amadey | 53f9b3b2ea25424baf94da442973f4efd71e1218a3b837600334d97898ebfd7e

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/09/2024, 01:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
53f9b3b2ea25424baf94da442973f4efd71e1218a3b837600334d97898ebfd7e.exe
Size 1.8MB
Sample240902-bevmfsxbln
SHA256 53f9b3b2ea25424baf94da442973f4efd71e1218a3b837600334d97898ebfd7e
MD5 0f2694844eb16391e15196e17e545f0b
SHA1 cb6cbd6a90349afa4624a221b3350af44feb4d71
SHA512 51179c080ce6dce08e8c78e392e20d283c0052e91ed3c4c651b9e53741a3c720f6e87d393eaf0cf8bed54a85d4c92699910b5d0fe237f8dbdcc75d6fe9cd3cd6
SSDEEP 49152:bxqFd8IXr3G0NPQQdiwHm+34RapwXKby8Y3O:bxqbhrGoPQQJHlp9Ye
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey stealc 0657d1 c7817d leva discovery evasion stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

0657d1

http://185.215.113.19

Attributes

install_dir
0d8f5eb8a7
install_file
explorti.exe
strings_key
6c55a5f34bb433fbd933a168577b1838
url_paths
/Vi9leo/index.php

rc4.plain

Extracted

Family

amadey

Version

4.41

Botnet

c7817d

http://31.41.244.10

Attributes

install_dir
0e8d0864aa
install_file
svoutse.exe
strings_key
5481b88a6ef75bcf21333988a4e47048
url_paths
/Dem7kTu/index.php

rc4.plain

Extracted

Family

stealc

Botnet

leva

http://185.215.113.100

Attributes

url_path
/e2b1563c6670f193.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Stealc
Stealc is an infostealer written in C++.
stealer stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 10 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	svoutse.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	65d98e5602.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	ee874a2837.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	svoutse.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	svoutse.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	53f9b3b2ea25424baf94da442973f4efd71e1218a3b837600334d97898ebfd7e.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 20 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ee874a2837.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	53f9b3b2ea25424baf94da442973f4efd71e1218a3b837600334d97898ebfd7e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	65d98e5602.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	65d98e5602.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ee874a2837.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	53f9b3b2ea25424baf94da442973f4efd71e1218a3b837600334d97898ebfd7e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	explorti.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	explorti.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	svoutse.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	53f9b3b2ea25424baf94da442973f4efd71e1218a3b837600334d97898ebfd7e.exe

Executes dropped EXE 10 IoCs

pid	Process
3160	explorti.exe
2140	explorti.exe
2940	svoutse.exe
4572	65d98e5602.exe
3272	ee874a2837.exe
4628	ee874a2837.exe
5124	svoutse.exe
2160	explorti.exe
5696	svoutse.exe
5576	explorti.exe

Identifies Wine through registry keys 2 TTPs 10 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Wine	ee874a2837.exe
Key opened	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Wine	svoutse.exe
Key opened	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Wine	53f9b3b2ea25424baf94da442973f4efd71e1218a3b837600334d97898ebfd7e.exe
Key opened	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Wine	svoutse.exe
Key opened	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Wine	65d98e5602.exe
Key opened	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Wine	svoutse.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000700000002345a-88.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 10 IoCs

