amadey | c90f522fd205ecf056e5827cbfdd49f37531238d65ae9b59251d2799a66e65cc

Analysis

max time kernel
147s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
06/09/2024, 22:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c90f522fd205ecf056e5827cbfdd49f37531238d65ae9b59251d2799a66e65cc.exe
Size 1.8MB
Sample240906-19s5js1bmp
SHA256 c90f522fd205ecf056e5827cbfdd49f37531238d65ae9b59251d2799a66e65cc
MD5 a505a4a411e6ba94c4b9c636169c0f03
SHA1 e62f25f90925dda82936c3b2214c83744726003a
SHA512 7e1d2e7bb00b9f98bb1a3307c0de13a88e667dce8e6749dc2542208bc1a4a8a9df7d025c943e4702afdf23949dd6074ec15e703e15233445e221f84d5c5c64cc
SSDEEP 49152:CEaVZEBBSrmmBB6Nx2WuHsiq1ARtdDeeIy3:vaV7r7G29qO
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey stealc c7817d leva discovery evasion execution persistence stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

c7817d

http://31.41.244.10

Attributes

install_dir
0e8d0864aa
install_file
svoutse.exe
strings_key
5481b88a6ef75bcf21333988a4e47048
url_paths
/Dem7kTu/index.php

rc4.plain

Extracted

Family

stealc

Botnet

leva

http://185.215.113.100

Attributes

url_path
/e2b1563c6670f193.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Stealc
Stealc is an infostealer written in C++.
stealer stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	svoutse.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	45591808a5.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	4233e321ca.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	svoutse.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	svoutse.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	c90f522fd205ecf056e5827cbfdd49f37531238d65ae9b59251d2799a66e65cc.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 12 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	c90f522fd205ecf056e5827cbfdd49f37531238d65ae9b59251d2799a66e65cc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	4233e321ca.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	c90f522fd205ecf056e5827cbfdd49f37531238d65ae9b59251d2799a66e65cc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	45591808a5.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	45591808a5.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	4233e321ca.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svoutse.exe

Executes dropped EXE 5 IoCs

pid	Process
4812	svoutse.exe
1608	45591808a5.exe
3112	4233e321ca.exe
4576	svoutse.exe
1560	svoutse.exe

Identifies Wine through registry keys 2 TTPs 6 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Wine	svoutse.exe
Key opened	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Wine	c90f522fd205ecf056e5827cbfdd49f37531238d65ae9b59251d2799a66e65cc.exe
Key opened	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Wine	svoutse.exe
Key opened	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Wine	45591808a5.exe
Key opened	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Wine	4233e321ca.exe
Key opened	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Wine	svoutse.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows\CurrentVersion\Run\4233e321ca.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000030001\\4233e321ca.exe"	svoutse.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

