amadey | 747ad71951bbc28d848c175e17423a7c38e5b05ebdcc2a1143f45bc7f88f8379

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/09/2024, 01:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

747ad71951bbc28d848c175e17423a7c38e5b05ebdcc2a1143f45bc7f88f8379.exe
Size

1.8MB
MD5

bee44c520f00c6bb04ef4333aae55860
SHA1

72aa29fb94b5c8206ba1b03770d1e5951c876dcf
SHA256

747ad71951bbc28d848c175e17423a7c38e5b05ebdcc2a1143f45bc7f88f8379
SHA512

4e4a23fda4fdfeca9c41d08a60d30132de4ec272ef11e8d6054542cc52b0eb3ddf71e41e1e5672995b5f99b7641577603c9353c4c98f746adc3a8111a8c2cc33
SSDEEP

49152:T2BOOFp6Ezld6Fyo+bfIv8y4rz/l0Vy9Kx68kl:T2BRbzld6F7B8b/l0Mm

Score

10^/10

amadey stealc 0657d1 c7817d leva discovery evasion stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

0657d1

http://185.215.113.19

Attributes

install_dir
0d8f5eb8a7
install_file
explorti.exe
strings_key
6c55a5f34bb433fbd933a168577b1838
url_paths
/Vi9leo/index.php

rc4.plain

Extracted

Family

amadey

Version

4.41

Botnet

c7817d

http://31.41.244.10

Attributes

install_dir
0e8d0864aa
install_file
svoutse.exe
strings_key
5481b88a6ef75bcf21333988a4e47048
url_paths
/Dem7kTu/index.php

rc4.plain

Extracted

Family

stealc

Botnet

leva

http://185.215.113.100

Attributes

url_path
/e2b1563c6670f193.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Stealc
Stealc is an infostealer written in C++.
stealer stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 12 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	svoutse.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	0148ce3fad.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	7541e209db.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	svoutse.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	svoutse.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	svoutse.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	747ad71951bbc28d848c175e17423a7c38e5b05ebdcc2a1143f45bc7f88f8379.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 24 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	0148ce3fad.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	747ad71951bbc28d848c175e17423a7c38e5b05ebdcc2a1143f45bc7f88f8379.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	747ad71951bbc28d848c175e17423a7c38e5b05ebdcc2a1143f45bc7f88f8379.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	7541e209db.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	0148ce3fad.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	7541e209db.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	explorti.exe
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	svoutse.exe
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	747ad71951bbc28d848c175e17423a7c38e5b05ebdcc2a1143f45bc7f88f8379.exe
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	explorti.exe

Executes dropped EXE 12 IoCs

pid	Process
1608	explorti.exe
2888	explorti.exe
2344	svoutse.exe
4768	0148ce3fad.exe
3044	7541e209db.exe
3680	7541e209db.exe
3728	svoutse.exe
4516	explorti.exe
3224	svoutse.exe
1016	explorti.exe
4188	explorti.exe
5932	svoutse.exe

Identifies Wine through registry keys 2 TTPs 12 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Wine	svoutse.exe
Key opened	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Wine	0148ce3fad.exe
Key opened	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Wine	7541e209db.exe
Key opened	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Wine	svoutse.exe
Key opened	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Wine	svoutse.exe
Key opened	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Wine	747ad71951bbc28d848c175e17423a7c38e5b05ebdcc2a1143f45bc7f88f8379.exe
Key opened	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Wine	svoutse.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x00070000000234c5-87.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs

pid	Process
1720	747ad71951bbc28d848c175e17423a7c38e5b05ebdcc2a1143f45bc7f88f8379.exe
1608	explorti.exe
2888	explorti.exe
2344	svoutse.exe
4768	0148ce3fad.exe
3044	7541e209db.exe
4516	explorti.exe
3728	svoutse.exe
3224	svoutse.exe
1016	explorti.exe
4188	explorti.exe
5932	svoutse.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explorti.job	747ad71951bbc28d848c175e17423a7c38e5b05ebdcc2a1143f45bc7f88f8379.exe
File created	C:\Windows\Tasks\svoutse.job	explorti.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorti.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svoutse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0148ce3fad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7541e209db.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	747ad71951bbc28d848c175e17423a7c38e5b05ebdcc2a1143f45bc7f88f8379.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorti.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7541e209db.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4948	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
2548	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
1720	747ad71951bbc28d848c175e17423a7c38e5b05ebdcc2a1143f45bc7f88f8379.exe
1720	747ad71951bbc28d848c175e17423a7c38e5b05ebdcc2a1143f45bc7f88f8379.exe
1608	explorti.exe
1608	explorti.exe
2888	explorti.exe
2888	explorti.exe
2344	svoutse.exe
2344	svoutse.exe
4768	0148ce3fad.exe
4768	0148ce3fad.exe
3044	7541e209db.exe
3044	7541e209db.exe
3092	msedge.exe
3092	msedge.exe
2520	msedge.exe
2520	msedge.exe
5216	identity_helper.exe
5216	identity_helper.exe
4516	explorti.exe
4516	explorti.exe
3728	svoutse.exe
3728	svoutse.exe
1016	explorti.exe
3224	svoutse.exe
1016	explorti.exe
3224	svoutse.exe
5476	msedge.exe
5476	msedge.exe
5476	msedge.exe
5476	msedge.exe
4188	explorti.exe
4188	explorti.exe
5932	svoutse.exe
5932	svoutse.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3680	7541e209db.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 33 IoCs

pid	Process
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2548	taskkill.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3680	7541e209db.exe
3680	7541e209db.exe
2520	msedge.exe
2520	msedge.exe
3680	7541e209db.exe
2520	msedge.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe
3680	7541e209db.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 1608	1720	747ad71951bbc28d848c175e17423a7c38e5b05ebdcc2a1143f45bc7f88f8379.exe	86
PID 1720 wrote to memory of 1608	1720	747ad71951bbc28d848c175e17423a7c38e5b05ebdcc2a1143f45bc7f88f8379.exe	86
PID 1720 wrote to memory of 1608	1720	747ad71951bbc28d848c175e17423a7c38e5b05ebdcc2a1143f45bc7f88f8379.exe	86
PID 1608 wrote to memory of 2420	1608	explorti.exe	88
PID 1608 wrote to memory of 2420	1608	explorti.exe	88
PID 1608 wrote to memory of 2420	1608	explorti.exe	88
PID 2420 wrote to memory of 2548	2420	cmd.exe	90
PID 2420 wrote to memory of 2548	2420	cmd.exe	90
PID 2420 wrote to memory of 2548	2420	cmd.exe	90
PID 2420 wrote to memory of 4948	2420	cmd.exe	92
PID 2420 wrote to memory of 4948	2420	cmd.exe	92
PID 2420 wrote to memory of 4948	2420	cmd.exe	92
PID 2420 wrote to memory of 2888	2420	cmd.exe	95
PID 2420 wrote to memory of 2888	2420	cmd.exe	95
PID 2420 wrote to memory of 2888	2420	cmd.exe	95
PID 2888 wrote to memory of 2344	2888	explorti.exe	97
PID 2888 wrote to memory of 2344	2888	explorti.exe	97
PID 2888 wrote to memory of 2344	2888	explorti.exe	97
PID 2344 wrote to memory of 4768	2344	svoutse.exe	99
PID 2344 wrote to memory of 4768	2344	svoutse.exe	99
PID 2344 wrote to memory of 4768	2344	svoutse.exe	99
PID 2344 wrote to memory of 3044	2344	svoutse.exe	100
PID 2344 wrote to memory of 3044	2344	svoutse.exe	100
PID 2344 wrote to memory of 3044	2344	svoutse.exe	100
PID 2344 wrote to memory of 3680	2344	svoutse.exe	101
PID 2344 wrote to memory of 3680	2344	svoutse.exe	101
PID 2344 wrote to memory of 3680	2344	svoutse.exe	101
PID 3680 wrote to memory of 2520	3680	7541e209db.exe	102
PID 3680 wrote to memory of 2520	3680	7541e209db.exe	102
PID 2520 wrote to memory of 2736	2520	msedge.exe	103
PID 2520 wrote to memory of 2736	2520	msedge.exe	103
PID 2520 wrote to memory of 4428	2520	msedge.exe	104
PID 2520 wrote to memory of 4428	2520	msedge.exe	104
PID 2520 wrote to memory of 4428	2520	msedge.exe	104
PID 2520 wrote to memory of 4428	2520	msedge.exe	104
PID 2520 wrote to memory of 4428	2520	msedge.exe	104
PID 2520 wrote to memory of 4428	2520	msedge.exe	104
PID 2520 wrote to memory of 4428	2520	msedge.exe	104
PID 2520 wrote to memory of 4428	2520	msedge.exe	104
PID 2520 wrote to memory of 4428	2520	msedge.exe	104
PID 2520 wrote to memory of 4428	2520	msedge.exe	104
PID 2520 wrote to memory of 4428	2520	msedge.exe	104
PID 2520 wrote to memory of 4428	2520	msedge.exe	104
PID 2520 wrote to memory of 4428	2520	msedge.exe	104
PID 2520 wrote to memory of 4428	2520	msedge.exe	104
PID 2520 wrote to memory of 4428	2520	msedge.exe	104
PID 2520 wrote to memory of 4428	2520	msedge.exe	104
PID 2520 wrote to memory of 4428	2520	msedge.exe	104
PID 2520 wrote to memory of 4428	2520	msedge.exe	104
PID 2520 wrote to memory of 4428	2520	msedge.exe	104
PID 2520 wrote to memory of 4428	2520	msedge.exe	104
PID 2520 wrote to memory of 4428	2520	msedge.exe	104
PID 2520 wrote to memory of 4428	2520	msedge.exe	104
PID 2520 wrote to memory of 4428	2520	msedge.exe	104
PID 2520 wrote to memory of 4428	2520	msedge.exe	104
PID 2520 wrote to memory of 4428	2520	msedge.exe	104
PID 2520 wrote to memory of 4428	2520	msedge.exe	104
PID 2520 wrote to memory of 4428	2520	msedge.exe	104
PID 2520 wrote to memory of 4428	2520	msedge.exe	104
PID 2520 wrote to memory of 4428	2520	msedge.exe	104
PID 2520 wrote to memory of 4428	2520	msedge.exe	104
PID 2520 wrote to memory of 4428	2520	msedge.exe	104
PID 2520 wrote to memory of 4428	2520	msedge.exe	104
PID 2520 wrote to memory of 4428	2520	msedge.exe	104