pid	Process
4552	53f9b3b2ea25424baf94da442973f4efd71e1218a3b837600334d97898ebfd7e.exe
3160	explorti.exe
2140	explorti.exe
2940	svoutse.exe
4572	65d98e5602.exe
3272	ee874a2837.exe
5124	svoutse.exe
2160	explorti.exe
5696	svoutse.exe
5576	explorti.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explorti.job	53f9b3b2ea25424baf94da442973f4efd71e1218a3b837600334d97898ebfd7e.exe
File created	C:\Windows\Tasks\svoutse.job	explorti.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svoutse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ee874a2837.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ee874a2837.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorti.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	65d98e5602.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	53f9b3b2ea25424baf94da442973f4efd71e1218a3b837600334d97898ebfd7e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorti.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2152	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
4584	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
4552	53f9b3b2ea25424baf94da442973f4efd71e1218a3b837600334d97898ebfd7e.exe
4552	53f9b3b2ea25424baf94da442973f4efd71e1218a3b837600334d97898ebfd7e.exe
3160	explorti.exe
3160	explorti.exe
2140	explorti.exe
2140	explorti.exe
2940	svoutse.exe
2940	svoutse.exe
4572	65d98e5602.exe
4572	65d98e5602.exe
3272	ee874a2837.exe
3272	ee874a2837.exe
1268	msedge.exe
1268	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
396	identity_helper.exe
396	identity_helper.exe
5124	svoutse.exe
5124	svoutse.exe
2160	explorti.exe
2160	explorti.exe
5696	svoutse.exe
5696	svoutse.exe
5576	explorti.exe
5576	explorti.exe
5752	msedge.exe
5752	msedge.exe
5752	msedge.exe
5752	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4628	ee874a2837.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 33 IoCs

pid	Process
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4584	taskkill.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4552	53f9b3b2ea25424baf94da442973f4efd71e1218a3b837600334d97898ebfd7e.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
1208	msedge.exe
1208	msedge.exe
4628	ee874a2837.exe
1208	msedge.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe
4628	ee874a2837.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4552 wrote to memory of 3160	4552	53f9b3b2ea25424baf94da442973f4efd71e1218a3b837600334d97898ebfd7e.exe	86
PID 4552 wrote to memory of 3160	4552	53f9b3b2ea25424baf94da442973f4efd71e1218a3b837600334d97898ebfd7e.exe	86
PID 4552 wrote to memory of 3160	4552	53f9b3b2ea25424baf94da442973f4efd71e1218a3b837600334d97898ebfd7e.exe	86
PID 3160 wrote to memory of 2008	3160	explorti.exe	92
PID 3160 wrote to memory of 2008	3160	explorti.exe	92
PID 3160 wrote to memory of 2008	3160	explorti.exe	92
PID 2008 wrote to memory of 4584	2008	cmd.exe	94
PID 2008 wrote to memory of 4584	2008	cmd.exe	94
PID 2008 wrote to memory of 4584	2008	cmd.exe	94
PID 2008 wrote to memory of 2152	2008	cmd.exe	95
PID 2008 wrote to memory of 2152	2008	cmd.exe	95
PID 2008 wrote to memory of 2152	2008	cmd.exe	95
PID 2008 wrote to memory of 2140	2008	cmd.exe	96
PID 2008 wrote to memory of 2140	2008	cmd.exe	96
PID 2008 wrote to memory of 2140	2008	cmd.exe	96
PID 2140 wrote to memory of 2940	2140	explorti.exe	97
PID 2140 wrote to memory of 2940	2140	explorti.exe	97
PID 2140 wrote to memory of 2940	2140	explorti.exe	97
PID 2940 wrote to memory of 4572	2940	svoutse.exe	99
PID 2940 wrote to memory of 4572	2940	svoutse.exe	99
PID 2940 wrote to memory of 4572	2940	svoutse.exe	99
PID 2940 wrote to memory of 3272	2940	svoutse.exe	100
PID 2940 wrote to memory of 3272	2940	svoutse.exe	100
PID 2940 wrote to memory of 3272	2940	svoutse.exe	100
PID 2940 wrote to memory of 4628	2940	svoutse.exe	103
PID 2940 wrote to memory of 4628	2940	svoutse.exe	103
PID 2940 wrote to memory of 4628	2940	svoutse.exe	103
PID 4628 wrote to memory of 1208	4628	ee874a2837.exe	104
PID 4628 wrote to memory of 1208	4628	ee874a2837.exe	104
PID 1208 wrote to memory of 3676	1208	msedge.exe	105
PID 1208 wrote to memory of 3676	1208	msedge.exe	105
PID 1208 wrote to memory of 4312	1208	msedge.exe	106
PID 1208 wrote to memory of 4312	1208	msedge.exe	106
PID 1208 wrote to memory of 4312	1208	msedge.exe	106
PID 1208 wrote to memory of 4312	1208	msedge.exe	106
PID 1208 wrote to memory of 4312	1208	msedge.exe	106
PID 1208 wrote to memory of 4312	1208	msedge.exe	106
PID 1208 wrote to memory of 4312	1208	msedge.exe	106
PID 1208 wrote to memory of 4312	1208	msedge.exe	106
PID 1208 wrote to memory of 4312	1208	msedge.exe	106
PID 1208 wrote to memory of 4312	1208	msedge.exe	106
PID 1208 wrote to memory of 4312	1208	msedge.exe	106
PID 1208 wrote to memory of 4312	1208	msedge.exe	106
PID 1208 wrote to memory of 4312	1208	msedge.exe	106
PID 1208 wrote to memory of 4312	1208	msedge.exe	106
PID 1208 wrote to memory of 4312	1208	msedge.exe	106
PID 1208 wrote to memory of 4312	1208	msedge.exe	106
PID 1208 wrote to memory of 4312	1208	msedge.exe	106
PID 1208 wrote to memory of 4312	1208	msedge.exe	106
PID 1208 wrote to memory of 4312	1208	msedge.exe	106
PID 1208 wrote to memory of 4312	1208	msedge.exe	106
PID 1208 wrote to memory of 4312	1208	msedge.exe	106
PID 1208 wrote to memory of 4312	1208	msedge.exe	106
PID 1208 wrote to memory of 4312	1208	msedge.exe	106
PID 1208 wrote to memory of 4312	1208	msedge.exe	106
PID 1208 wrote to memory of 4312	1208	msedge.exe	106
PID 1208 wrote to memory of 4312	1208	msedge.exe	106
PID 1208 wrote to memory of 4312	1208	msedge.exe	106
PID 1208 wrote to memory of 4312	1208	msedge.exe	106
PID 1208 wrote to memory of 4312	1208	msedge.exe	106
PID 1208 wrote to memory of 4312	1208	msedge.exe	106
PID 1208 wrote to memory of 4312	1208	msedge.exe	106
PID 1208 wrote to memory of 4312	1208	msedge.exe	106
PID 1208 wrote to memory of 4312	1208	msedge.exe	106