pid	Process
2156	c90f522fd205ecf056e5827cbfdd49f37531238d65ae9b59251d2799a66e65cc.exe
4812	svoutse.exe
1608	45591808a5.exe
3112	4233e321ca.exe
4576	svoutse.exe
1560	svoutse.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\svoutse.job	c90f522fd205ecf056e5827cbfdd49f37531238d65ae9b59251d2799a66e65cc.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2000	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c90f522fd205ecf056e5827cbfdd49f37531238d65ae9b59251d2799a66e65cc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svoutse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	45591808a5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4233e321ca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
2156	c90f522fd205ecf056e5827cbfdd49f37531238d65ae9b59251d2799a66e65cc.exe
2156	c90f522fd205ecf056e5827cbfdd49f37531238d65ae9b59251d2799a66e65cc.exe
4812	svoutse.exe
4812	svoutse.exe
1608	45591808a5.exe
1608	45591808a5.exe
3112	4233e321ca.exe
3112	4233e321ca.exe
2000	powershell.exe
2000	powershell.exe
2064	msedge.exe
2064	msedge.exe
3024	msedge.exe
3024	msedge.exe
4576	msedge.exe
4576	msedge.exe
1952	identity_helper.exe
1952	identity_helper.exe
4576	svoutse.exe
4576	svoutse.exe
1560	svoutse.exe
1560	svoutse.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2000	powershell.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2156	c90f522fd205ecf056e5827cbfdd49f37531238d65ae9b59251d2799a66e65cc.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 4812	2156	c90f522fd205ecf056e5827cbfdd49f37531238d65ae9b59251d2799a66e65cc.exe	79
PID 2156 wrote to memory of 4812	2156	c90f522fd205ecf056e5827cbfdd49f37531238d65ae9b59251d2799a66e65cc.exe	79
PID 2156 wrote to memory of 4812	2156	c90f522fd205ecf056e5827cbfdd49f37531238d65ae9b59251d2799a66e65cc.exe	79
PID 4812 wrote to memory of 1608	4812	svoutse.exe	80
PID 4812 wrote to memory of 1608	4812	svoutse.exe	80
PID 4812 wrote to memory of 1608	4812	svoutse.exe	80
PID 4812 wrote to memory of 3112	4812	svoutse.exe	81
PID 4812 wrote to memory of 3112	4812	svoutse.exe	81
PID 4812 wrote to memory of 3112	4812	svoutse.exe	81
PID 4812 wrote to memory of 2000	4812	svoutse.exe	82
PID 4812 wrote to memory of 2000	4812	svoutse.exe	82
PID 4812 wrote to memory of 2000	4812	svoutse.exe	82
PID 2000 wrote to memory of 3024	2000	powershell.exe	84
PID 2000 wrote to memory of 3024	2000	powershell.exe	84
PID 3024 wrote to memory of 2488	3024	msedge.exe	85
PID 3024 wrote to memory of 2488	3024	msedge.exe	85
PID 3024 wrote to memory of 2336	3024	msedge.exe	86
PID 3024 wrote to memory of 2336	3024	msedge.exe	86
PID 3024 wrote to memory of 2336	3024	msedge.exe	86
PID 3024 wrote to memory of 2336	3024	msedge.exe	86
PID 3024 wrote to memory of 2336	3024	msedge.exe	86
PID 3024 wrote to memory of 2336	3024	msedge.exe	86
PID 3024 wrote to memory of 2336	3024	msedge.exe	86
PID 3024 wrote to memory of 2336	3024	msedge.exe	86
PID 3024 wrote to memory of 2336	3024	msedge.exe	86
PID 3024 wrote to memory of 2336	3024	msedge.exe	86
PID 3024 wrote to memory of 2336	3024	msedge.exe	86
PID 3024 wrote to memory of 2336	3024	msedge.exe	86
PID 3024 wrote to memory of 2336	3024	msedge.exe	86
PID 3024 wrote to memory of 2336	3024	msedge.exe	86
PID 3024 wrote to memory of 2336	3024	msedge.exe	86
PID 3024 wrote to memory of 2336	3024	msedge.exe	86
PID 3024 wrote to memory of 2336	3024	msedge.exe	86
PID 3024 wrote to memory of 2336	3024	msedge.exe	86
PID 3024 wrote to memory of 2336	3024	msedge.exe	86
PID 3024 wrote to memory of 2336	3024	msedge.exe	86
PID 3024 wrote to memory of 2336	3024	msedge.exe	86
PID 3024 wrote to memory of 2336	3024	msedge.exe	86
PID 3024 wrote to memory of 2336	3024	msedge.exe	86
PID 3024 wrote to memory of 2336	3024	msedge.exe	86
PID 3024 wrote to memory of 2336	3024	msedge.exe	86
PID 3024 wrote to memory of 2336	3024	msedge.exe	86
PID 3024 wrote to memory of 2336	3024	msedge.exe	86
PID 3024 wrote to memory of 2336	3024	msedge.exe	86
PID 3024 wrote to memory of 2336	3024	msedge.exe	86
PID 3024 wrote to memory of 2336	3024	msedge.exe	86
PID 3024 wrote to memory of 2336	3024	msedge.exe	86
PID 3024 wrote to memory of 2336	3024	msedge.exe	86
PID 3024 wrote to memory of 2336	3024	msedge.exe	86
PID 3024 wrote to memory of 2336	3024	msedge.exe	86
PID 3024 wrote to memory of 2336	3024	msedge.exe	86
PID 3024 wrote to memory of 2336	3024	msedge.exe	86
PID 3024 wrote to memory of 2336	3024	msedge.exe	86
PID 3024 wrote to memory of 2336	3024	msedge.exe	86
PID 3024 wrote to memory of 2336	3024	msedge.exe	86
PID 3024 wrote to memory of 2336	3024	msedge.exe	86
PID 3024 wrote to memory of 2064	3024	msedge.exe	87
PID 3024 wrote to memory of 2064	3024	msedge.exe	87
PID 3024 wrote to memory of 2424	3024	msedge.exe	88
PID 3024 wrote to memory of 2424	3024	msedge.exe	88
PID 3024 wrote to memory of 2424	3024	msedge.exe	88
PID 3024 wrote to memory of 2424	3024	msedge.exe	88
PID 3024 wrote to memory of 2424	3024	msedge.exe	88
PID 3024 wrote to memory of 2424	3024	msedge.exe	88