C:\Users\Admin\AppData\Local\Temp\747ad71951bbc28d848c175e17423a7c38e5b05ebdcc2a1143f45bc7f88f8379.exe
"C:\Users\Admin\AppData\Local\Temp\747ad71951bbc28d848c175e17423a7c38e5b05ebdcc2a1143f45bc7f88f8379.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
  "C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Checks computer location settings
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1608
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k "taskkill /f /im "explorti.exe" && timeout 1 && del "explorti.exe" && ren 0657d1 explorti.exe && C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe && Exit"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2420
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "explorti.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2548
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 1
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:4948
  - - C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
      C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Checks computer location settings
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2888
    - - C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Checks computer location settings
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2344
      - C:\Users\Admin\AppData\Roaming\1000026000\0148ce3fad.exe
        
        "C:\Users\Admin\AppData\Roaming\1000026000\0148ce3fad.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4768
      - C:\Users\Admin\AppData\Roaming\1000027000\7541e209db.exe
        
        "C:\Users\Admin\AppData\Roaming\1000027000\7541e209db.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3044
      - C:\Users\Admin\AppData\Local\Temp\1000028001\7541e209db.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000028001\7541e209db.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:3680
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
        7⤵
        Enumerates system info in registry
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:2520
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa835b46f8,0x7ffa835b4708,0x7ffa835b4718
        8⤵
        
        PID:2736
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,13056696362247798181,9823196425034013416,131072 --disable-features=TranslateUI --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 /prefetch:2
        8⤵
        
        PID:4428
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2000,13056696362247798181,9823196425034013416,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 /prefetch:3
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3092
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2000,13056696362247798181,9823196425034013416,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
        8⤵
        
        PID:2936
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,13056696362247798181,9823196425034013416,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
        8⤵
        
        PID:4744
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,13056696362247798181,9823196425034013416,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
        8⤵
        
        PID:4672
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,13056696362247798181,9823196425034013416,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3880 /prefetch:1
        8⤵
        
        PID:448
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,13056696362247798181,9823196425034013416,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3904 /prefetch:1
        8⤵
        
        PID:3244
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,13056696362247798181,9823196425034013416,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4240 /prefetch:1
        8⤵
        
        PID:2940
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,13056696362247798181,9823196425034013416,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4256 /prefetch:1
        8⤵
        
