amadey | fe01449dcb360e0a229cf326071b44910a2aa6357eff82f77af3aec9c3b9e5b6

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/09/2024, 01:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fe01449dcb360e0a229cf326071b44910a2aa6357eff82f77af3aec9c3b9e5b6.exe
Size 1.8MB
Sample240902-bsf18aydpf
SHA256 fe01449dcb360e0a229cf326071b44910a2aa6357eff82f77af3aec9c3b9e5b6
MD5 1e1be607275af8bc71fab2203e02efd5
SHA1 39959642e9e919c88ac7bb870b9c9484a298aa1e
SHA512 1ed45303c6592268f1629dd9f086234bfe5543e488fbed0023859c892633db8d355f45809aaaef659bf4746761e4132a8c47fbce6ee648979cdab3d019297bab
SSDEEP 49152:lp2ivE7Z+VA1Nc4Xppga2vwjRf1CwgnNlm4:lsiGQcS4yvoJg6
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey stealc 0657d1 c7817d leva discovery evasion stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

0657d1

http://185.215.113.19

Attributes

install_dir
0d8f5eb8a7
install_file
explorti.exe
strings_key
6c55a5f34bb433fbd933a168577b1838
url_paths
/Vi9leo/index.php

rc4.plain

Extracted

Family

amadey

Version

4.41

Botnet

c7817d

http://31.41.244.10

Attributes

install_dir
0e8d0864aa
install_file
svoutse.exe
strings_key
5481b88a6ef75bcf21333988a4e47048
url_paths
/Dem7kTu/index.php

rc4.plain

Extracted

Family

stealc

Botnet

leva

http://185.215.113.100

Attributes

url_path
/e2b1563c6670f193.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Stealc
Stealc is an infostealer written in C++.
stealer stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 10 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	f4a8fac6e9.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	fe01449dcb360e0a229cf326071b44910a2aa6357eff82f77af3aec9c3b9e5b6.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	svoutse.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	svoutse.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	6a7f37ee0e.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	svoutse.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 20 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	6a7f37ee0e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	fe01449dcb360e0a229cf326071b44910a2aa6357eff82f77af3aec9c3b9e5b6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	f4a8fac6e9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	6a7f37ee0e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	fe01449dcb360e0a229cf326071b44910a2aa6357eff82f77af3aec9c3b9e5b6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	f4a8fac6e9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	explorti.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	explorti.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	svoutse.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	fe01449dcb360e0a229cf326071b44910a2aa6357eff82f77af3aec9c3b9e5b6.exe

Executes dropped EXE 10 IoCs

pid	Process
2120	explorti.exe
1852	explorti.exe
1716	svoutse.exe
2256	6a7f37ee0e.exe
3244	f4a8fac6e9.exe
2704	2a15a392a3.exe
5896	svoutse.exe
5924	explorti.exe
5004	svoutse.exe
5352	explorti.exe

Identifies Wine through registry keys 2 TTPs 10 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Wine	fe01449dcb360e0a229cf326071b44910a2aa6357eff82f77af3aec9c3b9e5b6.exe
Key opened	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Wine	svoutse.exe
Key opened	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Wine	f4a8fac6e9.exe
Key opened	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Wine	svoutse.exe
Key opened	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Wine	6a7f37ee0e.exe
Key opened	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Wine	svoutse.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x0007000000023487-90.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 10 IoCs

pid	Process
456	fe01449dcb360e0a229cf326071b44910a2aa6357eff82f77af3aec9c3b9e5b6.exe
2120	explorti.exe
1852	explorti.exe
1716	svoutse.exe
2256	6a7f37ee0e.exe
3244	f4a8fac6e9.exe
5896	svoutse.exe
5924	explorti.exe
5352	explorti.exe
5004	svoutse.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explorti.job	fe01449dcb360e0a229cf326071b44910a2aa6357eff82f77af3aec9c3b9e5b6.exe
File created	C:\Windows\Tasks\svoutse.job	explorti.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorti.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorti.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svoutse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f4a8fac6e9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fe01449dcb360e0a229cf326071b44910a2aa6357eff82f77af3aec9c3b9e5b6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6a7f37ee0e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2a15a392a3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2216	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
4680	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
456	fe01449dcb360e0a229cf326071b44910a2aa6357eff82f77af3aec9c3b9e5b6.exe
456	fe01449dcb360e0a229cf326071b44910a2aa6357eff82f77af3aec9c3b9e5b6.exe
2120	explorti.exe
2120	explorti.exe
1852	explorti.exe
1852	explorti.exe
1716	svoutse.exe
1716	svoutse.exe
2256	6a7f37ee0e.exe
2256	6a7f37ee0e.exe
3244	f4a8fac6e9.exe
3244	f4a8fac6e9.exe
2332	msedge.exe
2332	msedge.exe
3832	msedge.exe
3832	msedge.exe
4676	identity_helper.exe
4676	identity_helper.exe
5896	svoutse.exe
5896	svoutse.exe
5924	explorti.exe
5924	explorti.exe
5352	explorti.exe
5352	explorti.exe
5004	svoutse.exe
5004	svoutse.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2704	2a15a392a3.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 31 IoCs