C:\Users\Admin\AppData\Local\Temp\c90f522fd205ecf056e5827cbfdd49f37531238d65ae9b59251d2799a66e65cc.exe
"C:\Users\Admin\AppData\Local\Temp\c90f522fd205ecf056e5827cbfdd49f37531238d65ae9b59251d2799a66e65cc.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
  "C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4812
- - C:\Users\Admin\AppData\Roaming\1000026000\45591808a5.exe
    "C:\Users\Admin\AppData\Roaming\1000026000\45591808a5.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1608
- - C:\Users\Admin\AppData\Local\Temp\1000030001\4233e321ca.exe
    "C:\Users\Admin\AppData\Local\Temp\1000030001\4233e321ca.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3112
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\AppData\Local\Temp\1000031041\do.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
      4⤵
      Enumerates system info in registry
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:3024
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffeb1333cb8,0x7ffeb1333cc8,0x7ffeb1333cd8
        5⤵
        
        PID:2488
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,9172564921723486643,16883913664657134991,131072 --disable-features=TranslateUI --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1732 /prefetch:2
        5⤵
        
        PID:2336
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1916,9172564921723486643,16883913664657134991,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2064
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1916,9172564921723486643,16883913664657134991,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2656 /prefetch:8
        5⤵
        
        PID:2424
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,9172564921723486643,16883913664657134991,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
        5⤵
        
        PID:2484
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,9172564921723486643,16883913664657134991,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
        5⤵
        
        PID:1588
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,9172564921723486643,16883913664657134991,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3824 /prefetch:1
        5⤵
        
        PID:2928
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,9172564921723486643,16883913664657134991,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3964 /prefetch:1
        5⤵
        
        PID:1344
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,9172564921723486643,16883913664657134991,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4152 /prefetch:1
        5⤵
        
        PID:2504
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,9172564921723486643,16883913664657134991,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4288 /prefetch:1
        5⤵
        
        PID:844
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,9172564921723486643,16883913664657134991,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4420 /prefetch:1
        5⤵
        
        PID:2368
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,9172564921723486643,16883913664657134991,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4568 /prefetch:1
        5⤵
        
        PID:3428
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1916,9172564921723486643,16883913664657134991,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6284 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4576
    - - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1916,9172564921723486643,16883913664657134991,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7584 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1952
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,9172564921723486643,16883913664657134991,131072 --disable-features=TranslateUI --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2812 /prefetch:2
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4712
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\gmag4mad\gmag4mad.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2056
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC8DE.tmp" "c:\Users\Admin\AppData\Local\Temp\gmag4mad\CSC4CF8DA2A74245ECA73B2CDF68784778.TMP"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:996