C:\Users\Admin\AppData\Local\Temp\53f9b3b2ea25424baf94da442973f4efd71e1218a3b837600334d97898ebfd7e.exe
"C:\Users\Admin\AppData\Local\Temp\53f9b3b2ea25424baf94da442973f4efd71e1218a3b837600334d97898ebfd7e.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4552
- C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
  "C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Checks computer location settings
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3160
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k "taskkill /f /im "explorti.exe" && timeout 1 && del "explorti.exe" && ren 0657d1 explorti.exe && C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe && Exit"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2008
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "explorti.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4584
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 1
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:2152
  - - C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
      C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Checks computer location settings
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2140
    - - C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Checks computer location settings
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2940
      - C:\Users\Admin\AppData\Roaming\1000026000\65d98e5602.exe
        
        "C:\Users\Admin\AppData\Roaming\1000026000\65d98e5602.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4572
      - C:\Users\Admin\AppData\Roaming\1000027000\ee874a2837.exe
        
        "C:\Users\Admin\AppData\Roaming\1000027000\ee874a2837.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3272
      - C:\Users\Admin\AppData\Local\Temp\1000028001\ee874a2837.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000028001\ee874a2837.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:4628
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
        7⤵
        Enumerates system info in registry
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:1208
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc371446f8,0x7ffc37144708,0x7ffc37144718
        8⤵
        