        PID:4872
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,13056696362247798181,9823196425034013416,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4540 /prefetch:1
        8⤵
        
        PID:452
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,13056696362247798181,9823196425034013416,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4660 /prefetch:1
        8⤵
        
        PID:4768
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,13056696362247798181,9823196425034013416,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4520 /prefetch:1
        8⤵
        
        PID:4692
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,13056696362247798181,9823196425034013416,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1
        8⤵
        
        PID:820
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,13056696362247798181,9823196425034013416,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
        8⤵
        
        PID:4416
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,13056696362247798181,9823196425034013416,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:1
        8⤵
        
        PID:4988
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,13056696362247798181,9823196425034013416,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
        8⤵
        
        PID:3940
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,13056696362247798181,9823196425034013416,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
        8⤵
        
        PID:1332
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,13056696362247798181,9823196425034013416,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
        8⤵
        
        PID:368
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,13056696362247798181,9823196425034013416,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
        8⤵
        
        PID:1712
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,13056696362247798181,9823196425034013416,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6556 /prefetch:1
        8⤵
        
        PID:5768
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,13056696362247798181,9823196425034013416,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6232 /prefetch:1
        8⤵
        
        PID:5776
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,13056696362247798181,9823196425034013416,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6548 /prefetch:1
        8⤵
        
        PID:5932
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,13056696362247798181,9823196425034013416,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6772 /prefetch:1
        8⤵
        
        PID:5940
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,13056696362247798181,9823196425034013416,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6872 /prefetch:1
        8⤵
        
        PID:5948
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,13056696362247798181,9823196425034013416,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6912 /prefetch:1
        8⤵
        
        PID:5956
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,13056696362247798181,9823196425034013416,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6920 /prefetch:1
        8⤵
        
        PID:5964
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,13056696362247798181,9823196425034013416,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6996 /prefetch:1
        8⤵
        
        PID:5972
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,13056696362247798181,9823196425034013416,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7024 /prefetch:1
        8⤵
        
        PID:5980
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,13056696362247798181,9823196425034013416,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6988 /prefetch:1
        8⤵
        
        PID:5988
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,13056696362247798181,9823196425034013416,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7036 /prefetch:1
        8⤵
        
        PID:5996
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,13056696362247798181,9823196425034013416,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5908 /prefetch:1
        8⤵
        
        PID:6004
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,13056696362247798181,9823196425034013416,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7104 /prefetch:1
        8⤵
        
        PID:6012
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,13056696362247798181,9823196425034013416,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7004 /prefetch:1
        8⤵
        
        PID:6024
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,13056696362247798181,9823196425034013416,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7092 /prefetch:1
        8⤵
        
        PID:6032
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,13056696362247798181,9823196425034013416,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7116 /prefetch:1
        8⤵
        
        PID:6040
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,13056696362247798181,9823196425034013416,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7192 /prefetch:1
        8⤵
        
        PID:6048
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2000,13056696362247798181,9823196425034013416,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7944 /prefetch:8
        8⤵
        
        PID:4416
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2000,13056696362247798181,9823196425034013416,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7944 /prefetch:8
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5216
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,13056696362247798181,9823196425034013416,131072 --disable-features=TranslateUI --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=8056 /prefetch:2
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5476

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5260

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5484

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3728

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4516

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3224

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1016

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5932

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

Filesize
152B

MD5
9084cb948a0549cf8649b5b8194694ea

SHA1
9a0bb182ba3a3a5606de51613ce40543d08a6082

SHA256
2482e9f169415c145239a9c3ec92232fa617bec335e619e6b0137b03c0019c62

SHA512
97795efc85ca67bfe5da47fcfbb1bc616476def8d29900e61f365312d5f7ea175fcff97c04566455469bd6430c7eba6a434b143fdb52da434462aa449f6e3ec1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

Filesize
152B

MD5
fe893de24c7b194933560954ac8ee84f

SHA1
e497ae1d1493144f0cd1bcf6f9a823ae79dbdc5e

SHA256
a19351e833a053fadb4191e4c8e105c63e0ae95dcc9e9e08f7b65da6fbf5574e

SHA512
3559e08a43f0e9bd8a211ee38a9c6796c994ef34ac445726ce0aa181f4524704cb812afb20d40c4d09501d9d99d512b6d87efc163121ae75d4f61ac843b6b2eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