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2004

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1904

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4576

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat
Size 152B
SHA256 cea5dd73fcbf88340bed56b4ce93cef5224a1b27f54e7a991da7dab9e5713a64
MD5 b76c101adc5346454e14f65395beaa23
SHA1 28040ef0d5885a03619a31f6b266c4c429525d3d
SHA512 fee8559d528f4a68925dad4a328885579fb83fe88461cb72bb04260cc06345945529b53af3118a2397178ad936fca7bd81e9a1fc50255084a5cedefe025e3a0f
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat
Size 152B
SHA256 574d29b1ca5f888c75e99c7060cad897b55ebfbf7f07637a667410e0d2d1eab2
MD5 4cf59060ffef2de2c05d4dc9ab860aeb
SHA1 6a5ba28bb4ad8c30f50d45b25383d4934dd87e45
SHA512 c67df2fc82d60522c3004197b8bd10b3988379bd2855f992043494891bf958e810a44ed8e697e815e9435df7df30868902a613db1dc891b24b816d48d2328c91
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat
Size 152B
SHA256 413882ffc2501c69f5569ea2bad03ef2121cf534f656fe4ce2dbb6e44ad5fe6b
MD5 c8dbdd1933409bf3c71e36f9844d37dd
SHA1 b4519c4887f6da733af700a9dd41d0a4e4084aea
SHA512 f5445907926537d551508365eb0f5b5ad49dff421282cb2713e66f4b71c978faa0cc4d172c7b6eae1575603907cab8225587a8c535e3290ef01510e456bb5bba
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index-dir\the-real-index
Size 336B
SHA256 62f8c266010ec181c572f51948d9224e9a2053681702c0d5579bddc10b364f55
MD5 4d38ff9f1064b5ae6e7368b326427ed5
SHA1 185d55124a41a000c78d0f772c6819817258faf1
SHA512 bf229d63a379d9a5d866a57aeaddcdeb157fc83dde7dd7642a1edea0a0405b52e6ed08d829e299e910ab33dec01b7c31f16cd97b731d9fc30367a4fe62d90806
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe5817d8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index-dir\the-real-index~RFe5817d8.TMP
Size 48B
SHA256 e26cf5817ab8a666ae8703528628f8b8fe1831c20d76b5a2892628826193f1e4
MD5 1797cb87cc549d32c023713248e2e533
SHA1 1b6a46dabfe9f174d367a0086f6a0017c99242bc
SHA512 30d6a9c0981fa9d1f6737a8fd34da15f3edfb22919a87b3805f85346ef46a0a89fb15fde6a0729d8735d968f2f3bd13d1438b2335595725b91cee70198d50ab9
MD5 SHA1 SHA512

Submit Download

Microsoft Edge.lnk

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Microsoft Edge.lnk
Size 1KB
SHA256 6d2d8f8718061cf931693100c00a6fd185c0be091e3ed4df0361655f70fc52f1
MD5 a88c9009284eb8673f5b50bb926b8233
SHA1 fb931e8adf41c9cdfa7dfe320a68096caa0eb9fe
SHA512 650f80a818faf919ee9038969a5e510cd178703347f3a1f49af5a8b7bdafeb8a0fb77aabb3f7f64836ea365520eda319666bd2170733e40f0fe0d25c5b63fb9b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network Persistent State
Size 1KB
SHA256 8ebb679bb03df2b91c0697de7a0db3cfcbbd03619d8c5e22bf88d8a79739fd6e
MD5 e49b4b2cb55db30de6f0c6fb48f3c6d8
SHA1 ca1a6b2865a1ed706085d7ee57c9bb9c14a1eab2
SHA512 9d6bf254ea3f04faa2b23bbb5953abf82df2b8160d60b74f0c06bd1f11c36db87575cc8039d84131b0aaebcfa3905ac4b3e861e96ba17cd3e3d21e8a555cc8e7
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network Persistent State
Size 1KB
SHA256 023a272dc350604512a4b059b3019f2260d3a7871413223f710c467731dfb888
MD5 0c5ef39321ed9167dbc3975647604ade
SHA1 d1419c7e49e60c76fd0e63bf7fce3561698aa5c8
SHA512 ba00d14a0fa6f3a3d0350ee4b4d1996f23484bf0d870782c51f9104652275840da6281d09d5ed04083b7a36857b570574a501703d9791ff2f21e610700b1c378
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences
Size 3KB
SHA256 e6d950a8ec6acd2511301ec005b5cfe3614f2e278314fb0e20e717df254625e3
MD5 06a748f930b6a6eff70d02ff1873fe3d
SHA1 1b4ed58b156eb3cce72d5760f1c1e15e85a05f29
SHA512 382f9d1c25b2c6c6d55736852267ad1e679a2979b76143363267489792500c5c9ee4d381dca94436173aa0b1b13a394e454e4a209832518293bc734dfb9b96d3
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences
Size 4KB
SHA256 a4479adc436e67431a051f166a53a9cc1f68f4cb2b6cb5d169316bf564b91f65
MD5 c7eda20db0f92cb46872b74414d4157a
SHA1 4d0f29e77732aff508cbae1506d326005f3d6404
SHA512 82cf6fc338e2d659b37ad21a60de1da2b0cea3ae9f64f9be1559336827ab75b361f886e501a05c1d5bd275dee0f258f018c14061b36d41518105f4c3d9dde567
SSDEEP 96:nhmv+EI2/GSkZBsMASMX0MoiVmdcuY1jIDUBPVuAiX3wI3:nhmvYSk6X0M7uYhI8a93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences
Size 4KB
SHA256 f552cf08f1d39cfdab817b63e82cdc2508280be33f7f3cc6ba9ee579ce770af6
MD5 07eb9c9a55ca975536b82c1b3b2572fd
SHA1 247adda77aea2f1addff17081a664c23c62c6b3a
SHA512 69938868675eb9ae06720d76763df3b67e19c80b2ab4d779404319158c16b3b4723fc7016c7078c52648175e712995045807ccdc58022fd611b52b744efb5826
SSDEEP 96:nhmv+EI2/GSkZBsMASMX0MoiVmdcuY1jIfRUBPVpAiX3wI3:nhmvYSk6X0M7uYhIij93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences~RFe57c2c3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RFe57c2c3.TMP
Size 3KB
SHA256 eaeb69a8f7b7b075c68021375612105a79ea0ae58f83ac35135bd3630d5c0f02
MD5 de45030e677de25cc3bedb514b23d5ad
SHA1 0c7a187ef4a79fecf2bbd1c5c70a9348982772a4
SHA512 f524c6060c814e322676e930588fc5dcac0a6aa5f3f95e0594534a987f0bdf891758a2bf1ead20a1c145e3f15462d760ff7cec47c7c51642849f1a87368c0450
MD5 SHA1 SHA512