        PID:3676
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,18179117748723829586,8964921916585300892,131072 --disable-features=TranslateUI --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2224 /prefetch:2
        8⤵
        
        PID:4312
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2176,18179117748723829586,8964921916585300892,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1268
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2176,18179117748723829586,8964921916585300892,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:8
        8⤵
        
        PID:3804
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,18179117748723829586,8964921916585300892,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1
        8⤵
        
        PID:3836
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,18179117748723829586,8964921916585300892,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
        8⤵
        
        PID:3828
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,18179117748723829586,8964921916585300892,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3948 /prefetch:1
        8⤵
        
        PID:3188
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,18179117748723829586,8964921916585300892,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3988 /prefetch:1
        8⤵
        
        PID:3000
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,18179117748723829586,8964921916585300892,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3804 /prefetch:1
        8⤵
        
        PID:1092
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,18179117748723829586,8964921916585300892,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:1
        8⤵
        
        PID:1772
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,18179117748723829586,8964921916585300892,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4540 /prefetch:1
        8⤵
        
        PID:4196
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,18179117748723829586,8964921916585300892,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4552 /prefetch:1
        8⤵
        
        PID:2872
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,18179117748723829586,8964921916585300892,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1
        8⤵
        
        PID:4752
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,18179117748723829586,8964921916585300892,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4292 /prefetch:1
        8⤵
        
        PID:3840
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,18179117748723829586,8964921916585300892,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
        8⤵
        
        PID:1212
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,18179117748723829586,8964921916585300892,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
        8⤵
        
        PID:4736
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,18179117748723829586,8964921916585300892,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
        8⤵
        
        PID:3564
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,18179117748723829586,8964921916585300892,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
        8⤵
        
        PID:2196
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,18179117748723829586,8964921916585300892,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
        8⤵
        
        PID:5128
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,18179117748723829586,8964921916585300892,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
        8⤵
        
        PID:5140
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,18179117748723829586,8964921916585300892,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:1
        8⤵
        
        PID:5208
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,18179117748723829586,8964921916585300892,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6228 /prefetch:1
        8⤵
        
        PID:5224
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,18179117748723829586,8964921916585300892,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
        8⤵
        
        PID:5232
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,18179117748723829586,8964921916585300892,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6360 /prefetch:1
        8⤵
        
        PID:5240
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,18179117748723829586,8964921916585300892,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6108 /prefetch:1
        8⤵
        
        PID:5484
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,18179117748723829586,8964921916585300892,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7000 /prefetch:1
        8⤵
        
        PID:5544
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,18179117748723829586,8964921916585300892,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7016 /prefetch:1
        8⤵
        
        PID:5552
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,18179117748723829586,8964921916585300892,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7260 /prefetch:1
        8⤵
        
        PID:5560
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,18179117748723829586,8964921916585300892,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7684 /prefetch:1
        8⤵
        
        PID:5872
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,18179117748723829586,8964921916585300892,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2264 /prefetch:1
        8⤵
        
        PID:5932
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,18179117748723829586,8964921916585300892,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
        8⤵
        
        PID:412
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,18179117748723829586,8964921916585300892,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7900 /prefetch:1
        8⤵
        
        PID:1376
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,18179117748723829586,8964921916585300892,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7960 /prefetch:1
        8⤵
        
        PID:5496
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,18179117748723829586,8964921916585300892,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8124 /prefetch:1
        8⤵
        
        PID:3732
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,18179117748723829586,8964921916585300892,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8140 /prefetch:1
        8⤵
        
        PID:3564
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,18179117748723829586,8964921916585300892,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8040 /prefetch:1
        8⤵
        
        PID:5128
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,18179117748723829586,8964921916585300892,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8172 /prefetch:1
        8⤵
        
        PID:5208
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,18179117748723829586,8964921916585300892,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8328 /prefetch:8
        8⤵
        