pid	Process
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4680	taskkill.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
456	fe01449dcb360e0a229cf326071b44910a2aa6357eff82f77af3aec9c3b9e5b6.exe
1852	explorti.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
3832	msedge.exe
3832	msedge.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
3832	msedge.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe
2704	2a15a392a3.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 456 wrote to memory of 2120	456	fe01449dcb360e0a229cf326071b44910a2aa6357eff82f77af3aec9c3b9e5b6.exe	88
PID 456 wrote to memory of 2120	456	fe01449dcb360e0a229cf326071b44910a2aa6357eff82f77af3aec9c3b9e5b6.exe	88
PID 456 wrote to memory of 2120	456	fe01449dcb360e0a229cf326071b44910a2aa6357eff82f77af3aec9c3b9e5b6.exe	88
PID 2120 wrote to memory of 3472	2120	explorti.exe	92
PID 2120 wrote to memory of 3472	2120	explorti.exe	92
PID 2120 wrote to memory of 3472	2120	explorti.exe	92
PID 3472 wrote to memory of 4680	3472	cmd.exe	95
PID 3472 wrote to memory of 4680	3472	cmd.exe	95
PID 3472 wrote to memory of 4680	3472	cmd.exe	95
PID 3472 wrote to memory of 2216	3472	cmd.exe	97
PID 3472 wrote to memory of 2216	3472	cmd.exe	97
PID 3472 wrote to memory of 2216	3472	cmd.exe	97
PID 3472 wrote to memory of 1852	3472	cmd.exe	98
PID 3472 wrote to memory of 1852	3472	cmd.exe	98
PID 3472 wrote to memory of 1852	3472	cmd.exe	98
PID 1852 wrote to memory of 1716	1852	explorti.exe	99
PID 1852 wrote to memory of 1716	1852	explorti.exe	99
PID 1852 wrote to memory of 1716	1852	explorti.exe	99
PID 1716 wrote to memory of 2256	1716	svoutse.exe	101
PID 1716 wrote to memory of 2256	1716	svoutse.exe	101
PID 1716 wrote to memory of 2256	1716	svoutse.exe	101
PID 1716 wrote to memory of 3244	1716	svoutse.exe	102
PID 1716 wrote to memory of 3244	1716	svoutse.exe	102
PID 1716 wrote to memory of 3244	1716	svoutse.exe	102
PID 1716 wrote to memory of 2704	1716	svoutse.exe	105
PID 1716 wrote to memory of 2704	1716	svoutse.exe	105
PID 1716 wrote to memory of 2704	1716	svoutse.exe	105
PID 2704 wrote to memory of 3832	2704	2a15a392a3.exe	106
PID 2704 wrote to memory of 3832	2704	2a15a392a3.exe	106
PID 3832 wrote to memory of 5104	3832	msedge.exe	107
PID 3832 wrote to memory of 5104	3832	msedge.exe	107
PID 3832 wrote to memory of 3168	3832	msedge.exe	108
PID 3832 wrote to memory of 3168	3832	msedge.exe	108
PID 3832 wrote to memory of 3168	3832	msedge.exe	108
PID 3832 wrote to memory of 3168	3832	msedge.exe	108
PID 3832 wrote to memory of 3168	3832	msedge.exe	108
PID 3832 wrote to memory of 3168	3832	msedge.exe	108
PID 3832 wrote to memory of 3168	3832	msedge.exe	108
PID 3832 wrote to memory of 3168	3832	msedge.exe	108
PID 3832 wrote to memory of 3168	3832	msedge.exe	108
PID 3832 wrote to memory of 3168	3832	msedge.exe	108
PID 3832 wrote to memory of 3168	3832	msedge.exe	108
PID 3832 wrote to memory of 3168	3832	msedge.exe	108
PID 3832 wrote to memory of 3168	3832	msedge.exe	108
PID 3832 wrote to memory of 3168	3832	msedge.exe	108
PID 3832 wrote to memory of 3168	3832	msedge.exe	108
PID 3832 wrote to memory of 3168	3832	msedge.exe	108
PID 3832 wrote to memory of 3168	3832	msedge.exe	108
PID 3832 wrote to memory of 3168	3832	msedge.exe	108
PID 3832 wrote to memory of 3168	3832	msedge.exe	108
PID 3832 wrote to memory of 3168	3832	msedge.exe	108
PID 3832 wrote to memory of 3168	3832	msedge.exe	108
PID 3832 wrote to memory of 3168	3832	msedge.exe	108
PID 3832 wrote to memory of 3168	3832	msedge.exe	108
PID 3832 wrote to memory of 3168	3832	msedge.exe	108
PID 3832 wrote to memory of 3168	3832	msedge.exe	108
PID 3832 wrote to memory of 3168	3832	msedge.exe	108
PID 3832 wrote to memory of 3168	3832	msedge.exe	108
PID 3832 wrote to memory of 3168	3832	msedge.exe	108
PID 3832 wrote to memory of 3168	3832	msedge.exe	108
PID 3832 wrote to memory of 3168	3832	msedge.exe	108
PID 3832 wrote to memory of 3168	3832	msedge.exe	108
PID 3832 wrote to memory of 3168	3832	msedge.exe	108
PID 3832 wrote to memory of 3168	3832	msedge.exe	108

