amadey | 5da8190ffd2e3bfbc685b9de6e326eefe60be0b51a5be2ea38634e45287ccfbc

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/09/2024, 01:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5da8190ffd2e3bfbc685b9de6e326eefe60be0b51a5be2ea38634e45287ccfbc.exe
Size 1.8MB
Sample240902-bfbwqsxhpf
SHA256 5da8190ffd2e3bfbc685b9de6e326eefe60be0b51a5be2ea38634e45287ccfbc
MD5 d2d35997021550d304bf21a670921efe
SHA1 974ed61752963812b1005e85d5077e43b00afc6b
SHA512 f7a48b602d925b5c8b0190279beff76f054530bf2aef3e1ff7c16d2f88f08227387d2ebe944a52601b7d9732716901a950744736cdd9dc630e5cc922154aa87d
SSDEEP 49152:rzrWn4LAutiSNWKIKR/J/mTmmJF500kjxw9WLVpw5:7WSXtiGWKn19mn5Adw9Wbw5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey stealc 0657d1 c7817d leva discovery evasion stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

0657d1

http://185.215.113.19

Attributes

install_dir
0d8f5eb8a7
install_file
explorti.exe
strings_key
6c55a5f34bb433fbd933a168577b1838
url_paths
/Vi9leo/index.php

rc4.plain

Extracted

Family

amadey

Version

4.41

Botnet

c7817d

http://31.41.244.10

Attributes

install_dir
0e8d0864aa
install_file
svoutse.exe
strings_key
5481b88a6ef75bcf21333988a4e47048
url_paths
/Dem7kTu/index.php

rc4.plain

Extracted

Family

stealc

Botnet

leva

http://185.215.113.100

Attributes

url_path
/e2b1563c6670f193.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Stealc
Stealc is an infostealer written in C++.
stealer stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 12 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	5da8190ffd2e3bfbc685b9de6e326eefe60be0b51a5be2ea38634e45287ccfbc.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	svoutse.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	54ca4d70b5.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	2f35c7f94b.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	svoutse.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	svoutse.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	svoutse.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 24 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2f35c7f94b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	2f35c7f94b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	5da8190ffd2e3bfbc685b9de6e326eefe60be0b51a5be2ea38634e45287ccfbc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	54ca4d70b5.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	54ca4d70b5.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	5da8190ffd2e3bfbc685b9de6e326eefe60be0b51a5be2ea38634e45287ccfbc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	explorti.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	svoutse.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	5da8190ffd2e3bfbc685b9de6e326eefe60be0b51a5be2ea38634e45287ccfbc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	explorti.exe

Executes dropped EXE 12 IoCs

pid	Process
2196	explorti.exe
4320	explorti.exe
2024	svoutse.exe
228	svoutse.exe
1300	explorti.exe
5004	54ca4d70b5.exe
1044	2f35c7f94b.exe
3540	2f35c7f94b.exe
1108	svoutse.exe
3760	explorti.exe
6016	explorti.exe
6028	svoutse.exe

Identifies Wine through registry keys 2 TTPs 12 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Wine	54ca4d70b5.exe
Key opened	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Wine	2f35c7f94b.exe
Key opened	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Wine	5da8190ffd2e3bfbc685b9de6e326eefe60be0b51a5be2ea38634e45287ccfbc.exe
Key opened	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Wine	svoutse.exe
Key opened	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Wine	svoutse.exe
Key opened	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Wine	svoutse.exe
Key opened	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Wine	svoutse.exe
Key opened	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Wine	explorti.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000700000002348a-93.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs

