amadey | 6a3d6a5974bbd540286b02095fea0e50746094dd90e2b39a6552e9479428cbe9

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/09/2024, 01:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6a3d6a5974bbd540286b02095fea0e50746094dd90e2b39a6552e9479428cbe9.exe
Size 1.8MB
Sample240902-bf62wayajc
SHA256 6a3d6a5974bbd540286b02095fea0e50746094dd90e2b39a6552e9479428cbe9
MD5 d6bf1c871bcb459f85a6cffc7367ebd2
SHA1 0fbb9c88ec4e9e3b02be1e53a737ce5d2a632451
SHA512 9f0978211d8a4a4e0430fca449b40474c6fb361498337a0062f39e7b7525c7e6205161c1de3ef32157fbdd718cf538b1e9edf84344db7eb393b4a89a5a903aad
SSDEEP 49152:Ks9y5mrbLuxziJZzrySK4UpdsU9qR5m99:EmnLuxmJZzrg/sTR49
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey stealc 0657d1 c7817d leva discovery evasion stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

0657d1

http://185.215.113.19

Attributes

install_dir
0d8f5eb8a7
install_file
explorti.exe
strings_key
6c55a5f34bb433fbd933a168577b1838
url_paths
/Vi9leo/index.php

rc4.plain

Extracted

Family

amadey

Version

4.41

Botnet

c7817d

http://31.41.244.10

Attributes

install_dir
0e8d0864aa
install_file
svoutse.exe
strings_key
5481b88a6ef75bcf21333988a4e47048
url_paths
/Dem7kTu/index.php

rc4.plain

Extracted

Family

stealc

Botnet

leva

http://185.215.113.100

Attributes

url_path
/e2b1563c6670f193.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Stealc
Stealc is an infostealer written in C++.
stealer stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 10 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	6a3d6a5974bbd540286b02095fea0e50746094dd90e2b39a6552e9479428cbe9.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	3c5b3e8864.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	5199f95dd7.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	svoutse.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	svoutse.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	svoutse.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 20 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	3c5b3e8864.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	6a3d6a5974bbd540286b02095fea0e50746094dd90e2b39a6552e9479428cbe9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	6a3d6a5974bbd540286b02095fea0e50746094dd90e2b39a6552e9479428cbe9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	3c5b3e8864.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	5199f95dd7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	5199f95dd7.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	svoutse.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	6a3d6a5974bbd540286b02095fea0e50746094dd90e2b39a6552e9479428cbe9.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	explorti.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	explorti.exe

Executes dropped EXE 10 IoCs

pid	Process
4784	explorti.exe
436	explorti.exe
2420	svoutse.exe
4696	3c5b3e8864.exe
1912	5199f95dd7.exe
4844	2f21f37e4e.exe
1676	svoutse.exe
436	explorti.exe
5284	explorti.exe
5268	svoutse.exe

Identifies Wine through registry keys 2 TTPs 10 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Software\Wine	svoutse.exe
Key opened	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Software\Wine	svoutse.exe
Key opened	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Software\Wine	6a3d6a5974bbd540286b02095fea0e50746094dd90e2b39a6552e9479428cbe9.exe
Key opened	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Software\Wine	3c5b3e8864.exe
Key opened	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Software\Wine	5199f95dd7.exe
Key opened	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Software\Wine	svoutse.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000700000002344e-85.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 10 IoCs

