lnk

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Microsoft Edge.lnk
Size 1KB
SHA256 e6dff62b72da83c16677fd5f611d9d35bef6aa7f90166c63567e05d4c348da2c
MD5 899e2175890b1e425662003cd5801933
SHA1 7280512027aa3e8921f12a17b625657917717a03
SHA512 a5cfc9880c77cbf0f65466b6ed2b18be8d0e6ca0bfb63d0918281201e2c113d5e020ada94b65b5100bae617ed6940355f54b3acaec6e12a056fa6edc6b5dc168
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences
Size 4KB
SHA256 115ed2744f95c6c26bf823d599ff4edf418c16d3c43cc39aff5565651559ddf4
MD5 e6c2335ae50f5ce7ef7a090374c49e80
SHA1 56649bae5ce8ee1df2a74205beb62d775730be1f
SHA512 c2cff8ebef88f6b2d13d5bb81c9ad253dc801a09584031fab8d9e394c791fc65aacae80bc03b8902444fbc193c8e9f6c7ef7f6e280120dae46670a36de5afd19
SSDEEP 96:n8y7Q1JCttmdpvWMoiVmdeHqLchUBKVD7AiEwb:n8fPuIWMXQYYE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences
Size 4KB
SHA256 06d1157753f4277612a682701da7e73096429457f08639850d53cd5724e61f16
MD5 86ed374aabd6ac1059a9390b5e5a0d9f
SHA1 2f24f25baabf4cef773b1172d098430f64beb1d7
SHA512 114346b9666601dc965335463d3f1f9ee7e394c2f5ef4624069a7f96fa007aa5adfa345c068b89cc5c8d6a80caad69f91af09c8aa8a1d8bcbace603cbb0f13c0
SSDEEP 96:n8y7Q1JCttmdpvWMoiVmdeHqLIhUBKVD7AiEwb:n8fPuIWMXQ8YE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences
Size 24KB
SHA256 f5fbce6fa510d442a6277a8d40ba3154ecf242468c30db3b5fe4484bca9a3947
MD5 9adf9909469eed353719443f23ee1303
SHA1 682d4123e424e3894cab3787381006720befd7a6
SHA512 8554140aeace69a5630da8b4a6a363a321519e85813db25cfcc93ec0759767b8437ea3faa665a2b758e53b115c84cf6568e54dc5af3d6f909e4acd40b383adde
SSDEEP 768:nngWur8F1+UoAYDCx9Tuqh0VfUC9xbog/OVTLl5IrU9E9S:nngWuru1jakLv9E0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences~RFe581410.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences~RFe581410.TMP
Size 24KB
SHA256 d7830a92a1aee3f167b9e129671cf1c0ac244d10ea9a89cae9ebda9d49e22dce
MD5 0441693de7e14725aca2240d2fed2e44
SHA1 0a6ed8413941a71aed20c0ca0816c9c70ccf6b45
SHA512 cd38b9968b05f12da194f878e5cd2d5b782f026cfef5936a6d0587a48903219280264165ddbcd4b1ac59c83c96759058ec1b31b5b704e2962e663328a2510c74
SSDEEP 768:fgWtJ8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3Ll5ErU9g9W:fgWtJu1jayL79gI
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

f2d45de0-a141-4e0e-9231-12b00b4e0f90.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\f2d45de0-a141-4e0e-9231-12b00b4e0f90.tmp
Size 4KB
SHA256 4f27f57917bd2dfb7cbb37888c9eab6bee455e7477d3d80fd12f163c18fbaa7e
MD5 92fd8664eee7ee9b3e17f4a16cb4b0a5
SHA1 5b7342fe6054ec29f5a827682f7f0038581744db
SHA512 455d12291d9182010a556ee871d111f2eec3be1087065a428ec36c128475022dee50860b675508f398afea30726b0c20fa8d38601274b02beeb294bac4747844
SSDEEP 96:n8B7e1JCttmdpvWMoiVmdeHqLIhUBKVDCzia:n8MPuIWMXQ8Y3
MD5 SHA1 SHA512 SSDEEP