pid	Process
1408	5da8190ffd2e3bfbc685b9de6e326eefe60be0b51a5be2ea38634e45287ccfbc.exe
2196	explorti.exe
4320	explorti.exe
2024	svoutse.exe
1300	explorti.exe
228	svoutse.exe
5004	54ca4d70b5.exe
1044	2f35c7f94b.exe
3760	explorti.exe
1108	svoutse.exe
6028	svoutse.exe
6016	explorti.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explorti.job	5da8190ffd2e3bfbc685b9de6e326eefe60be0b51a5be2ea38634e45287ccfbc.exe
File created	C:\Windows\Tasks\svoutse.job	explorti.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorti.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svoutse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5da8190ffd2e3bfbc685b9de6e326eefe60be0b51a5be2ea38634e45287ccfbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorti.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	54ca4d70b5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2f35c7f94b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2f35c7f94b.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2372	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
4600	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
1408	5da8190ffd2e3bfbc685b9de6e326eefe60be0b51a5be2ea38634e45287ccfbc.exe
1408	5da8190ffd2e3bfbc685b9de6e326eefe60be0b51a5be2ea38634e45287ccfbc.exe
2196	explorti.exe
2196	explorti.exe
4320	explorti.exe
4320	explorti.exe
2024	svoutse.exe
2024	svoutse.exe
1300	explorti.exe
228	svoutse.exe
1300	explorti.exe
228	svoutse.exe
5004	54ca4d70b5.exe
5004	54ca4d70b5.exe
1044	2f35c7f94b.exe
1044	2f35c7f94b.exe
1380	msedge.exe
1380	msedge.exe
5084	msedge.exe
5084	msedge.exe
5504	identity_helper.exe
5504	identity_helper.exe
3760	explorti.exe
3760	explorti.exe
1108	svoutse.exe
1108	svoutse.exe
6028	svoutse.exe
6028	svoutse.exe
6016	explorti.exe
6016	explorti.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3540	2f35c7f94b.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 29 IoCs

pid	Process
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4600	taskkill.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1408	5da8190ffd2e3bfbc685b9de6e326eefe60be0b51a5be2ea38634e45287ccfbc.exe
4320	explorti.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
5084	msedge.exe
5084	msedge.exe
3540	2f35c7f94b.exe
5084	msedge.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe
3540	2f35c7f94b.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1408 wrote to memory of 2196	1408	5da8190ffd2e3bfbc685b9de6e326eefe60be0b51a5be2ea38634e45287ccfbc.exe	86
PID 1408 wrote to memory of 2196	1408	5da8190ffd2e3bfbc685b9de6e326eefe60be0b51a5be2ea38634e45287ccfbc.exe	86
PID 1408 wrote to memory of 2196	1408	5da8190ffd2e3bfbc685b9de6e326eefe60be0b51a5be2ea38634e45287ccfbc.exe	86
PID 2196 wrote to memory of 3416	2196	explorti.exe	91
PID 2196 wrote to memory of 3416	2196	explorti.exe	91
PID 2196 wrote to memory of 3416	2196	explorti.exe	91
PID 3416 wrote to memory of 4600	3416	cmd.exe	93
PID 3416 wrote to memory of 4600	3416	cmd.exe	93
PID 3416 wrote to memory of 4600	3416	cmd.exe	93
PID 3416 wrote to memory of 2372	3416	cmd.exe	94
PID 3416 wrote to memory of 2372	3416	cmd.exe	94
PID 3416 wrote to memory of 2372	3416	cmd.exe	94
PID 3416 wrote to memory of 4320	3416	cmd.exe	95
PID 3416 wrote to memory of 4320	3416	cmd.exe	95
PID 3416 wrote to memory of 4320	3416	cmd.exe	95
PID 4320 wrote to memory of 2024	4320	explorti.exe	97
PID 4320 wrote to memory of 2024	4320	explorti.exe	97
PID 4320 wrote to memory of 2024	4320	explorti.exe	97
PID 2024 wrote to memory of 5004	2024	svoutse.exe	102
PID 2024 wrote to memory of 5004	2024	svoutse.exe	102
PID 2024 wrote to memory of 5004	2024	svoutse.exe	102
PID 2024 wrote to memory of 1044	2024	svoutse.exe	103
PID 2024 wrote to memory of 1044	2024	svoutse.exe	103
PID 2024 wrote to memory of 1044	2024	svoutse.exe	103
PID 2024 wrote to memory of 3540	2024	svoutse.exe	104
PID 2024 wrote to memory of 3540	2024	svoutse.exe	104
PID 2024 wrote to memory of 3540	2024	svoutse.exe	104
PID 3540 wrote to memory of 5084	3540	2f35c7f94b.exe	105
PID 3540 wrote to memory of 5084	3540	2f35c7f94b.exe	105
PID 5084 wrote to memory of 4132	5084	msedge.exe	106
PID 5084 wrote to memory of 4132	5084	msedge.exe	106
PID 5084 wrote to memory of 3952	5084	msedge.exe	107
PID 5084 wrote to memory of 3952	5084	msedge.exe	107
PID 5084 wrote to memory of 3952	5084	msedge.exe	107
PID 5084 wrote to memory of 3952	5084	msedge.exe	107
PID 5084 wrote to memory of 3952	5084	msedge.exe	107
PID 5084 wrote to memory of 3952	5084	msedge.exe	107
PID 5084 wrote to memory of 3952	5084	msedge.exe	107
PID 5084 wrote to memory of 3952	5084	msedge.exe	107
PID 5084 wrote to memory of 3952	5084	msedge.exe	107
PID 5084 wrote to memory of 3952	5084	msedge.exe	107
PID 5084 wrote to memory of 3952	5084	msedge.exe	107
PID 5084 wrote to memory of 3952	5084	msedge.exe	107
PID 5084 wrote to memory of 3952	5084	msedge.exe	107
PID 5084 wrote to memory of 3952	5084	msedge.exe	107
PID 5084 wrote to memory of 3952	5084	msedge.exe	107
PID 5084 wrote to memory of 3952	5084	msedge.exe	107
PID 5084 wrote to memory of 3952	5084	msedge.exe	107
PID 5084 wrote to memory of 3952	5084	msedge.exe	107
PID 5084 wrote to memory of 3952	5084	msedge.exe	107
PID 5084 wrote to memory of 3952	5084	msedge.exe	107
PID 5084 wrote to memory of 3952	5084	msedge.exe	107
PID 5084 wrote to memory of 3952	5084	msedge.exe	107
PID 5084 wrote to memory of 3952	5084	msedge.exe	107
PID 5084 wrote to memory of 3952	5084	msedge.exe	107
PID 5084 wrote to memory of 3952	5084	msedge.exe	107
PID 5084 wrote to memory of 3952	5084	msedge.exe	107
PID 5084 wrote to memory of 3952	5084	msedge.exe	107
PID 5084 wrote to memory of 3952	5084	msedge.exe	107
PID 5084 wrote to memory of 3952	5084	msedge.exe	107
PID 5084 wrote to memory of 3952	5084	msedge.exe	107
PID 5084 wrote to memory of 3952	5084	msedge.exe	107
PID 5084 wrote to memory of 3952	5084	msedge.exe	107
PID 5084 wrote to memory of 3952	5084	msedge.exe	107