        PID:5812
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,18179117748723829586,8964921916585300892,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8328 /prefetch:8
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:396
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,18179117748723829586,8964921916585300892,131072 --disable-features=TranslateUI --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=8060 /prefetch:2
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5752

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1048

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5852

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5124

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2160

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5696

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

32784982-3278-4717-bfb7-78895cb6e141.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\32784982-3278-4717-bfb7-78895cb6e141.tmp
Size 9KB
SHA256 fe50bd72e5050efd1b11bf14d0c84bf657634dc1b8a108204c8ce4d96bfea797
MD5 88a888087277363f1d2a04df78505100
SHA1 809243a59332b1a2367431d62d3a1bda578d2fad
SHA512 7e8a69d0044f977f7d2d2e249a5692fb9e910da035c26cdd110d0198444ab617f4e6573f788e4ab987922e30e37159f1024edd1b5ca3ccf2f8cccac37c6ff52a
SSDEEP 192:RoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup3NeMRU7vpKATRw5Ytj9Zkq:N9iIxuERzA83h09RZxY5G4hkLsg
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat
Size 152B
SHA256 1e138ec40a7f637d846f736c9d9f642cd775ed47b889f8777b6032826280c390
MD5 db473097551c340430d41e8d16e361a9
SHA1 da545a3d4ac43f026957f81d6c34d4e5f67ff3a3
SHA512 3deebb135907a4269f5aa58f688a5c8a73e4fad402aa4a42be353c834f52d4f413d7eb13d0f5d30ee543be056356f8a808bdcef7225a751d2f64468d58303594
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat
Size 152B
SHA256 6ce7116780fca245db07ed72ce10f1bd2d07b5f64731cc0a9845715737106545
MD5 713eb192c0f515c6d71ff3bdda3a41ad
SHA1 462c3a2b3b23d96d88192c30a13d307610fbf466
SHA512 df02e093b063e4d8599049ac3064f6584add4729485572089edd660456e0c1cd1eb0b49e82377400560bee4bcc05c2f32d6a6df15ced73c44eab6b57053bb60c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat
Size 152B
SHA256 33f83801c91433cd4b2944168582ea0cd721bd0dfb4c5b2dbac238678bd245b9
MD5 6e6ed854e1111cd4792c692c07e6e8bc
SHA1 95febc55f393c8e89709a3f39ecba381d746c808
SHA512 1906fc6bdc152341b2ec968868b8fb28eb200d298fecf73b281978771f2657cda75359db03acfa8e1a2d20f7d548d0750e403970122c3494bac9e911e294a472
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Microsoft Edge.lnk