C:\Users\Admin\AppData\Local\Temp\fe01449dcb360e0a229cf326071b44910a2aa6357eff82f77af3aec9c3b9e5b6.exe
"C:\Users\Admin\AppData\Local\Temp\fe01449dcb360e0a229cf326071b44910a2aa6357eff82f77af3aec9c3b9e5b6.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:456
- C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
  "C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Checks computer location settings
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2120
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k "taskkill /f /im "explorti.exe" && timeout 1 && del "explorti.exe" && ren 0657d1 explorti.exe && C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe && Exit"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3472
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im "explorti.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4680
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 1
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:2216
  - - C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
      C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Checks computer location settings
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:1852
    - - C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Checks computer location settings
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1716
      - C:\Users\Admin\AppData\Roaming\1000026000\6a7f37ee0e.exe
        
        "C:\Users\Admin\AppData\Roaming\1000026000\6a7f37ee0e.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2256
      - C:\Users\Admin\AppData\Roaming\1000027000\f4a8fac6e9.exe
        
        "C:\Users\Admin\AppData\Roaming\1000027000\f4a8fac6e9.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3244
      - C:\Users\Admin\AppData\Local\Temp\1000028001\2a15a392a3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000028001\2a15a392a3.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2704
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
        7⤵
        Enumerates system info in registry
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:3832
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffce4c46f8,0x7fffce4c4708,0x7fffce4c4718
        8⤵
        
        PID:5104
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,4890053649277074784,15102040308612635200,131072 --disable-features=TranslateUI --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
        8⤵
        
        PID:3168
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,4890053649277074784,15102040308612635200,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2332
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,4890053649277074784,15102040308612635200,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
        8⤵
        
        PID:4720
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4890053649277074784,15102040308612635200,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
        8⤵
        
        PID:684
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4890053649277074784,15102040308612635200,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
        8⤵
        
        PID:3196
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4890053649277074784,15102040308612635200,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3880 /prefetch:1
        8⤵
        
        PID:4380
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4890053649277074784,15102040308612635200,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3896 /prefetch:1
        8⤵
        
        PID:548
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4890053649277074784,15102040308612635200,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4160 /prefetch:1
        8⤵
        
        PID:1692
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4890053649277074784,15102040308612635200,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3780 /prefetch:1
        8⤵
        
        PID:2932
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4890053649277074784,15102040308612635200,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4468 /prefetch:1
        8⤵
        
        PID:3104
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4890053649277074784,15102040308612635200,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4480 /prefetch:1
        8⤵
        