C:\Users\Admin\AppData\Local\Temp\5da8190ffd2e3bfbc685b9de6e326eefe60be0b51a5be2ea38634e45287ccfbc.exe
"C:\Users\Admin\AppData\Local\Temp\5da8190ffd2e3bfbc685b9de6e326eefe60be0b51a5be2ea38634e45287ccfbc.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1408
- C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
  "C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Checks computer location settings
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2196
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k "taskkill /f /im "explorti.exe" && timeout 1 && del "explorti.exe" && ren 0657d1 explorti.exe && C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe && Exit"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3416
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "explorti.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4600
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 1
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:2372
  - - C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
      C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Checks computer location settings
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:4320
    - - C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Checks computer location settings
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2024
      - C:\Users\Admin\AppData\Roaming\1000026000\54ca4d70b5.exe
        
        "C:\Users\Admin\AppData\Roaming\1000026000\54ca4d70b5.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:5004
      - C:\Users\Admin\AppData\Roaming\1000027000\2f35c7f94b.exe
        
        "C:\Users\Admin\AppData\Roaming\1000027000\2f35c7f94b.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1044
      - C:\Users\Admin\AppData\Local\Temp\1000028001\2f35c7f94b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000028001\2f35c7f94b.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:3540
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
        7⤵
        Enumerates system info in registry
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:5084
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8215a46f8,0x7ff8215a4708,0x7ff8215a4718
        8⤵
        
        PID:4132
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,15443545416184336315,1503813357680833820,131072 --disable-features=TranslateUI --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
        8⤵
        
        PID:3952
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,15443545416184336315,1503813357680833820,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1380
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,15443545416184336315,1503813357680833820,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
        8⤵
        
        PID:1432
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15443545416184336315,1503813357680833820,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
        8⤵
        
        PID:1572
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15443545416184336315,1503813357680833820,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
        8⤵
        
        PID:1400
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15443545416184336315,1503813357680833820,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3852 /prefetch:1
        8⤵
        
        PID:4784
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15443545416184336315,1503813357680833820,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4028 /prefetch:1
        8⤵
        
        PID:1812
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15443545416184336315,1503813357680833820,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4204 /prefetch:1
        8⤵
        
        PID:4800
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15443545416184336315,1503813357680833820,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4208 /prefetch:1
        8⤵
        