pid	Process
1332	6a3d6a5974bbd540286b02095fea0e50746094dd90e2b39a6552e9479428cbe9.exe
4784	explorti.exe
436	explorti.exe
2420	svoutse.exe
4696	3c5b3e8864.exe
1912	5199f95dd7.exe
436	explorti.exe
1676	svoutse.exe
5284	explorti.exe
5268	svoutse.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explorti.job	6a3d6a5974bbd540286b02095fea0e50746094dd90e2b39a6552e9479428cbe9.exe
File created	C:\Windows\Tasks\svoutse.job	explorti.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorti.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svoutse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3c5b3e8864.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5199f95dd7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2f21f37e4e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6a3d6a5974bbd540286b02095fea0e50746094dd90e2b39a6552e9479428cbe9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorti.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2192	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
1680	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
1332	6a3d6a5974bbd540286b02095fea0e50746094dd90e2b39a6552e9479428cbe9.exe
1332	6a3d6a5974bbd540286b02095fea0e50746094dd90e2b39a6552e9479428cbe9.exe
4784	explorti.exe
4784	explorti.exe
436	explorti.exe
436	explorti.exe
2420	svoutse.exe
2420	svoutse.exe
4696	3c5b3e8864.exe
4696	3c5b3e8864.exe
1912	5199f95dd7.exe
1912	5199f95dd7.exe
1320	msedge.exe
1320	msedge.exe
5036	msedge.exe
5036	msedge.exe
3296	identity_helper.exe
3296	identity_helper.exe
436	explorti.exe
1676	svoutse.exe
1676	svoutse.exe
436	explorti.exe
5284	explorti.exe
5284	explorti.exe
5268	svoutse.exe
5268	svoutse.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4844	2f21f37e4e.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 29 IoCs

pid	Process
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1680	taskkill.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1332	6a3d6a5974bbd540286b02095fea0e50746094dd90e2b39a6552e9479428cbe9.exe
436	explorti.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
5036	msedge.exe
5036	msedge.exe
4844	2f21f37e4e.exe
5036	msedge.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe
4844	2f21f37e4e.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1332 wrote to memory of 4784	1332	6a3d6a5974bbd540286b02095fea0e50746094dd90e2b39a6552e9479428cbe9.exe	86
PID 1332 wrote to memory of 4784	1332	6a3d6a5974bbd540286b02095fea0e50746094dd90e2b39a6552e9479428cbe9.exe	86
PID 1332 wrote to memory of 4784	1332	6a3d6a5974bbd540286b02095fea0e50746094dd90e2b39a6552e9479428cbe9.exe	86
PID 4784 wrote to memory of 3520	4784	explorti.exe	89
PID 4784 wrote to memory of 3520	4784	explorti.exe	89
PID 4784 wrote to memory of 3520	4784	explorti.exe	89
PID 3520 wrote to memory of 1680	3520	cmd.exe	92
PID 3520 wrote to memory of 1680	3520	cmd.exe	92
PID 3520 wrote to memory of 1680	3520	cmd.exe	92
PID 3520 wrote to memory of 2192	3520	cmd.exe	94
PID 3520 wrote to memory of 2192	3520	cmd.exe	94
PID 3520 wrote to memory of 2192	3520	cmd.exe	94
PID 3520 wrote to memory of 436	3520	cmd.exe	95
PID 3520 wrote to memory of 436	3520	cmd.exe	95
PID 3520 wrote to memory of 436	3520	cmd.exe	95
PID 436 wrote to memory of 2420	436	explorti.exe	96
PID 436 wrote to memory of 2420	436	explorti.exe	96
PID 436 wrote to memory of 2420	436	explorti.exe	96
PID 2420 wrote to memory of 4696	2420	svoutse.exe	98
PID 2420 wrote to memory of 4696	2420	svoutse.exe	98
PID 2420 wrote to memory of 4696	2420	svoutse.exe	98
PID 2420 wrote to memory of 1912	2420	svoutse.exe	101
PID 2420 wrote to memory of 1912	2420	svoutse.exe	101
PID 2420 wrote to memory of 1912	2420	svoutse.exe	101
PID 2420 wrote to memory of 4844	2420	svoutse.exe	102
PID 2420 wrote to memory of 4844	2420	svoutse.exe	102
PID 2420 wrote to memory of 4844	2420	svoutse.exe	102
PID 4844 wrote to memory of 5036	4844	2f21f37e4e.exe	103
PID 4844 wrote to memory of 5036	4844	2f21f37e4e.exe	103
PID 5036 wrote to memory of 4276	5036	msedge.exe	104
PID 5036 wrote to memory of 4276	5036	msedge.exe	104
PID 5036 wrote to memory of 2632	5036	msedge.exe	105
PID 5036 wrote to memory of 2632	5036	msedge.exe	105
PID 5036 wrote to memory of 2632	5036	msedge.exe	105
PID 5036 wrote to memory of 2632	5036	msedge.exe	105
PID 5036 wrote to memory of 2632	5036	msedge.exe	105
PID 5036 wrote to memory of 2632	5036	msedge.exe	105
PID 5036 wrote to memory of 2632	5036	msedge.exe	105
PID 5036 wrote to memory of 2632	5036	msedge.exe	105
PID 5036 wrote to memory of 2632	5036	msedge.exe	105
PID 5036 wrote to memory of 2632	5036	msedge.exe	105
PID 5036 wrote to memory of 2632	5036	msedge.exe	105
PID 5036 wrote to memory of 2632	5036	msedge.exe	105
PID 5036 wrote to memory of 2632	5036	msedge.exe	105
PID 5036 wrote to memory of 2632	5036	msedge.exe	105
PID 5036 wrote to memory of 2632	5036	msedge.exe	105
PID 5036 wrote to memory of 2632	5036	msedge.exe	105
PID 5036 wrote to memory of 2632	5036	msedge.exe	105
PID 5036 wrote to memory of 2632	5036	msedge.exe	105
PID 5036 wrote to memory of 2632	5036	msedge.exe	105
PID 5036 wrote to memory of 2632	5036	msedge.exe	105
PID 5036 wrote to memory of 2632	5036	msedge.exe	105
PID 5036 wrote to memory of 2632	5036	msedge.exe	105
PID 5036 wrote to memory of 2632	5036	msedge.exe	105
PID 5036 wrote to memory of 2632	5036	msedge.exe	105
PID 5036 wrote to memory of 2632	5036	msedge.exe	105
PID 5036 wrote to memory of 2632	5036	msedge.exe	105
PID 5036 wrote to memory of 2632	5036	msedge.exe	105
PID 5036 wrote to memory of 2632	5036	msedge.exe	105
PID 5036 wrote to memory of 2632	5036	msedge.exe	105
PID 5036 wrote to memory of 2632	5036	msedge.exe	105
PID 5036 wrote to memory of 2632	5036	msedge.exe	105
PID 5036 wrote to memory of 2632	5036	msedge.exe	105
PID 5036 wrote to memory of 2632	5036	msedge.exe	105