        PID:3244
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4890053649277074784,15102040308612635200,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4476 /prefetch:1
        8⤵
        
        PID:3872
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4890053649277074784,15102040308612635200,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:1
        8⤵
        
        PID:1452
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4890053649277074784,15102040308612635200,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
        8⤵
        
        PID:2092
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4890053649277074784,15102040308612635200,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:1
        8⤵
        
        PID:3280
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4890053649277074784,15102040308612635200,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
        8⤵
        
        PID:5232
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4890053649277074784,15102040308612635200,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
        8⤵
        
        PID:5244
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4890053649277074784,15102040308612635200,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4484 /prefetch:1
        8⤵
        
        PID:5328
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4890053649277074784,15102040308612635200,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:1
        8⤵
        
        PID:5336
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4890053649277074784,15102040308612635200,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
        8⤵
        
        PID:5344
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4890053649277074784,15102040308612635200,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5908 /prefetch:1
        8⤵
        
        PID:5352
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4890053649277074784,15102040308612635200,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1
        8⤵
        
        PID:5360
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4890053649277074784,15102040308612635200,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6164 /prefetch:1
        8⤵
        
        PID:5368
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4890053649277074784,15102040308612635200,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6416 /prefetch:1
        8⤵
        
        PID:5628
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4890053649277074784,15102040308612635200,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7156 /prefetch:1
        8⤵
        
        PID:5716
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4890053649277074784,15102040308612635200,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7188 /prefetch:1
        8⤵
        
        PID:5724
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4890053649277074784,15102040308612635200,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7436 /prefetch:1
        8⤵
        
        PID:5736
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4890053649277074784,15102040308612635200,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:1
        8⤵
        
        PID:5744
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4890053649277074784,15102040308612635200,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7592 /prefetch:1
        8⤵
        
        PID:5752
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4890053649277074784,15102040308612635200,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7176 /prefetch:1
        8⤵
        
        PID:5952
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4890053649277074784,15102040308612635200,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
        8⤵
        
        PID:6072
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4890053649277074784,15102040308612635200,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7940 /prefetch:1
        8⤵
        
        PID:4992
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4890053649277074784,15102040308612635200,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8040 /prefetch:1
        8⤵
        
        PID:2588
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4890053649277074784,15102040308612635200,131072 --disable-features=TranslateUI --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8080 /prefetch:1
        8⤵
        
        PID:4168
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,4890053649277074784,15102040308612635200,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4292 /prefetch:8
        8⤵
        
        PID:756
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,4890053649277074784,15102040308612635200,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4292 /prefetch:8
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4676
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,4890053649277074784,15102040308612635200,131072 --disable-features=TranslateUI --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=8256 /prefetch:2
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3092

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4952

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3460

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5896

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5924

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5004

C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4ae06e24-c1f2-4445-9ef7-215afde1854d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\4ae06e24-c1f2-4445-9ef7-215afde1854d.tmp
Size 9KB
SHA256 d7d864635b92a8cd774e27eb2f8651252f54a29067860f786593967c2f0e0405
MD5 a76bcaf05281751e5089a364f2442ade
SHA1 6d44a654ddcd7f218b9fb0f2bf18396ffee655a7
SHA512 97a523ecbf8c484988d2dc0eced89b11ef25d73445f6785eacd1a80b5eb5a72eb7e08a5b0194740e29a37eb16e42a9527ba1af32048a7d8594ae45a7cd65943f
SSDEEP 192:RoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupTzbzeMRUQaqSBRw5Ytj9Zb:N9iIxuERzA83h09RZxYDXu6kLseB
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat
Size 152B
SHA256 dffeb716b8ff1c71adee18049e30cc386271f9fd1c7e0336bc2da56e04913405
MD5 22f5bc25b05b5bdc00ef29cd59b8b7a4
SHA1 47aab5802ce9385873607d72404023c21eeb2739
SHA512 02052ed647de2c604819ab2a39cc1f948cad589e95989fcf9c14126f5754ea020a60472ecf07076449512c46bc1436a151b79379aef6093c18f6ee3bf7d3827c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat
Size 152B
SHA256 77e5a92215abea7066a98da82737d31f69f1291f2d7d20ff8e099770065e55cd
MD5 80c95e30452ff8a15c50cdf7d87dfd4d
SHA1 3dd633bc438555ab0bc560fa1d269e4fcb38b86a
SHA512 ef07c105f262884ec8c95753a00bad5f53ccc81a68c453d66fff066443900abbedf0af9dc695c646eb4b3f04da3df612f102a09e2c1c3aeaf72cff7258b893d5
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat
Size 152B
SHA256 13af44e771412fc1df32767e36ab1f9c5672cea1186ca4a7b171bd332ef5f90b
MD5 a332a6763fe34f3949e61d05e9bf6e93
SHA1 7fb68c3227b832aed8c4efc4a14d19c33e943dc8
SHA512 dbf8f0e9d02527bc2471c5a4595c79efd4ce0e04ff3eeb115b3b846e73e8cc4fbe2386ead1be70b8ed4b8134adb9f95a2f2856afe875c23c3ab37b11f379b43c
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