        PID:4596
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15443545416184336315,1503813357680833820,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4476 /prefetch:1
        8⤵
        
        PID:4936
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15443545416184336315,1503813357680833820,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4484 /prefetch:1
        8⤵
        
        PID:1516
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15443545416184336315,1503813357680833820,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:1
        8⤵
        
        PID:4992
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15443545416184336315,1503813357680833820,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4824 /prefetch:1
        8⤵
        
        PID:3836
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15443545416184336315,1503813357680833820,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4196 /prefetch:1
        8⤵
        
        PID:5500
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15443545416184336315,1503813357680833820,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
        8⤵
        
        PID:5508
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15443545416184336315,1503813357680833820,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
        8⤵
        
        PID:5516
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15443545416184336315,1503813357680833820,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
        8⤵
        
        PID:5524
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15443545416184336315,1503813357680833820,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
        8⤵
        
        PID:5532
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15443545416184336315,1503813357680833820,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
        8⤵
        
        PID:5540
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15443545416184336315,1503813357680833820,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
        8⤵
        
        PID:5548
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15443545416184336315,1503813357680833820,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
        8⤵
        
        PID:5556
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15443545416184336315,1503813357680833820,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:1
        8⤵
        
        PID:5564
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15443545416184336315,1503813357680833820,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:1
        8⤵
        
        PID:5572
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15443545416184336315,1503813357680833820,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:1
        8⤵
        
        PID:5580
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15443545416184336315,1503813357680833820,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6152 /prefetch:1
        8⤵
        
        PID:5588
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15443545416184336315,1503813357680833820,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6148 /prefetch:1
        8⤵
        
        PID:5596
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15443545416184336315,1503813357680833820,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:1
        8⤵
        
        PID:5604
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15443545416184336315,1503813357680833820,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6316 /prefetch:1
        8⤵
        
        PID:5612
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15443545416184336315,1503813357680833820,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:1
        8⤵
        
        PID:5620
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15443545416184336315,1503813357680833820,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6220 /prefetch:1
        8⤵
        
        PID:5628
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15443545416184336315,1503813357680833820,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6300 /prefetch:1
        8⤵
        
        PID:5636
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15443545416184336315,1503813357680833820,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6260 /prefetch:1
        8⤵
        
        PID:5644
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,15443545416184336315,1503813357680833820,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8764 /prefetch:8
        8⤵
        
        PID:3648
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,15443545416184336315,1503813357680833820,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8764 /prefetch:8
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5504
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,15443545416184336315,1503813357680833820,131072 --disable-features=TranslateUI --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3020 /prefetch:2
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5220

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:228

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1300

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4820

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5244

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3760

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1108

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:6016

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:6028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat
Size 152B
SHA256 6e396201ad1b33f978df72e472ac58b5bb055be0560d859da7853888cfc6dbb3
MD5 0c15bdfb20158c9c5a6ade955cf0f1e4
SHA1 22051abb2c92d4fb0ddc7e0a6f8a17c0dbc83bdb
SHA512 fd9cf75b9f8b4cb0ab90d6080214cdb5e45ddd6f787a6fa1b8c8a8e022d970c26bae11eb9ce552765cc393f2d2a6c3785e5b0896e2bc4aa507969dbada16bbe2
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat
Size 152B
SHA256 b3dc2fe559605374b263b5e4375454f5d1f287e5c8ac44147566d17309f8f287
MD5 5b3d9e416c68ec11c198c4313082a4df
SHA1 e0c9033e47708167a9d08f0903f28c38b9370b4b
SHA512 b903426eb3b940c081cb53211cda582ebaa6922a5f7f197622a6577b1977d4457e999c115c6f7f50c8f5c1cee534982be7fdf613308ef3fdc7ca5fde4951ce0e
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat
Size 152B
SHA256 9299a0b8ea4b1350b90ec101d3f87b94c1d5421ba5894d8bc815b08dfdd164d9
MD5 f9fdecf5957045d5d867656817ff2f5e
SHA1 8416a47c4f1790c924d0f49101c0c9fee9aeae3c
SHA512 64552e612d0390a8fe89da7c5edfbbb693f91cc458cc368915743def652f759dbd805a0bfd2169a94ae9784edd3e086b5cfcb21ba7edee74ff09853e6b5f9000
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