Submit Download

d2c5cf6c-d701-40a2-bb29-c5e8d18d9380.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\d2c5cf6c-d701-40a2-bb29-c5e8d18d9380.tmp
Size 9KB
SHA256 d569962e67de756ffd7650db308793b52a98a25b4197b038040defbf3da31603
MD5 2ab629f76e3e547fc759a1bd62a95b51
SHA1 c622861a3b45ce97a4d86dfe1f049130e409f09c
SHA512 3204683489a8f3db0295431a9d9a2987ddf508bc09b2c63e433dcf43bbcf371e2911c432a966a865c411fb2d66f8f145ab2ac05330ef80a7ddc33f3a6bf8a344
SSDEEP 192:RoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupH4eMRUh8wDRw5Ytj9Zklq8:N9iIxuERzA83h09RZxYsukkLsl
MD5 SHA1 SHA512 SSDEEP

Submit Download

0657d1

Path C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\0657d1
Size 1.8MB
SHA256 0cce55a6fec4dbf3581208ef779f877ff43ecbaa27d2f2119d6552d06b684493
MD5 5a4f2d577db2373f79eb9d16f8037af4
SHA1 ed08c149b8992e508e7382b0a19e6685eb9caf5e
SHA512 ec8bec4bf9433e4fd41e3a4b74e7bb1b8dbf46e15ab528e4feed51750e3c9e43ed59fcbc12982fc36bd50172a752325b192dfc65195f7118c47f1e7c2d24eccb
SSDEEP 49152:R7wbCfJnoVxG8rdz1iuf4ri4pmy/Yr8rxXm:RFfJoVxGmdZiFrzdyyxXm
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorti.exe

Path C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Size 1.8MB
SHA256 15229dcebe0701228fde02db680d4bb51f803f3f6b6e5a0c5dbf26f6fff206e0
MD5 b23a126d9fa0fb4a8dc0ac3ddb0b3272
SHA1 ac11ca5683a5942539f7d9a50a5a31a4fa18e5fb
SHA512 8ee2711103b14a23ac97d45bbb81fc05cf2512eb70bfc506ca35c5efcc76f6d14ec7b5795ae6c4995e50edd6114d974d1afce610e75c1eaa8da56744b157d2a1
SSDEEP 49152:fa7ngGIcABweSN6gChLr5qugO/nR0LUrdz5NXcPnzEkZOrTwC4v:bakweyWLXgvYVHMPnz3ZOvwdv
MD5 SHA1 SHA512 SSDEEP

Submit Download

c3a72a3fc8.exe

Path C:\Users\Admin\AppData\Local\Temp\1000028001\c3a72a3fc8.exe
Size 896KB
SHA256 1cf0747ce1310fd989b24a93d2108784efb003948fdec1f7e64479213075cb90
MD5 f0356008c23a76acfc263b5c3e2180cb
SHA1 2ed3657f3ee94a5cc0cf6b8b30a1334a9311baa2
SHA512 67efa62082d20bef10318cb2a46391219ee377138b50e5d05fdf2f8945092d1b9401e7cce6f3ccbdfe26f800e896d5e634c5fe41260cca4c0d3055b21c2bdf2a
SSDEEP 12288:vqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgacTy:vqDEvCTbMWu7rQYlBQcBiT6rprG8asy
MD5 SHA1 SHA512 SSDEEP

Submit Download

bd25299d77.exe

Path C:\Users\Admin\AppData\Roaming\1000026000\bd25299d77.exe
Size 1.7MB
SHA256 83ebffd7d12fabe2f1bf465425e0883ff62d4bbdbab60924acaafd8ce197465c
MD5 538ef8d8696f1a9f1388a615ed4cf361
SHA1 280a7c4edc18e0c5e836d02d78f6bfbafe15c5bc
SHA512 f9bdf7d3569957f39d60fae6996da3491c92203d3f271e0cf832da4bc4c580a8e2fa33a6ccd15ce8e386ab1b1a9414470d31618828b0bd6b63a75f5da03769ad
SSDEEP 49152:Kmgy8lNBFQ1xx70XhuHiWpPlg9hrtxIQ:Pp8l61T0RuHP29FIQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