C:\Users\Admin\AppData\Local\Temp\6a3d6a5974bbd540286b02095fea0e50746094dd90e2b39a6552e9479428cbe9.exe
"C:\Users\Admin\AppData\Local\Temp\6a3d6a5974bbd540286b02095fea0e50746094dd90e2b39a6552e9479428cbe9.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1332
- C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
  "C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Checks computer location settings
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4784
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k "taskkill /f /im "explorti.exe" && timeout 1 && del "explorti.exe" && ren 0657d1 explorti.exe && C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe && Exit"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3520
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "explorti.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1680
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 1
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:2192
  - - C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
      C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Checks computer location settings
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:436
    - - C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Checks computer location settings
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2420
      - C:\Users\Admin\AppData\Roaming\1000026000\3c5b3e8864.exe
        
        "C:\Users\Admin\AppData\Roaming\1000026000\3c5b3e8864.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4696
      - C:\Users\Admin\AppData\Roaming\1000027000\5199f95dd7.exe
        
        "C:\Users\Admin\AppData\Roaming\1000027000\5199f95dd7.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1912
      - C:\Users\Admin\AppData\Local\Temp\1000028001\2f21f37e4e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000028001\2f21f37e4e.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:4844
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
        7⤵
        Enumerates system info in registry
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:5036
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff96d9846f8,0x7ff96d984708,0x7ff96d984718
        8⤵
        
        PID:4276
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,6632474042170744736,12827687026536735526,131072 --disable-features=TranslateUI --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
        8⤵
        
        PID:2632
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,6632474042170744736,12827687026536735526,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2524 /prefetch:3
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1320
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,6632474042170744736,12827687026536735526,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
        8⤵
        
        PID:2432
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6632474042170744736,12827687026536735526,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
        8⤵
        
        PID:4704
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6632474042170744736,12827687026536735526,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
        8⤵
        
        PID:2572
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6632474042170744736,12827687026536735526,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3848 /prefetch:1
        8⤵
        
        PID:4832
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6632474042170744736,12827687026536735526,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3856 /prefetch:1
        8⤵
        
        PID:868
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6632474042170744736,12827687026536735526,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4124 /prefetch:1
        8⤵
        