Filesize
152B

MD5
ef1b13e2289d3639dce566bc1649a246

SHA1
9bf4dc87716e505952b994ee83f04c0bf6ec9bd8

SHA256
2e5f6213422630837a25e82ae94622e7778566fb9feeb55cc0c48d7acf5634c3

SHA512
15ca74aabb54aa2b21f2f05bc0c45d0d725ee85f551c771a7ee1d333307cac3f9b163cae544be4d951eca87b7d7bd370b00a89b0dace0da58526125fee237c05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat

Filesize
20B

MD5
9e4e94633b73f4a7680240a0ffd6cd2c

SHA1
e68e02453ce22736169a56fdb59043d33668368f

SHA256
41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304

SHA512
193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\64b9d27c-0103-4b38-a188-afef27e440ad.tmp

Filesize
4KB

MD5
a0d59122fd09ce2f78261528a79e3266

SHA1
8297b5ae0dc344222259647b6843a535c1e74e0f

SHA256
e5ac468845c708f89c7efd965781cfdeb4ceeb2651b8e4cd306c1f8a9e7fade5

SHA512
cd96bce7430001cb2f66a4b6c650ff69de44488511253cf32064cfe60fda815b525f0b90c9f31351f71913ea02312ddb8feea8b95d37066c2667ab65313ea45e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Microsoft Edge.lnk

Filesize
1KB

MD5
f412c143eafb9471b62434fc7039d2ea

SHA1
1a5c1a227f70a09556f0627b1dd0293d4d787577

SHA256
85abf44abb93ac502b2d510d9e2bf915e7407d3f09e4c35efa609dd64b3d39d5

SHA512
3265fdb1820da777e4574006c468eb7fd6f1992bb062c52d1b2eb0b3a2b9a31803c2e37cf78b9e675454f9507c6fc6a0423c02026054d5ad6f4762db78f9ef7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences

Filesize
4KB

MD5
2164f7ef303d417269fa1f4066aab258

SHA1
aede28a8402c10f4fb8fb8a7584e67d588a16b00

SHA256
8793c43dc98064d1383f7f3c5b18e9db65be1b0918ef80bbb84432ea863d5c47

SHA512
f8383b79a7662f967d0235baabf8d1034844a1ba28ca91a3cf4d1ebf8d77d43645813a6079ee0b2b5723fdf49a64cb44e53380a44262b7a1b1109cfbca2dde36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences

Filesize
4KB

MD5
f53fc51c1ddfc6736ed9ddad648007b2

SHA1
2031a6e3c1739d5e31803d6849fb35df1dc8fb94

SHA256
a020facbf2b6d702691bd7e493c03b646e9d0d68b3e3cc872f6225ea029e2a2b

SHA512
c0ce98d6fbc2e1c50ae2d2a7b4314b70a7d51c9579eb79e03ef7b87d34dd22a365c1995f209aa2f4fa2bb3a55e71702ad5f965a82ed07c24a45a36e9c5be9161

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences

Filesize
24KB

MD5
a66d6d4fa196f7f5735c5e184ec933a8

SHA1
a40374207868684cc7d5268abc5ee41e3deed4ef

SHA256
0552eea7e53b8e62f867b369d971e5458858ea28e2eb6c8d45c7af66b4c4663d

SHA512
2e8bd2b076c59e762e1a96da7b68e9fe0f1a0bf7379b39a8551d713c62c3b5f39ed51bd9d632e757e6cd3c7096eccb75002fba259f78c070361dfaf765df298e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences~RFe57e1d4.TMP

Filesize
24KB

MD5
11525a3161b4bbfb2f4c224206d9d8ff

SHA1
bacb2a9d3723816f2b44744ee9679dc414c1bd21

SHA256
18bfd799384d6a7e7692ac8fd3289f7616282d4f3ae22445a8165b6eb085b981

SHA512
3bdab4e6a968912cbc94b10b854d4520cb72d1266e8959936d8f51b084f6c35765224bca8978e1e6019fa4b7a34acc063cb8578a4228da5e9ab94ef36690a70d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\d740feb7-32a9-4878-82dc-b2efeed439c8.tmp