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences
Size 26KB
SHA256 7e533bce2e726b6366dc36c3db352a28935467d9ef726819cdc0810674b84d6a
MD5 c26b9d453c1b7b8f97f6f352cd3fac23
SHA1 337178d09b3bb06a0cbfb99cc41b2bad6d3ffa29
SHA512 31a1e90ba8894799d1cc69ee2990bfabc69029d080be14d221d436434615ff2c5f94b52081e2d546451b0833be2cd1620d4dab72dc5a398b2a8bbc53a9c978b4
SSDEEP 768:noZ8D2LWRKQ48F1+UoAYDCx9Tuqh0VfUC9xbog/OV3NLl/S0uxrUpkHY:noZ8D2LWRKQ4u1jaKNLpru6pk4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences~RFe57ea9e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences~RFe57ea9e.TMP
Size 25KB
SHA256 43c8444e301967092417460e6321996bd2094acd0e7f872e256e2952b90f26fa
MD5 72056264ee55688d877a06eb06af7f99
SHA1 22e921eca4e3285a51043ddbf038c1efed0d1d0e
SHA512 4aabc4c8df1ffa22d6359c4f0637bc90f184f46939c57307b1bfa61f306040688dc97deec62bf8bff8df306216e6c333b282df6da4d6011d74fca670e91bfc37
SSDEEP 768:gZ8D2LWRHQG8F1+UoAYDCx9Tuqh0VfUC9xbog/OV33Ll/S0u9rUpbzd:gZ8D2LWRHQGu1jaK3LpruWpbp
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir\temp-index
Size 48B
SHA256 b2ea5e12d72482664220fcf5e09894bcfd9b94e828ff3c1aabbee2d4dd0a5eb4
MD5 4324b6c25853b7045e4a7c059ec47517
SHA1 8453249d511c4e86be3ba9a94941837f332e14c9
SHA512 13bc6df54c9596fdeb540fab992f3e5809b7d38adaac45d3f41c8d89723eb13b7900b7fc7814197db81b55cfd5b0e21d805b9317aecc625f94b1e5bbd405a905
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\TransportSecurity
Size 203B
SHA256 507c97a5739690d2b810ab86af8a3c9b10d19441c586fc9172955a70f481e62b
MD5 ba9fd8f87f0da4fc1e6c29e04e59fb7f
SHA1 9741cb61cde4fe56d75068fee4bc6fd649060893
SHA512 acd92f371af721b655c10c4234dfe01a0e5423f816257896b717c6b78a7dfc784e31ff8e91d9ce0e5078d159771463e429dde6d2e91879539aecf51ac276a92a
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe58e598.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\TransportSecurity~RFe58e598.TMP
Size 203B
SHA256 ea6016ba1721aacda610eee6617ba18a3b2f42cd8ea2d2d297d2bfe37a65012c
MD5 6c45655914a50d09c6fe83c3bc4f92a8
SHA1 b764be1f118dd49a1a0fd9b5918da39e1580815b
SHA512 6058b6f072a5790ff7f11888ca2a4a38fb871247351b694aef6933722e35c13abb540985c98842d052ffaebb24340ab07e9fee1b31ba1eaaac2da527db32a1e1
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State
Size 9KB
SHA256 de9a808d914cd0239e967a0b109f1ecfbdf2b60dff230e399f62ecec9f4e2ff0
MD5 a516e5459bb7b8c4b4f4f8423d0cb2b8
SHA1 5cee409b66f5d263e3636f6867654b0257f123e9
SHA512 b50146e51a5a4aaffd78842adda390aff5d375be1b3ca2bfb42d38b2d341d27b6171bed0f29dd70bf8c5d93bb5d58b4c9d95e26ec73d88b51ad6219bd4a1093d
SSDEEP 192:aoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASFMeMRUj25NXW7mh8AEdvvX:e9iIxuERzA83h09RZxASF4wqNXW7m8vx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State~RFe5813c2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RFe5813c2.TMP
Size 9KB
SHA256 722f54c6b15fa64b9dc2a7cccf0a53dcf6e86bf43878df221f2e324938caf5d1
MD5 8f31b8ae53bfef7fcef91430933d475c
SHA1 7c066aa3776ab39138d01efa5c9a44c87cceca2b
SHA512 4b506e0353becdc50c75fb03ce09276874c64acb487dcdc9bd752ea6857aa75134610a5f823f5c48755f911a5f3f2d02fe1504b7f52289cfe39d138ffeb3dad0
SSDEEP 192:aoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAYMeMRUj254uW7mh8AEdvvX:e9iIxuERzA83h09RZxAY4wq4uW7m8vRX
MD5 SHA1 SHA512 SSDEEP