0f9d390c-a9b6-48a4-82c8-d0cce0db10b1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\0f9d390c-a9b6-48a4-82c8-d0cce0db10b1.tmp
Size 4KB
SHA256 d329e22610da2745566cdd9b043c966b19a5c419acf663bb446fff2807f07ba6
MD5 4055528a0b6b8f375bc8e1b8dabec46a
SHA1 f361af9baaec68edc83f9ed1438630ab3cd95806
SHA512 7ddb82787c99d9fe3fe8744f0ea6bd58dbcb1d1b7b070c2e2ef611e2759fd86ac18aeb08f750b2fe69d8ff2559f9f2cc53bb04a6c7c61c619e937b1ef6adc4c7
SSDEEP 96:n1BUm1Ht4spvWMoiVmdeHhJhUBKVDCzia:n1np1WMXVY3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft Edge.lnk

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Microsoft Edge.lnk
Size 1KB
SHA256 4659e81a41417a4ff3fe0206a4eac589fb7f4515058588a45be4e87f8b1f6f01
MD5 b254a6f83ecde15a99887796c33e8d18
SHA1 00d571a024abb42bdf709937ca00f4feed6c6c4a
SHA512 af5d47b857b99d5bc7eb580255d9d50d7b041ceb6b4fd86fe1417515e12319370e90678c24aa4965d3b1a7d57cffad32944d8c1ce4695889c8dbd8f302ca322e
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences
Size 4KB
SHA256 a68fa152c1b258a34002d7808dac186e299c1a5b818211a385ba90597c9df062
MD5 3b57f3f6d4e86fedafa1559443edb862
SHA1 ab3c42db2c14324eafd0cd2dfcdbd4e7d5690b69
SHA512 7c8fc66eacf0e9135a117cc22a483c803546bf4ca79c272ebe247d734e47a4b38389623df37fc6a669bb8c2d3388c73fbd8cd552357d1625d6d64cb59a3a8332
SSDEEP 96:n1yUk1Ht4spvWMoiVmdeHhJhUBKVD7AiEwb:n1Wp1WMXVYE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences
Size 4KB
SHA256 dc4ffc05cd8eb64936847e605bc0360e7c7cf7a5ee0f93cd925678914fa7ae7d
MD5 07bb0e566cf41e2fe7b12d9bf5f2cc14
SHA1 773c615307439feea9c450f5922908d7a5745a0f
SHA512 73af261f6d553d81218047f3b8ea5707ae5f141248227df9897d3e6294b0fe47601fcb972115800dd393b354c0d093da2562235817762e27175fd76ffa0b336c
SSDEEP 96:n1yUk1Ht4spvWMoiVmdeHhEKshUBKVD7AiEwb:n1Wp1WMXWYE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences
Size 24KB
SHA256 5c8f6d10132a908a8d415e3a446b963ae3ceb4e74f731bd42c7f4e9118481787
MD5 861901c9cc6a4054cea29b39c25fe848
SHA1 fd2ca5f98b9d856d0536238edde24ad22106b39b
SHA512 f1ded1eb43b553a70e94be532ed3b619c3c3bcac49904e522bbdbda532c5c308db0f31725282d93239d6848834f3ce497892fd88ad7db3613c3495febd0e26ab
SSDEEP 768:nNaW148F1+UoAYDCx9Tuqh0VfUC9xbog/OV0LlcurU22:nNaW14u1ja3LS22
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences~RFe583ae1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences~RFe583ae1.TMP
Size 24KB
SHA256 c2d7644d0a6cfec93ea4da0d52022777011f911f15e8a1748f8037d648a587cc
MD5 f29c1e87aaea84f8c5216bba76527d7b
SHA1 7c8ba9c3ce22ff3add8ab1ffda8f4b51eedba57c
SHA512 e1fde8f90a49943364f6cc1f5393203aee600b7ebe97c63956dbb7bfb7fb3c1450d5a0dcf5d8a7eb52282ab3ae505d27804f2b3390b9f39cd87a1e754a90a9b0
SSDEEP 768:FaWiC8F1+UoAYDCx9Tuqh0VfUC9xbog/OVQLlcErU2eT:FaWiCu1jaJLu2G
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