Filesize
9KB

MD5
88fd7ca748dffa5b0117592e35c0c785

SHA1
260a6477ece72ac11df006b381636d25ab34e152

SHA256
8a374e288595aa82282ca3ff9f9ec12a8387dd4482ce529b7355bd59e989babd

SHA512
298617b759d5d9e67d9cc55011b7dc08dcfdb4def15b464f6abe1572b6c7fc03b642e968bf21921c40255d3ac7cdc7da2d6063f0f39f542d85210e613bee60d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\0657d1

Filesize
1.8MB

MD5
5a4f2d577db2373f79eb9d16f8037af4

SHA1
ed08c149b8992e508e7382b0a19e6685eb9caf5e

SHA256
0cce55a6fec4dbf3581208ef779f877ff43ecbaa27d2f2119d6552d06b684493

SHA512
ec8bec4bf9433e4fd41e3a4b74e7bb1b8dbf46e15ab528e4feed51750e3c9e43ed59fcbc12982fc36bd50172a752325b192dfc65195f7118c47f1e7c2d24eccb

Download Submit
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Filesize
1.8MB

MD5
bee44c520f00c6bb04ef4333aae55860

SHA1
72aa29fb94b5c8206ba1b03770d1e5951c876dcf

SHA256
747ad71951bbc28d848c175e17423a7c38e5b05ebdcc2a1143f45bc7f88f8379

SHA512
4e4a23fda4fdfeca9c41d08a60d30132de4ec272ef11e8d6054542cc52b0eb3ddf71e41e1e5672995b5f99b7641577603c9353c4c98f746adc3a8111a8c2cc33

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000028001\7541e209db.exe

Filesize
896KB

MD5
f0356008c23a76acfc263b5c3e2180cb

SHA1
2ed3657f3ee94a5cc0cf6b8b30a1334a9311baa2

SHA256
1cf0747ce1310fd989b24a93d2108784efb003948fdec1f7e64479213075cb90

SHA512
67efa62082d20bef10318cb2a46391219ee377138b50e5d05fdf2f8945092d1b9401e7cce6f3ccbdfe26f800e896d5e634c5fe41260cca4c0d3055b21c2bdf2a

Download Submit
C:\Users\Admin\AppData\Roaming\1000026000\0148ce3fad.exe

Filesize
1.7MB

MD5
538ef8d8696f1a9f1388a615ed4cf361

SHA1
280a7c4edc18e0c5e836d02d78f6bfbafe15c5bc

SHA256
83ebffd7d12fabe2f1bf465425e0883ff62d4bbdbab60924acaafd8ce197465c

SHA512
f9bdf7d3569957f39d60fae6996da3491c92203d3f271e0cf832da4bc4c580a8e2fa33a6ccd15ce8e386ab1b1a9414470d31618828b0bd6b63a75f5da03769ad

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\AJ9IGQWS0KFJDS4TB3L8.temp

Filesize
3KB

MD5
5a600e79356a3b26575da10143bef5c6

SHA1
4b1d55a81bb834ee0c6eda961cc6d9c95fc30942

SHA256
d8998283c73ba16cb7dfcfbcd63c2a2751c37e212f7c2b23719b8ec58e087055

SHA512
ed3b0e080cf2805c8e2dd73a35bdc5bd457e8227074299380273819458efe24a34eb32c9d1cde2ade159b45d5f708afa2b12383ab3712ad310d794fa1c9f615a