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Microsoft Edge.lnk
Size 1KB
SHA256 9dd3e78816c95eafe5c04430c4d070cbcdff7666a6902f51a7484c5e281e06eb
MD5 55b1250f5a5842316769f4387a95ce91
SHA1 cfdd3be70295d2cf2e14b5b6b6b310ee7b200a3a
SHA512 99736713d11ae35c898f1146671c766d5a3683b4736c94e4e654251c17babe82f21cb6c72d9c2715601ad5b4c8a42d03a0676cbb36b14240b440e60b69553d86
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences
Size 4KB
SHA256 638648c3d6f3fef3fa417a0fb218be147560e67275e9bd727df11fac5fa03819
MD5 84bac5129d0d6aaf78e184b4911050bc
SHA1 da066102a784b1a0f8313e8acb5966d9fcc75885
SHA512 4bbf6acc604091c58cdff5821345945c6e6ecef9a9a4134ec4c4e3edd4af4e40889d5f2c079a0802451c2f380fbdcb23f19ed9480b0f0d981baacb222edf7e3b
SSDEEP 48:Yc5NQwAxlUP5RqySsIjp2FXqfVDa9lOtO9fmTSDQ/9BhccIEyMoI3HmeSye7pe/s:n7Buv1vt1pvWMoiVmdeHlhhUBKVDCzia
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences
Size 4KB
SHA256 73dafe49581bb9b2bbd03d55d8ef865c17175881223a441288d46255f73e7f03
MD5 f68b9af411b40226c2bcdd73153cce79
SHA1 1c4e44dea9168bbea507bd3d72a838612f0c12ef
SHA512 2560c4dcfd2eb2987e06ae565b005fa48e43a53c675c943b4734d8777ef0170919608004eaa4389d5da8d2ffec5467002559874cb7986674d018ffec3ac70dad
SSDEEP 96:n7yut1vt1pvWMoiVmdeHlhhUBKVD7AiEwb:n7dFdWMX5YE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences
Size 4KB
SHA256 4a94d5c423630cc5f09fc2f4f329a3a77b0ea6b72a0e7576d517c3e838a39c00
MD5 6e0c231261f8bace055337c30334e2d4
SHA1 b5454cd467dcf38d8a1b133e30a5d30dfcca00c5
SHA512 acda80e1f81401996e0b157e36545a07bf3e06462ce03619ed0f6ef1fe87bb36053fdec40b6cb5cd7178b98d297f5d936be2412f2261bb5c550aff39b09dd92a
SSDEEP 96:n7yut1vt1pvWMoiVmdeHl5chUBKVD7AiEwb:n7dFdWMXnYYE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences~RFe579bf2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RFe579bf2.TMP
Size 4KB
SHA256 7bd440ae434fcc61d1914d74505ff61a5f91258b86a82259a9d98d246e593d4b
MD5 c54cce7bec63d7399e129a1a07b1ef49
SHA1 da663eaacdecd53b7ba0bb5247f801cc93f3794d
SHA512 98c38cf6debf17eccd902354687c281b8ddaf52166e99997fe19c0eb29b55d19b9e94f8c7c201d8fe198d8615dfe7b896943e92546c98f3b864e75e77e08fc6d
SSDEEP 48:Yc5NQwAxlUP5RqySsIjp2FXqfVDa9lOtO9fmTSDQ/9BhccIEyMoI3HmeSye7pe/R:n7Buv1vt1pvWMoiVmdeHlhhUBKVDCAia
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences
Size 24KB
SHA256 ea19dd256fce84f3fffe48b2b3cfd762aa0fc960cd07c3a4c3779e576c9ce656
MD5 156cf701a6416e235db5faee320494f3
SHA1 a6c5559d679a571e56732c97df264722c4a966f7
SHA512 61a0e2561030b41bbc6b1943b1abc78891844315d08b24258eee5626d74d3b3a58299dc5705ea943c84c7bf985c461f253eab841423838a636c8d3fac28e9dcb
SSDEEP 768:nZ6W9c8F1+UoAYDCx9Tuqh0VfUC9xbog/OVELlc6rUwZ:nZ6W9cu1jabLem
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences~RFe57c515.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences~RFe57c515.TMP
Size 24KB
SHA256 16b7778659f965faf1e799363a55eb58413cd7f536578b4a60709ff62cf4f141
MD5 08b5c8fd7b69adcfd3aabc948eb9a903
SHA1 07c4d94593fc0c5fe365d43680851d7b0638e13f
SHA512 8f16ce475acfb2703f31232926b0e43ca7b85e15745aab73140c120d5b03b1a4a4d88ed9e1052843b5ecbce325450d98c2fd00abfdc8a95e46b3d749887bed2a
SSDEEP 768:x6WOG8F1+UoAYDCx9Tuqh0VfUC9xbog/OV4Llc4rUT6:x6WOGu1jaFLK2
MD5 SHA1 SHA512 SSDEEP