0657d1

Path C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\0657d1
Size 1.8MB
SHA256 0cce55a6fec4dbf3581208ef779f877ff43ecbaa27d2f2119d6552d06b684493
MD5 5a4f2d577db2373f79eb9d16f8037af4
SHA1 ed08c149b8992e508e7382b0a19e6685eb9caf5e
SHA512 ec8bec4bf9433e4fd41e3a4b74e7bb1b8dbf46e15ab528e4feed51750e3c9e43ed59fcbc12982fc36bd50172a752325b192dfc65195f7118c47f1e7c2d24eccb
SSDEEP 49152:R7wbCfJnoVxG8rdz1iuf4ri4pmy/Yr8rxXm:RFfJoVxGmdZiFrzdyyxXm
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorti.exe

Path C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Size 1.8MB
SHA256 fe01449dcb360e0a229cf326071b44910a2aa6357eff82f77af3aec9c3b9e5b6
MD5 1e1be607275af8bc71fab2203e02efd5
SHA1 39959642e9e919c88ac7bb870b9c9484a298aa1e
SHA512 1ed45303c6592268f1629dd9f086234bfe5543e488fbed0023859c892633db8d355f45809aaaef659bf4746761e4132a8c47fbce6ee648979cdab3d019297bab
SSDEEP 49152:lp2ivE7Z+VA1Nc4Xppga2vwjRf1CwgnNlm4:lsiGQcS4yvoJg6
MD5 SHA1 SHA512 SSDEEP

Submit Download

2a15a392a3.exe

Path C:\Users\Admin\AppData\Local\Temp\1000028001\2a15a392a3.exe
Size 896KB
SHA256 1cf0747ce1310fd989b24a93d2108784efb003948fdec1f7e64479213075cb90
MD5 f0356008c23a76acfc263b5c3e2180cb
SHA1 2ed3657f3ee94a5cc0cf6b8b30a1334a9311baa2
SHA512 67efa62082d20bef10318cb2a46391219ee377138b50e5d05fdf2f8945092d1b9401e7cce6f3ccbdfe26f800e896d5e634c5fe41260cca4c0d3055b21c2bdf2a
SSDEEP 12288:vqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgacTy:vqDEvCTbMWu7rQYlBQcBiT6rprG8asy
MD5 SHA1 SHA512 SSDEEP

Submit Download

6a7f37ee0e.exe

Path C:\Users\Admin\AppData\Roaming\1000026000\6a7f37ee0e.exe
Size 1.7MB
SHA256 83ebffd7d12fabe2f1bf465425e0883ff62d4bbdbab60924acaafd8ce197465c
MD5 538ef8d8696f1a9f1388a615ed4cf361
SHA1 280a7c4edc18e0c5e836d02d78f6bfbafe15c5bc
SHA512 f9bdf7d3569957f39d60fae6996da3491c92203d3f271e0cf832da4bc4c580a8e2fa33a6ccd15ce8e386ab1b1a9414470d31618828b0bd6b63a75f5da03769ad
SSDEEP 49152:Kmgy8lNBFQ1xx70XhuHiWpPlg9hrtxIQ:Pp8l61T0RuHP29FIQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

3E8YF2ZOSSUBYM0U8LNM.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\3E8YF2ZOSSUBYM0U8LNM.temp
Size 3KB
SHA256 4f5c03d8b5c51a0a22914503fa8bc97df94d18324e87c4725cff1b5fb66d08bc
MD5 5f4e40c1dadd953f68bb7031f1254dd2
SHA1 56c0e671a38147b0e3c6b21fe79a74ad1e7551a7
SHA512 94dec1207dae7733c7a8b6a7b4fa433ad3baf3503c680cdcd33b8af357e897eb01029115e747fe68101aa089f30f716a83661d1379ed62f326609459cf2253a9
MD5 SHA1 SHA512