        PID:5032
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6632474042170744736,12827687026536735526,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4132 /prefetch:1
        8⤵
        
        PID:3580
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6632474042170744736,12827687026536735526,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4448 /prefetch:1
        8⤵
        
        PID:4544
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6632474042170744736,12827687026536735526,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4592 /prefetch:1
        8⤵
        
        PID:1776
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6632474042170744736,12827687026536735526,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:1
        8⤵
        
        PID:4900
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6632474042170744736,12827687026536735526,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4824 /prefetch:1
        8⤵
        
        PID:2988
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6632474042170744736,12827687026536735526,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
        8⤵
        
        PID:2488
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6632474042170744736,12827687026536735526,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
        8⤵
        
        PID:3796
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6632474042170744736,12827687026536735526,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
        8⤵
        
        PID:4596
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6632474042170744736,12827687026536735526,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4104 /prefetch:1
        8⤵
        
        PID:4696
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6632474042170744736,12827687026536735526,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
        8⤵
        
        PID:5128
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6632474042170744736,12827687026536735526,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
        8⤵
        
        PID:5136
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6632474042170744736,12827687026536735526,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
        8⤵
        
        PID:5144
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6632474042170744736,12827687026536735526,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
        8⤵
        
        PID:5152
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6632474042170744736,12827687026536735526,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4848 /prefetch:1
        8⤵
        
        PID:5356
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6632474042170744736,12827687026536735526,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6048 /prefetch:1
        8⤵
        
        PID:5364
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6632474042170744736,12827687026536735526,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:1
        8⤵
        
        PID:5372
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6632474042170744736,12827687026536735526,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6216 /prefetch:1
        8⤵
        
        PID:5380
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6632474042170744736,12827687026536735526,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6360 /prefetch:1
        8⤵
        
        PID:5388
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6632474042170744736,12827687026536735526,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
        8⤵
        
        PID:5604
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6632474042170744736,12827687026536735526,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6692 /prefetch:1
        8⤵
        
        PID:5612
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6632474042170744736,12827687026536735526,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7420 /prefetch:1
        8⤵
        
        PID:5860
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6632474042170744736,12827687026536735526,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7560 /prefetch:1
        8⤵
        
        PID:3064
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6632474042170744736,12827687026536735526,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7828 /prefetch:1
        8⤵
        
        PID:2708
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6632474042170744736,12827687026536735526,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8248 /prefetch:1
        8⤵
        
        PID:4656
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,6632474042170744736,12827687026536735526,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7852 /prefetch:8
        8⤵
        
        PID:2288
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,6632474042170744736,12827687026536735526,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7852 /prefetch:8
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3296
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,6632474042170744736,12827687026536735526,131072 --disable-features=TranslateUI --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=8176 /prefetch:2
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4052

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5048

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6052

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1676

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:436

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5284

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2200125a-38ca-4dbc-9df5-ecf55b78dbf9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\2200125a-38ca-4dbc-9df5-ecf55b78dbf9.tmp
Size 9KB
SHA256 7894fd22fe23b285b8bade9395b513a3e3097e09cfbf4b7712014e761b76ff94
MD5 9d0ba656d26aa56a76a1606eb39cebb4
SHA1 ad151c46ac5c0795c53dfefb362cc5e4ccb961c2
SHA512 ea28a76721acc1e3d6313da5ef1bc13ae39132ccda2fc39c6d0785529ade4fee9b73882282902e32eeed861233e7eff207b94b7e3b5a138b471f53cbb47b0512
SSDEEP 192:RoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupoeMRUnr13KRw5Ytj9Zklqn:N9iIxuERzA83h09RZxY8e1kLsu
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat
Size 152B
SHA256 0be6b240f7a65c9abcc334fbc65c50c4bacc038760edddbc40add2b046c3e070
MD5 0d8d4737a13d9654d2954835163ea1ff
SHA1 c85d7727daf480334fc71b37e46f25e4760ad68a
SHA512 f784ce83a9cb8a2afb0a614d1d8ddce07a57c8aa525fee917e269038204724a3fdf2da58e572206ac1f34dcb4ecc8976c964595059f25406e1418733d9131d93
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat
Size 152B
SHA256 abb86940ea7fc479574e9863e407570afcf1910e7f1accb06263e49dd5d9af20
MD5 7cf371ba105a001a3267a125a9e1835e
SHA1 b8968d13d954cfd01e831423adfe3be5a959c3db
SHA512 180f390477eaca4a46275b1d089f4a14552b98f9eb47c2a7aae4af74f440db8b28005d4953f501eeaea9de317c383c978b96183a03934502a4990ea6e07b5d73
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat
Size 152B
SHA256 bb7931ac5833686cd4c9a35ac702bcbc5a94714cfab827b89862d0713296ef37
MD5 cb26266add6084fe9977ab3985f624e6
SHA1 d8ff246290fb22ff858c60c89d32bab55bf9d3c8
SHA512 4f5be071df0305a7562e4bfdf4a9e08002b22890fb74c9fe32941120d659e5c1e6469fec2e04ef06372c3545aaf2ae0019234c32697f1985cfb6ed56a3e5fbec
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Microsoft Edge.lnk