Download Submit
memory/1016-442-0x0000000000E20000-0x00000000012E8000-memory.dmp

Filesize
4.8MB

Download
memory/1016-445-0x0000000000E20000-0x00000000012E8000-memory.dmp

Filesize
4.8MB

Download
memory/1608-20-0x0000000000B20000-0x0000000000FD6000-memory.dmp

Filesize
4.7MB

Download
memory/1608-31-0x0000000000B20000-0x0000000000FD6000-memory.dmp

Filesize
4.7MB

Download
memory/1608-22-0x0000000000B20000-0x0000000000FD6000-memory.dmp

Filesize
4.7MB

Download
memory/1608-21-0x0000000000B20000-0x0000000000FD6000-memory.dmp

Filesize
4.7MB

Download
memory/1608-19-0x0000000000B20000-0x0000000000FD6000-memory.dmp

Filesize
4.7MB

Download
memory/1608-18-0x0000000000B20000-0x0000000000FD6000-memory.dmp

Filesize
4.7MB

Download
memory/1720-0-0x0000000000FB0000-0x0000000001466000-memory.dmp

Filesize
4.7MB

Download
memory/1720-17-0x0000000000FB0000-0x0000000001466000-memory.dmp

Filesize
4.7MB

Download
memory/1720-4-0x0000000000FB0000-0x0000000001466000-memory.dmp

Filesize
4.7MB

Download
memory/1720-3-0x0000000000FB0000-0x0000000001466000-memory.dmp

Filesize
4.7MB

Download
memory/1720-2-0x0000000000FB1000-0x0000000000FDF000-memory.dmp

Filesize
184KB

Download
memory/1720-1-0x0000000077DD4000-0x0000000077DD6000-memory.dmp

Filesize
8KB

Download
memory/2344-411-0x00000000009A0000-0x0000000000E68000-memory.dmp

Filesize
4.8MB

Download
memory/2344-451-0x00000000009A0000-0x0000000000E68000-memory.dmp

Filesize
4.8MB

Download
memory/2344-464-0x00000000009A0000-0x0000000000E68000-memory.dmp

Filesize
4.8MB

Download
memory/2344-454-0x00000000009A0000-0x0000000000E68000-memory.dmp

Filesize
4.8MB

Download
memory/2344-328-0x00000000009A0000-0x0000000000E68000-memory.dmp

Filesize
4.8MB

Download
memory/2344-296-0x00000000009A0000-0x0000000000E68000-memory.dmp

Filesize
4.8MB

Download
memory/2344-295-0x00000000009A0000-0x0000000000E68000-memory.dmp

Filesize
4.8MB

Download
memory/2344-46-0x00000000009A0000-0x0000000000E68000-memory.dmp

Filesize
4.8MB

Download
memory/2344-450-0x00000000009A0000-0x0000000000E68000-memory.dmp

Filesize
4.8MB

Download
memory/2344-381-0x00000000009A0000-0x0000000000E68000-memory.dmp

Filesize
4.8MB

Download
memory/2344-449-0x00000000009A0000-0x0000000000E68000-memory.dmp

Filesize
4.8MB

Download
memory/2344-400-0x00000000009A0000-0x0000000000E68000-memory.dmp

Filesize
4.8MB

Download
memory/2344-401-0x00000000009A0000-0x0000000000E68000-memory.dmp

Filesize
4.8MB

Download
memory/2344-448-0x00000000009A0000-0x0000000000E68000-memory.dmp

Filesize
4.8MB

Download
memory/2344-421-0x00000000009A0000-0x0000000000E68000-memory.dmp

Filesize
4.8MB

Download
memory/2344-447-0x00000000009A0000-0x0000000000E68000-memory.dmp

Filesize
4.8MB

Download
memory/2888-48-0x0000000000E20000-0x00000000012E8000-memory.dmp

Filesize
4.8MB

Download
memory/2888-34-0x0000000000E20000-0x00000000012E8000-memory.dmp

Filesize
4.8MB

Download
memory/3044-82-0x00000000009A0000-0x0000000001031000-memory.dmp

Filesize
6.6MB

Download
memory/3044-80-0x00000000009A0000-0x0000000001031000-memory.dmp

Filesize
6.6MB

Download
memory/3224-446-0x00000000009A0000-0x0000000000E68000-memory.dmp

Filesize
4.8MB

Download
memory/3728-327-0x00000000009A0000-0x0000000000E68000-memory.dmp

Filesize
4.8MB

Download
memory/4188-459-0x0000000000E20000-0x00000000012E8000-memory.dmp

Filesize
4.8MB

Download
memory/4188-461-0x0000000000E20000-0x00000000012E8000-memory.dmp

Filesize
4.8MB

Download
memory/4516-323-0x0000000000E20000-0x00000000012E8000-memory.dmp

Filesize
4.8MB

Download
memory/4516-325-0x0000000000E20000-0x00000000012E8000-memory.dmp

Filesize
4.8MB

Download
memory/4768-81-0x00000000004D0000-0x0000000000B61000-memory.dmp

Filesize
6.6MB

Download
memory/4768-64-0x00000000004D0000-0x0000000000B61000-memory.dmp

Filesize
6.6MB

Download
memory/5932-460-0x00000000009A0000-0x0000000000E68000-memory.dmp

Filesize
4.8MB

Download
memory/5932-463-0x00000000009A0000-0x0000000000E68000-memory.dmp

Filesize
4.8MB

Download