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir\temp-index
Size 48B
SHA256 8fc1ee36cf09108703418dbea82487ab4c72d48d2d6142278946af9a6ef23f27
MD5 4284a0afa4d9f0dae5cd4376fc1a5103
SHA1 0d150139c2bbb7f89d4540a00cd333a7b412457a
SHA512 e266f8d539b7410c91d90b14edf3d5ea79336e142e0ea926631fddaefbc9ee8ec63f778dc7b16c2d3ca9997f61560bc8e362dc1fe9c48c511e899131547eca30
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

0657d1

Path C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\0657d1
Size 1.8MB
SHA256 0cce55a6fec4dbf3581208ef779f877ff43ecbaa27d2f2119d6552d06b684493
MD5 5a4f2d577db2373f79eb9d16f8037af4
SHA1 ed08c149b8992e508e7382b0a19e6685eb9caf5e
SHA512 ec8bec4bf9433e4fd41e3a4b74e7bb1b8dbf46e15ab528e4feed51750e3c9e43ed59fcbc12982fc36bd50172a752325b192dfc65195f7118c47f1e7c2d24eccb
SSDEEP 49152:R7wbCfJnoVxG8rdz1iuf4ri4pmy/Yr8rxXm:RFfJoVxGmdZiFrzdyyxXm
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorti.exe

Path C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Size 1.8MB
SHA256 53f9b3b2ea25424baf94da442973f4efd71e1218a3b837600334d97898ebfd7e
MD5 0f2694844eb16391e15196e17e545f0b
SHA1 cb6cbd6a90349afa4624a221b3350af44feb4d71
SHA512 51179c080ce6dce08e8c78e392e20d283c0052e91ed3c4c651b9e53741a3c720f6e87d393eaf0cf8bed54a85d4c92699910b5d0fe237f8dbdcc75d6fe9cd3cd6
SSDEEP 49152:bxqFd8IXr3G0NPQQdiwHm+34RapwXKby8Y3O:bxqbhrGoPQQJHlp9Ye
MD5 SHA1 SHA512 SSDEEP

Submit Download

ee874a2837.exe

Path C:\Users\Admin\AppData\Local\Temp\1000028001\ee874a2837.exe
Size 896KB
SHA256 1cf0747ce1310fd989b24a93d2108784efb003948fdec1f7e64479213075cb90
MD5 f0356008c23a76acfc263b5c3e2180cb
SHA1 2ed3657f3ee94a5cc0cf6b8b30a1334a9311baa2
SHA512 67efa62082d20bef10318cb2a46391219ee377138b50e5d05fdf2f8945092d1b9401e7cce6f3ccbdfe26f800e896d5e634c5fe41260cca4c0d3055b21c2bdf2a
SSDEEP 12288:vqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgacTy:vqDEvCTbMWu7rQYlBQcBiT6rprG8asy
MD5 SHA1 SHA512 SSDEEP

Submit Download

65d98e5602.exe

Path C:\Users\Admin\AppData\Roaming\1000026000\65d98e5602.exe
Size 1.7MB
SHA256 83ebffd7d12fabe2f1bf465425e0883ff62d4bbdbab60924acaafd8ce197465c
MD5 538ef8d8696f1a9f1388a615ed4cf361
SHA1 280a7c4edc18e0c5e836d02d78f6bfbafe15c5bc
SHA512 f9bdf7d3569957f39d60fae6996da3491c92203d3f271e0cf832da4bc4c580a8e2fa33a6ccd15ce8e386ab1b1a9414470d31618828b0bd6b63a75f5da03769ad
SSDEEP 49152:Kmgy8lNBFQ1xx70XhuHiWpPlg9hrtxIQ:Pp8l61T0RuHP29FIQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

X6VQDA302X4M811GAF91.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\X6VQDA302X4M811GAF91.temp
Size 3KB
SHA256 700ff0b392b8839301ad8cbbfd9e69878e08c52778097a591a6c3a8982bc3bd8
MD5 6090ea64f7e3665727cc7bb10f96543f
SHA1 dbeb1b35d1c0709e5d746e62b97970dd55d17a91
SHA512 e70c1067d721af812a89bb6473765418248795ad3dbe04d02be01dc245afc214d31e2a8ecd1f12f23dc79a1569ddcf0cb47b776180e27a0abb3004589d95cb27
MD5 SHA1 SHA512