0d53d698-6fb3-4b9e-9573-f62f780a0bc8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\0d53d698-6fb3-4b9e-9573-f62f780a0bc8.tmp
Size 4KB
SHA256 27e592b7635f8a7301e3656445aff260bfe446891492b2547df80d2b78988359
MD5 e5692ff09788af9e9882654f3307b9fb
SHA1 104cb38847f16625d7199ed75c283c595c80eefa
SHA512 3185d930b2cb49f5fa7affed846c10d8430c7b821ee3417ba6d1c2e2712c2d68f57ce2c95e92183805d8eb41b3f4e570882364e030f1014109b8a0be087efbf7
SSDEEP 96:nZypH1uNtnKpvWMoiVmdeHpmWOhUBKVD7AiEwb:nZSQNRcWMXIWeYE
MD5 SHA1 SHA512 SSDEEP

Submit Download

97ee6680-70be-455c-a1df-7a86442c4696.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\97ee6680-70be-455c-a1df-7a86442c4696.tmp
Size 4KB
SHA256 fd039121b95507f80f1cb5a75f16d83bd44d6b33eac4834e067e866f32f631ae
MD5 d843a38cbbd1e864514307824f6a9f15
SHA1 466a4135d01d2cf196107506b18ade3a0cf824c6
SHA512 101729e078bc5da0b2f001144b67b7a0378729318b19847f5b34506491854f799ad419dff6dd88940456ec822216ff49c9b850693c7a7f3e7bcb25b704d9889a
SSDEEP 96:nZBpN1uNtnKpvWMoiVmdeHpmWOhUBKVDCzia:nZxQNRcWMXIWeY3
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Microsoft Edge.lnk

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Microsoft Edge.lnk
Size 1KB
SHA256 b6cd9e35f9b7afc10ee4df01ccb559e19ed4f4df4af225870abe11e746859de3
MD5 840f49fde0a7bc3ddb820bc0f45b0570
SHA1 33d8f776dd1aa623b6f3510527a6b47669dc3134
SHA512 22cefab5ba829678a0e3c4f3cc82a6fa741ecea7c89241a84d78eb157d8e370b60c7ba90418da708c2fa4f04f802392aedb72af4257150c0c079abc2a85a1731
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences
Size 4KB
SHA256 f1a4e10e593410eab47dd4d77f2db66625a573b82ab512eb0ef90e82677bb15f
MD5 a65fbafec986cf7ae85ca05a6a701dee
SHA1 7584dac631cecb606c9030e194d1e7021db0a993
SHA512 bd0b31fc5794fdc257bf7c561daa6d5ab1a894d897a1184589f23f9c2898d6ccb7850ab44af5998307631f80e33daeb3ed52afdd2edf867ef47b5bad1443bc02
SSDEEP 96:nZypH1uNtnKpvWMoiVmdeHpmWxhUBKVD7AiEwb:nZSQNRcWMXIWvYE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences
Size 24KB
SHA256 b0ede0ffcb810670fd6cd23843df01ee4860c931aec7d18a204123acd89d121b
MD5 cff1fd106e70944cad79a4aff2f6dd46
SHA1 1a75d80b4325e60a72e1eb43a58c7110a3697873
SHA512 ff587cb52cb1e7135801615492fc8eca78d1ca3e8f4e3ae13cbbcbee927d5e63be2a58edf2c2aec470eba78dde0ca13b76b70baad316ce926f0842f548f04a4f
SSDEEP 768:nhoW+j8F1+UoAYDCx9Tuqh0VfUC9xbog/OV7LlzerUfNz4Kd:nhoW+ju1jacL31zFd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences~RFe57df54.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences~RFe57df54.TMP
Size 24KB
SHA256 163e695c7e13c62cc045811c285c6cdd194cc40e2e8d27e028b1703a2c59ff05
MD5 00dd917a3167b8d59973928496d868d1
SHA1 0449d93d722b0fda421d48cf020d588b742e6716
SHA512 b76552b91b2b9bd4c3aba44061d3ae3a4ed8e87db7016410cb5d1c80363d701caac1c88dbc2a5f7738f2d2198013bbd4015e13d7579d059443e62d1c273f92e5
SSDEEP 768:ZoWtZ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVfLlzqrUfNqOKW:ZoWtZu1jayLH1qXW
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

ce421be4-1470-44e6-a545-898a5dc0043e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\ce421be4-1470-44e6-a545-898a5dc0043e.tmp
Size 9KB
SHA256 e25a0da168136aa20e8330fa26beb816cdcd8c6a53caeb8d3ae375011e22668c
MD5 30773491a835e00192bea02169e3e517
SHA1 d4be6d77a17da1faf65880161bfd1b5c256ebceb
SHA512 de37ba25400889bc9a50c9de43d2d6d38b081dc8158bc579f6a7f6a657a3f6ecc9896ae6172620a88c46cfe6380670d6f84d6ce9a47767dcafaa67cd323c76dd
SSDEEP 192:RoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupfmU/eMRUfusbRw5Ytj9ZkR:N9iIxuERzA83h09RZxY9LackLsb
MD5 SHA1 SHA512 SSDEEP