Submit Download

memory/456-4-0x0000000000A80000-0x0000000000F2C000-memory.dmp

Download

memory/456-3-0x0000000000A80000-0x0000000000F2C000-memory.dmp

Download

memory/456-2-0x0000000000A81000-0x0000000000AAF000-memory.dmp

Download

memory/456-17-0x0000000000A80000-0x0000000000F2C000-memory.dmp

Download

memory/456-0-0x0000000000A80000-0x0000000000F2C000-memory.dmp

Download

memory/456-1-0x00000000774A4000-0x00000000774A6000-memory.dmp

Download

memory/1716-47-0x0000000000BD0000-0x0000000001098000-memory.dmp

Download

memory/1716-439-0x0000000000BD0000-0x0000000001098000-memory.dmp

Download

memory/1716-456-0x0000000000BD0000-0x0000000001098000-memory.dmp

Download

memory/1716-453-0x0000000000BD0000-0x0000000001098000-memory.dmp

Download

memory/1716-293-0x0000000000BD0000-0x0000000001098000-memory.dmp

Download

memory/1716-294-0x0000000000BD0000-0x0000000001098000-memory.dmp

Download

memory/1716-450-0x0000000000BD0000-0x0000000001098000-memory.dmp

Download

memory/1716-449-0x0000000000BD0000-0x0000000001098000-memory.dmp

Download

memory/1716-448-0x0000000000BD0000-0x0000000001098000-memory.dmp

Download

memory/1716-319-0x0000000000BD0000-0x0000000001098000-memory.dmp

Download

memory/1716-440-0x0000000000BD0000-0x0000000001098000-memory.dmp

Download

memory/1716-420-0x0000000000BD0000-0x0000000001098000-memory.dmp

Download

memory/1716-410-0x0000000000BD0000-0x0000000001098000-memory.dmp

Download

memory/1716-400-0x0000000000BD0000-0x0000000001098000-memory.dmp

Download

memory/1716-372-0x0000000000BD0000-0x0000000001098000-memory.dmp

Download

memory/1716-399-0x0000000000BD0000-0x0000000001098000-memory.dmp

Download

memory/1852-35-0x0000000000CB0000-0x0000000001178000-memory.dmp

Download

memory/1852-49-0x0000000000CB0000-0x0000000001178000-memory.dmp

Download

memory/2120-20-0x0000000000E20000-0x00000000012CC000-memory.dmp

Download

memory/2120-19-0x0000000000E21000-0x0000000000E4F000-memory.dmp

Download

memory/2120-21-0x0000000000E20000-0x00000000012CC000-memory.dmp

Download

memory/2120-22-0x0000000000E20000-0x00000000012CC000-memory.dmp

Download

memory/2120-18-0x0000000000E20000-0x00000000012CC000-memory.dmp

Download

memory/2120-32-0x0000000000E20000-0x00000000012CC000-memory.dmp

Download

memory/2256-83-0x0000000000A60000-0x00000000010F1000-memory.dmp

Download

memory/2256-65-0x0000000000A60000-0x00000000010F1000-memory.dmp

Download

memory/3244-84-0x0000000000DB0000-0x0000000001441000-memory.dmp

Download

memory/3244-81-0x0000000000DB0000-0x0000000001441000-memory.dmp

Download

memory/5004-447-0x0000000000BD0000-0x0000000001098000-memory.dmp

Download

memory/5004-443-0x0000000000BD0000-0x0000000001098000-memory.dmp

Download

memory/5352-444-0x0000000000CB0000-0x0000000001178000-memory.dmp

Download

memory/5352-446-0x0000000000CB0000-0x0000000001178000-memory.dmp

Download

memory/5896-397-0x0000000000BD0000-0x0000000001098000-memory.dmp

Download

memory/5896-393-0x0000000000BD0000-0x0000000001098000-memory.dmp

Download

memory/5924-398-0x0000000000CB0000-0x0000000001178000-memory.dmp

Download

memory/5924-394-0x0000000000CB0000-0x0000000001178000-memory.dmp

Download