Submit Download

svoutse.exe

Path C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
Size 1.8MB
SHA256 c90f522fd205ecf056e5827cbfdd49f37531238d65ae9b59251d2799a66e65cc
MD5 a505a4a411e6ba94c4b9c636169c0f03
SHA1 e62f25f90925dda82936c3b2214c83744726003a
SHA512 7e1d2e7bb00b9f98bb1a3307c0de13a88e667dce8e6749dc2542208bc1a4a8a9df7d025c943e4702afdf23949dd6074ec15e703e15233445e221f84d5c5c64cc
SSDEEP 49152:CEaVZEBBSrmmBB6Nx2WuHsiq1ARtdDeeIy3:vaV7r7G29qO
MD5 SHA1 SHA512 SSDEEP

Submit Download

do.ps1

Path C:\Users\Admin\AppData\Local\Temp\1000031041\do.ps1
Size 2KB
SHA256 a25a4b587f073d464c1dc31b23b751be1ab586986a2491a158e538079c34c850
MD5 73858f170d0aa9e324b12427d8025f41
SHA1 17095e22fa380f5be286319a956f68fab2eded5c
SHA512 46792418f06c9bbd125a507da0b5b549327488861ee66d53c115b37dd61a26868eda7101696d7d1f15a0401acec5110e0e59d48f165103b91bb90b745a28755c
MD5 SHA1 SHA512

Submit Download

RESC8DE.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESC8DE.tmp
Size 1KB
SHA256 2481cb11ff863b582e0fe07786faaa7da4bd54e84e69908a011ed30e58730a7d
MD5 e1a9f4c7ed874a4acf6ea301830067dd
SHA1 dd5294c6833da5ace7fdb9904304e77914d8ed9e
SHA512 7e8d2029cf10985dad665137a8e694c280456fe899acdaa79c22f286d353a79602e761cde5245d598e956b3166887b94cc1de50d739e650ee5fa722f48dd6535
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_31vtqjqi.ht0.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_31vtqjqi.ht0.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

gmag4mad.dll

Path C:\Users\Admin\AppData\Local\Temp\gmag4mad\gmag4mad.dll
Size 3KB
SHA256 99e507c33b370a7af6da4eb9e85307eb67f71002da57f99e11b9876e005521b4
MD5 67011d2b87476506713deeeb040cf23a
SHA1 9a8d6ca2a1f889294025fa32cbefa53f4c42dfd4
SHA512 3aebbd7a056d466637c58f846a8c012e9683cae3687c64392624832da95f796f79111be217efcc69c752097c24a2eeb10422f960b44359664367a8f083308417
MD5 SHA1 SHA512