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Microsoft Edge.lnk
Size 1KB
SHA256 e366f2e7d8b7f42cd4f1f73f4554f753c0b5d4854318ccafcebb5ebcea92bdc5
MD5 6d56820105e3592fd5cf2e26c7d84723
SHA1 8c7a51f2785736c5f9072646988269bb03fd342b
SHA512 71de551eab1b16332d07a5418f9ecf35afba1c1fa567110a25dba90c2fbb8da8ccbdc4910e1898d84a2d756bde7457554ac8cd1e4b926fa1d3d02a8e319894a4
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences
Size 4KB
SHA256 174c716613eb022c70e7ab42505e4d210059e1f097570785ddc7220edb43f7ef
MD5 d1ff2b84a9576ae2a331a2c67af4a764
SHA1 8346553b10bb39ef39ed452d5d126dbf4070d40a
SHA512 d62db479dc38d8a300c8c93452ddfc9a1c0b301538df6cd34d3ac41dd76190c523973166480024403150b338ff1069b5985791f9b4c41fc9978e11c61235658d
SSDEEP 96:nXySm1mtgpvWMoiVmdeHrVZhUBKVD7AiEwb:nX6M0WMXBnYE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences
Size 4KB
SHA256 b75a4c2354e1b7a0b29cbdd4bbbecdca2e99956f4ac093ecf7474cacd7833b9e
MD5 bfb2a09469029c396397112d98ffe8c1
SHA1 f013b5f536031ecbfcda3070a8cad55a79e81cf0
SHA512 3e6d75ae3f2eb9216eff441300a8ef5ff20c5eb155f74951dbad6107543613a02cc8784cc8e9a96f842fe05118adea5ee269d8f5ccbc7d4896b9f74117782d15
SSDEEP 96:nXySm1mtgpvWMoiVmdeHrAZhUBKVD7AiEwb:nX6M0WMXEnYE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences
Size 24KB
SHA256 8cd3daf1ebeaafa0ef8467182107aaae81c94da327dc57f30df9d0d87d59b8a3
MD5 f59bea05c4292f058cc3e8bead28abf3
SHA1 86c33b1322959e6118c44fc6578c23690e3a3dc7
SHA512 f0b8bf8f23d3a2f4df743ae9e12d03d79b5b3c1c2d5e84ff0a22c094c175bd93abcec50d0714c0fa01f5801013e6f45ed883e94d701630fe0f0b829b86127ab0
SSDEEP 768:nn8WmT8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXLlFUrUtl9:nn8WmTu1jasLTtl9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences~RFe581c6c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences~RFe581c6c.TMP
Size 24KB
SHA256 2075267e798b8c74e527197762460b62252482db32471f9e5477f5c9287da482
MD5 c26366fc8eb4e0cc28a29da568b7b284
SHA1 d968da06a99f961365405b5bcb71bd24993aa844
SHA512 98cdc46e123443e16bbeeac80fbdee29810455ff8a7ccf1ab8de9f0145801f8065ffa73e0395e451165e82c27367dc660b1c028d6e21e0883e2c44014700322d
SSDEEP 768:/8Wh18F1+UoAYDCx9Tuqh0VfUC9xbog/OV7LlFwrUtlrl:/8Wh1u1jaGLvtlB
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