Submit Download

0657d1

Path C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\0657d1
Size 1.8MB
SHA256 0cce55a6fec4dbf3581208ef779f877ff43ecbaa27d2f2119d6552d06b684493
MD5 5a4f2d577db2373f79eb9d16f8037af4
SHA1 ed08c149b8992e508e7382b0a19e6685eb9caf5e
SHA512 ec8bec4bf9433e4fd41e3a4b74e7bb1b8dbf46e15ab528e4feed51750e3c9e43ed59fcbc12982fc36bd50172a752325b192dfc65195f7118c47f1e7c2d24eccb
SSDEEP 49152:R7wbCfJnoVxG8rdz1iuf4ri4pmy/Yr8rxXm:RFfJoVxGmdZiFrzdyyxXm
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorti.exe

Path C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Size 1.8MB
SHA256 5da8190ffd2e3bfbc685b9de6e326eefe60be0b51a5be2ea38634e45287ccfbc
MD5 d2d35997021550d304bf21a670921efe
SHA1 974ed61752963812b1005e85d5077e43b00afc6b
SHA512 f7a48b602d925b5c8b0190279beff76f054530bf2aef3e1ff7c16d2f88f08227387d2ebe944a52601b7d9732716901a950744736cdd9dc630e5cc922154aa87d
SSDEEP 49152:rzrWn4LAutiSNWKIKR/J/mTmmJF500kjxw9WLVpw5:7WSXtiGWKn19mn5Adw9Wbw5
MD5 SHA1 SHA512 SSDEEP

Submit Download

2f35c7f94b.exe

Path C:\Users\Admin\AppData\Local\Temp\1000028001\2f35c7f94b.exe
Size 896KB
SHA256 1cf0747ce1310fd989b24a93d2108784efb003948fdec1f7e64479213075cb90
MD5 f0356008c23a76acfc263b5c3e2180cb
SHA1 2ed3657f3ee94a5cc0cf6b8b30a1334a9311baa2
SHA512 67efa62082d20bef10318cb2a46391219ee377138b50e5d05fdf2f8945092d1b9401e7cce6f3ccbdfe26f800e896d5e634c5fe41260cca4c0d3055b21c2bdf2a
SSDEEP 12288:vqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgacTy:vqDEvCTbMWu7rQYlBQcBiT6rprG8asy
MD5 SHA1 SHA512 SSDEEP

Submit Download

54ca4d70b5.exe

Path C:\Users\Admin\AppData\Roaming\1000026000\54ca4d70b5.exe
Size 1.7MB
SHA256 83ebffd7d12fabe2f1bf465425e0883ff62d4bbdbab60924acaafd8ce197465c
MD5 538ef8d8696f1a9f1388a615ed4cf361
SHA1 280a7c4edc18e0c5e836d02d78f6bfbafe15c5bc
SHA512 f9bdf7d3569957f39d60fae6996da3491c92203d3f271e0cf832da4bc4c580a8e2fa33a6ccd15ce8e386ab1b1a9414470d31618828b0bd6b63a75f5da03769ad
SSDEEP 49152:Kmgy8lNBFQ1xx70XhuHiWpPlg9hrtxIQ:Pp8l61T0RuHP29FIQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

2BLD7BLJ42FKAJ6WHW3S.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\2BLD7BLJ42FKAJ6WHW3S.temp
Size 3KB
SHA256 ed59ddb02e031a9019b21dd28ea38f8c41b1d546f03d199546178c35bc730662
MD5 5c54fe1b4f6d523727be6b6e2ea6c391
SHA1 d393b44026e2586e8bffd24cb834de08704ab680
SHA512 150f9b1458de0e2fc67c8e1ddac76bc463c55d6764817fa68e9172bebcaab5ef0e04bd11e8f21f6c5f80a87afe0c7198db964dda4dfcc2925e8ec850bec54d3c
MD5 SHA1 SHA512