KGDUCWP10X4N7PG5O1WN.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\KGDUCWP10X4N7PG5O1WN.temp
Size 3KB
SHA256 0ac880b73287fdd5739a820e6743427dbb24bb3273c6717842ef7790aacb2609
MD5 d464a8c9f78c99b2fc4426f6f1661e12
SHA1 8d5101f41fd89ae2c80a1ea0652591ed60f36372
SHA512 7601011a77449005d0c4354d97a5bca51aa5e6679cba50ba3880fe2ef027e5bbc31998b43f34f993b9d0900a64ffd0fb0aa92ea3dc420c46af6af76fd68b6906
MD5 SHA1 SHA512

Submit Download

memory/1384-80-0x0000000000100000-0x0000000000791000-memory.dmp

Download

memory/1384-83-0x0000000000100000-0x0000000000791000-memory.dmp

Download

memory/1568-47-0x0000000000290000-0x0000000000758000-memory.dmp

Download

memory/1568-439-0x0000000000290000-0x0000000000758000-memory.dmp

Download

memory/1568-393-0x0000000000290000-0x0000000000758000-memory.dmp

Download

memory/1568-403-0x0000000000290000-0x0000000000758000-memory.dmp

Download

memory/1568-447-0x0000000000290000-0x0000000000758000-memory.dmp

Download

memory/1568-413-0x0000000000290000-0x0000000000758000-memory.dmp

Download

memory/1568-253-0x0000000000290000-0x0000000000758000-memory.dmp

Download

memory/1568-444-0x0000000000290000-0x0000000000758000-memory.dmp

Download

memory/1568-441-0x0000000000290000-0x0000000000758000-memory.dmp

Download

memory/1568-289-0x0000000000290000-0x0000000000758000-memory.dmp

Download

memory/1568-440-0x0000000000290000-0x0000000000758000-memory.dmp

Download

memory/1568-392-0x0000000000290000-0x0000000000758000-memory.dmp

Download

memory/1568-367-0x0000000000290000-0x0000000000758000-memory.dmp

Download

memory/1568-314-0x0000000000290000-0x0000000000758000-memory.dmp

Download

memory/1568-432-0x0000000000290000-0x0000000000758000-memory.dmp

Download

memory/1568-433-0x0000000000290000-0x0000000000758000-memory.dmp

Download

memory/1672-82-0x0000000000B20000-0x00000000011B1000-memory.dmp

Download

memory/1672-65-0x0000000000B20000-0x00000000011B1000-memory.dmp

Download

memory/2640-35-0x0000000000CF0000-0x00000000011B8000-memory.dmp

Download

memory/2640-49-0x0000000000CF0000-0x00000000011B8000-memory.dmp

Download

memory/3092-438-0x0000000000CF0000-0x00000000011B8000-memory.dmp

Download

memory/3988-436-0x0000000000290000-0x0000000000758000-memory.dmp

Download

memory/3988-437-0x0000000000290000-0x0000000000758000-memory.dmp

Download

memory/4716-2-0x0000000000031000-0x000000000005F000-memory.dmp

Download

memory/4716-5-0x0000000000030000-0x00000000004FE000-memory.dmp

Download

memory/4716-0-0x0000000000030000-0x00000000004FE000-memory.dmp

Download

memory/4716-17-0x0000000000030000-0x00000000004FE000-memory.dmp

Download

memory/4716-1-0x0000000077CE4000-0x0000000077CE6000-memory.dmp

Download

memory/4716-3-0x0000000000030000-0x00000000004FE000-memory.dmp

Download

memory/5008-18-0x0000000000590000-0x0000000000A5E000-memory.dmp

Download

memory/5008-19-0x0000000000591000-0x00000000005BF000-memory.dmp

Download

memory/5008-20-0x0000000000590000-0x0000000000A5E000-memory.dmp

Download

memory/5008-21-0x0000000000590000-0x0000000000A5E000-memory.dmp

Download

memory/5008-22-0x0000000000590000-0x0000000000A5E000-memory.dmp

Download

memory/5008-32-0x0000000000590000-0x0000000000A5E000-memory.dmp

Download

memory/5416-391-0x0000000000CF0000-0x00000000011B8000-memory.dmp

Download

memory/5448-388-0x0000000000290000-0x0000000000758000-memory.dmp

Download

memory/5448-389-0x0000000000290000-0x0000000000758000-memory.dmp

Download