cd37b310-ed19-42d7-8100-fbafc827f44b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\cd37b310-ed19-42d7-8100-fbafc827f44b.tmp
Size 4KB
SHA256 084b1a357dee6d809dca20685ae09df95a169e6e47721e3a6e071a4330ecaf8e
MD5 5d1e8e287f429659387e51a2a6199e62
SHA1 3ff085ab7868c866e2caaba5085a8feb406ceb0e
SHA512 500e2ed4f7ab4da8ac5bf6c3eefc793932cb4f578721fe22389e35d4b8be523900f724f6b98acce90d1f99253ab1ec5db322b3f92a188acad112031142968b08
SSDEEP 96:nXBSI1mtgpvWMoiVmdeHrAZhUBKVDCzia:nX7M0WMXEnY3
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

0657d1

Path C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\0657d1
Size 1.8MB
SHA256 0cce55a6fec4dbf3581208ef779f877ff43ecbaa27d2f2119d6552d06b684493
MD5 5a4f2d577db2373f79eb9d16f8037af4
SHA1 ed08c149b8992e508e7382b0a19e6685eb9caf5e
SHA512 ec8bec4bf9433e4fd41e3a4b74e7bb1b8dbf46e15ab528e4feed51750e3c9e43ed59fcbc12982fc36bd50172a752325b192dfc65195f7118c47f1e7c2d24eccb
SSDEEP 49152:R7wbCfJnoVxG8rdz1iuf4ri4pmy/Yr8rxXm:RFfJoVxGmdZiFrzdyyxXm
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorti.exe

Path C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Size 1.8MB
SHA256 6a3d6a5974bbd540286b02095fea0e50746094dd90e2b39a6552e9479428cbe9
MD5 d6bf1c871bcb459f85a6cffc7367ebd2
SHA1 0fbb9c88ec4e9e3b02be1e53a737ce5d2a632451
SHA512 9f0978211d8a4a4e0430fca449b40474c6fb361498337a0062f39e7b7525c7e6205161c1de3ef32157fbdd718cf538b1e9edf84344db7eb393b4a89a5a903aad
SSDEEP 49152:Ks9y5mrbLuxziJZzrySK4UpdsU9qR5m99:EmnLuxmJZzrg/sTR49
MD5 SHA1 SHA512 SSDEEP

Submit Download

2f21f37e4e.exe

Path C:\Users\Admin\AppData\Local\Temp\1000028001\2f21f37e4e.exe
Size 896KB
SHA256 1cf0747ce1310fd989b24a93d2108784efb003948fdec1f7e64479213075cb90
MD5 f0356008c23a76acfc263b5c3e2180cb
SHA1 2ed3657f3ee94a5cc0cf6b8b30a1334a9311baa2
SHA512 67efa62082d20bef10318cb2a46391219ee377138b50e5d05fdf2f8945092d1b9401e7cce6f3ccbdfe26f800e896d5e634c5fe41260cca4c0d3055b21c2bdf2a
SSDEEP 12288:vqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgacTy:vqDEvCTbMWu7rQYlBQcBiT6rprG8asy
MD5 SHA1 SHA512 SSDEEP

Submit Download

3c5b3e8864.exe

Path C:\Users\Admin\AppData\Roaming\1000026000\3c5b3e8864.exe
Size 1.7MB
SHA256 83ebffd7d12fabe2f1bf465425e0883ff62d4bbdbab60924acaafd8ce197465c
MD5 538ef8d8696f1a9f1388a615ed4cf361
SHA1 280a7c4edc18e0c5e836d02d78f6bfbafe15c5bc
SHA512 f9bdf7d3569957f39d60fae6996da3491c92203d3f271e0cf832da4bc4c580a8e2fa33a6ccd15ce8e386ab1b1a9414470d31618828b0bd6b63a75f5da03769ad
SSDEEP 49152:Kmgy8lNBFQ1xx70XhuHiWpPlg9hrtxIQ:Pp8l61T0RuHP29FIQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