Submit Download

memory/228-56-0x0000000000AD0000-0x0000000000F98000-memory.dmp

Download

memory/228-51-0x0000000000AD0000-0x0000000000F98000-memory.dmp

Download

memory/1044-88-0x0000000000030000-0x00000000006C1000-memory.dmp

Download

memory/1044-298-0x0000000000030000-0x00000000006C1000-memory.dmp

Download

memory/1108-409-0x0000000000AD0000-0x0000000000F98000-memory.dmp

Download

memory/1108-413-0x0000000000AD0000-0x0000000000F98000-memory.dmp

Download

memory/1300-52-0x0000000000060000-0x0000000000528000-memory.dmp

Download

memory/1300-55-0x0000000000060000-0x0000000000528000-memory.dmp

Download

memory/1408-1-0x0000000076F54000-0x0000000076F56000-memory.dmp

Download

memory/1408-18-0x0000000000BC0000-0x000000000107E000-memory.dmp

Download

memory/1408-0-0x0000000000BC0000-0x000000000107E000-memory.dmp

Download

memory/1408-2-0x0000000000BC1000-0x0000000000BEF000-memory.dmp

Download

memory/1408-3-0x0000000000BC0000-0x000000000107E000-memory.dmp

Download

memory/1408-4-0x0000000000BC0000-0x000000000107E000-memory.dmp

Download

memory/2024-443-0x0000000000AD0000-0x0000000000F98000-memory.dmp

Download

memory/2024-395-0x0000000000AD0000-0x0000000000F98000-memory.dmp

Download

memory/2024-457-0x0000000000AD0000-0x0000000000F98000-memory.dmp

Download

memory/2024-454-0x0000000000AD0000-0x0000000000F98000-memory.dmp

Download

memory/2024-446-0x0000000000AD0000-0x0000000000F98000-memory.dmp

Download

memory/2024-323-0x0000000000AD0000-0x0000000000F98000-memory.dmp

Download

memory/2024-445-0x0000000000AD0000-0x0000000000F98000-memory.dmp

Download

memory/2024-444-0x0000000000AD0000-0x0000000000F98000-memory.dmp

Download

memory/2024-296-0x0000000000AD0000-0x0000000000F98000-memory.dmp

Download

memory/2024-442-0x0000000000AD0000-0x0000000000F98000-memory.dmp

Download

memory/2024-376-0x0000000000AD0000-0x0000000000F98000-memory.dmp

Download

memory/2024-406-0x0000000000AD0000-0x0000000000F98000-memory.dmp

Download

memory/2024-423-0x0000000000AD0000-0x0000000000F98000-memory.dmp

Download

memory/2024-396-0x0000000000AD0000-0x0000000000F98000-memory.dmp

Download

memory/2024-46-0x0000000000AD0000-0x0000000000F98000-memory.dmp

Download

memory/2024-260-0x0000000000AD0000-0x0000000000F98000-memory.dmp

Download

memory/2196-20-0x0000000000EE0000-0x000000000139E000-memory.dmp

Download

memory/2196-31-0x0000000000EE0000-0x000000000139E000-memory.dmp

Download

memory/2196-22-0x0000000000EE0000-0x000000000139E000-memory.dmp

Download

memory/2196-21-0x0000000000EE0000-0x000000000139E000-memory.dmp

Download

memory/2196-16-0x0000000000EE0000-0x000000000139E000-memory.dmp

Download

memory/2196-19-0x0000000000EE1000-0x0000000000F0F000-memory.dmp

Download

memory/3760-412-0x0000000000060000-0x0000000000528000-memory.dmp

Download

memory/3760-410-0x0000000000060000-0x0000000000528000-memory.dmp

Download

memory/4320-34-0x0000000000060000-0x0000000000528000-memory.dmp

Download

memory/4320-47-0x0000000000060000-0x0000000000528000-memory.dmp

Download

memory/5004-107-0x00000000000A0000-0x0000000000731000-memory.dmp

Download

memory/5004-71-0x00000000000A0000-0x0000000000731000-memory.dmp

Download

memory/6016-451-0x0000000000060000-0x0000000000528000-memory.dmp

Download

memory/6028-449-0x0000000000AD0000-0x0000000000F98000-memory.dmp

Download

memory/6028-450-0x0000000000AD0000-0x0000000000F98000-memory.dmp

Download