Submit Download

memory/2140-47-0x0000000000990000-0x0000000000E58000-memory.dmp

Download

memory/2140-34-0x0000000000990000-0x0000000000E58000-memory.dmp

Download

memory/2160-402-0x0000000000990000-0x0000000000E58000-memory.dmp

Download

memory/2940-46-0x00000000005A0000-0x0000000000A68000-memory.dmp

Download

memory/2940-377-0x00000000005A0000-0x0000000000A68000-memory.dmp

Download

memory/2940-458-0x00000000005A0000-0x0000000000A68000-memory.dmp

Download

memory/2940-455-0x00000000005A0000-0x0000000000A68000-memory.dmp

Download

memory/2940-452-0x00000000005A0000-0x0000000000A68000-memory.dmp

Download

memory/2940-444-0x00000000005A0000-0x0000000000A68000-memory.dmp

Download

memory/2940-298-0x00000000005A0000-0x0000000000A68000-memory.dmp

Download

memory/2940-299-0x00000000005A0000-0x0000000000A68000-memory.dmp

Download

memory/2940-443-0x00000000005A0000-0x0000000000A68000-memory.dmp

Download

memory/2940-442-0x00000000005A0000-0x0000000000A68000-memory.dmp

Download

memory/2940-441-0x00000000005A0000-0x0000000000A68000-memory.dmp

Download

memory/2940-324-0x00000000005A0000-0x0000000000A68000-memory.dmp

Download

memory/2940-422-0x00000000005A0000-0x0000000000A68000-memory.dmp

Download

memory/2940-412-0x00000000005A0000-0x0000000000A68000-memory.dmp

Download

memory/2940-397-0x00000000005A0000-0x0000000000A68000-memory.dmp

Download

memory/2940-396-0x00000000005A0000-0x0000000000A68000-memory.dmp

Download

memory/3160-21-0x00000000006F0000-0x0000000000BA6000-memory.dmp

Download

memory/3160-19-0x00000000006F1000-0x000000000071F000-memory.dmp

Download

memory/3160-31-0x00000000006F0000-0x0000000000BA6000-memory.dmp

Download

memory/3160-20-0x00000000006F0000-0x0000000000BA6000-memory.dmp

Download

memory/3160-18-0x00000000006F0000-0x0000000000BA6000-memory.dmp

Download

memory/3272-80-0x00000000009E0000-0x0000000001071000-memory.dmp

Download

memory/3272-82-0x00000000009E0000-0x0000000001071000-memory.dmp

Download

memory/4552-2-0x0000000000C81000-0x0000000000CAF000-memory.dmp

Download

memory/4552-1-0x0000000076F74000-0x0000000076F76000-memory.dmp

Download

memory/4552-3-0x0000000000C80000-0x0000000001136000-memory.dmp

Download

memory/4552-17-0x0000000000C80000-0x0000000001136000-memory.dmp

Download

memory/4552-0-0x0000000000C80000-0x0000000001136000-memory.dmp

Download

memory/4552-5-0x0000000000C80000-0x0000000001136000-memory.dmp

Download

memory/4572-64-0x0000000000D60000-0x00000000013F1000-memory.dmp

Download

memory/4572-81-0x0000000000D60000-0x00000000013F1000-memory.dmp

Download

memory/5124-400-0x00000000005A0000-0x0000000000A68000-memory.dmp

Download

memory/5576-447-0x0000000000990000-0x0000000000E58000-memory.dmp

Download

memory/5576-451-0x0000000000990000-0x0000000000E58000-memory.dmp

Download

memory/5696-449-0x00000000005A0000-0x0000000000A68000-memory.dmp

Download