32J37120352IW16I8MBK.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\32J37120352IW16I8MBK.temp
Size 3KB
SHA256 5779237e54ffa905b2573f5d4210a3083df669cb98bb0c9f8e1af942ab8f4e2e
MD5 e608dc4d68681a1542bafadbfc536aa1
SHA1 16a1e8789f2483f277cde3de281c0c4c2a5eb34c
SHA512 e3e62456b0945094341440109731637140543558fde1457a0c5d495a7bd1a0c38d9bd21ed11daa7908cbebe550557f08ba31c0fd30115986931883cff9458635
MD5 SHA1 SHA512

Submit Download

memory/436-390-0x0000000000FA0000-0x0000000001468000-memory.dmp

Download

memory/436-46-0x0000000000FA0000-0x0000000001468000-memory.dmp

Download

memory/436-33-0x0000000000FA0000-0x0000000001468000-memory.dmp

Download

memory/436-387-0x0000000000FA0000-0x0000000001468000-memory.dmp

Download

memory/1332-18-0x00000000000F0000-0x00000000005AB000-memory.dmp

Download

memory/1332-4-0x00000000000F0000-0x00000000005AB000-memory.dmp

Download

memory/1332-0-0x00000000000F0000-0x00000000005AB000-memory.dmp

Download

memory/1332-3-0x00000000000F0000-0x00000000005AB000-memory.dmp

Download

memory/1332-2-0x00000000000F1000-0x000000000011F000-memory.dmp

Download

memory/1332-1-0x00000000771E4000-0x00000000771E6000-memory.dmp

Download

memory/1676-391-0x0000000000DF0000-0x00000000012B8000-memory.dmp

Download

memory/1912-79-0x0000000000190000-0x0000000000821000-memory.dmp

Download

memory/1912-288-0x0000000000190000-0x0000000000821000-memory.dmp

Download

memory/2420-272-0x0000000000DF0000-0x00000000012B8000-memory.dmp

Download

memory/2420-446-0x0000000000DF0000-0x00000000012B8000-memory.dmp

Download

memory/2420-286-0x0000000000DF0000-0x00000000012B8000-memory.dmp

Download

memory/2420-433-0x0000000000DF0000-0x00000000012B8000-memory.dmp

Download

memory/2420-432-0x0000000000DF0000-0x00000000012B8000-memory.dmp

Download

memory/2420-45-0x0000000000DF0000-0x00000000012B8000-memory.dmp

Download

memory/2420-366-0x0000000000DF0000-0x00000000012B8000-memory.dmp

Download

memory/2420-313-0x0000000000DF0000-0x00000000012B8000-memory.dmp

Download

memory/2420-449-0x0000000000DF0000-0x00000000012B8000-memory.dmp

Download

memory/2420-441-0x0000000000DF0000-0x00000000012B8000-memory.dmp

Download

memory/2420-443-0x0000000000DF0000-0x00000000012B8000-memory.dmp

Download

memory/2420-392-0x0000000000DF0000-0x00000000012B8000-memory.dmp

Download

memory/2420-393-0x0000000000DF0000-0x00000000012B8000-memory.dmp

Download

memory/2420-403-0x0000000000DF0000-0x00000000012B8000-memory.dmp

Download

memory/2420-413-0x0000000000DF0000-0x00000000012B8000-memory.dmp

Download

memory/2420-442-0x0000000000DF0000-0x00000000012B8000-memory.dmp

Download

memory/4696-63-0x0000000000E10000-0x00000000014A1000-memory.dmp

Download

memory/4696-80-0x0000000000E10000-0x00000000014A1000-memory.dmp

Download

memory/4784-30-0x0000000000EB0000-0x000000000136B000-memory.dmp

Download

memory/4784-17-0x0000000000EB0000-0x000000000136B000-memory.dmp

Download

memory/4784-19-0x0000000000EB1000-0x0000000000EDF000-memory.dmp

Download

memory/4784-20-0x0000000000EB0000-0x000000000136B000-memory.dmp

Download

memory/4784-21-0x0000000000EB0000-0x000000000136B000-memory.dmp

Download

memory/5268-440-0x0000000000DF0000-0x00000000012B8000-memory.dmp

Download

memory/5268-437-0x0000000000DF0000-0x00000000012B8000-memory.dmp

Download

memory/5284-436-0x0000000000FA0000-0x0000000001468000-memory.dmp

Download

memory/5284-439-0x0000000000FA0000-0x0000000001468000-memory.dmp

Download