Submit Download

45591808a5.exe

Path C:\Users\Admin\AppData\Roaming\1000026000\45591808a5.exe
Size 1.7MB
SHA256 c3aeec8fdf17cb7d30e2d97dce245505d26b90e160856e90f9e7fb8949a01022
MD5 40cb7abb3661d5c0bbee8c794bc8fd01
SHA1 413785114a79f6ce35a5ea35af89b40e4a70b280
SHA512 ab95e13bcf49385789b46387ee10b28e726c58bc7093edf17364789d74934224a9fbe4e72334a7b8be36d89fa9f378e4dd491c380b0f8696c835caa3316f0806
SSDEEP 24576:Rh1hlH4vRteq8529WxH0yk19k16XAkFkvt6clXMcIlaGvgGclGdRHwsN5yaRIdyg:7FHieq8MWws6eMcC7vXmGdRHb5Ady
MD5 SHA1 SHA512 SSDEEP

Submit Download

CSC4CF8DA2A74245ECA73B2CDF68784778.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\gmag4mad\CSC4CF8DA2A74245ECA73B2CDF68784778.TMP
Size 652B
SHA256 de87415dc4ed5884aa5798b0d2a94c037d03ad7be8357b6ce7b595afeaefeb67
MD5 e799e5026e0e317c61053dccf688a876
SHA1 d56989cb1cc2e245a9dc97d7956c0bc00a3f534b
SHA512 7e4822c694514a0886d3a5512c613914f1a018659575c0a0607ef98233440afb5f0b0dcb0825784cd6449e349de5dbbb8301bdef7f6b6f6f844a2605976c3ae0
MD5 SHA1 SHA512

Submit Download

gmag4mad.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\gmag4mad\gmag4mad.0.cs
Size 580B
SHA256 940b2536894a381f4eaeeda3289a969ef8c50e2c3988ffdee26b4fc70cc18f37
MD5 d83df3d6161b621f56402401dddd6195
SHA1 4a658a72eae666d8e1431bec08cf8be55a4180c4
SHA512 b7280b953c85e054387a6e5429aef3e607c6332621983cdfbd01277c40fb54af07a2badb0743270104a5d17c99eaa9438072abbda728f8104ea634642fff6a2d
MD5 SHA1 SHA512

Submit Download

gmag4mad.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\gmag4mad\gmag4mad.cmdline
Size 369B
SHA256 85ab36acf5db3e1d64f3e8b4f703c5d6bc3280303db72395291839b0e7f9da95
MD5 12eab88ac1d69ecb40f095f355928773
SHA1 f471abcc2d84ed217645ffd3fa031c82c3de05ea
SHA512 fefa934ae87b0d16d56a9fe330428d6010a8598da5fa25185fa11e494164f2cd7ef8ad2799ca49eed27a0c332dba4fe8225f7a7310eb50ae1148afe5e37a5d20
MD5 SHA1 SHA512

Submit Download

memory/1560-451-0x00000000004F0000-0x00000000009B0000-memory.dmp

Download

memory/1560-453-0x00000000004F0000-0x00000000009B0000-memory.dmp

Download

memory/1608-47-0x0000000000821000-0x0000000000835000-memory.dmp

Download

memory/1608-48-0x0000000000820000-0x0000000000E8B000-memory.dmp

Download

memory/1608-37-0x0000000000820000-0x0000000000E8B000-memory.dmp

Download

memory/1608-67-0x0000000000820000-0x0000000000E8B000-memory.dmp

Download

memory/2000-69-0x00000000057B0000-0x0000000005DDA000-memory.dmp

Download

memory/2000-81-0x00000000060A0000-0x00000000063F7000-memory.dmp

Download

memory/2000-87-0x00000000069F0000-0x0000000006A0A000-memory.dmp

Download

memory/2000-83-0x0000000006480000-0x000000000649E000-memory.dmp

Download

memory/2000-84-0x00000000064D0000-0x000000000651C000-memory.dmp

Download

memory/2000-86-0x0000000007440000-0x00000000074D6000-memory.dmp

Download

memory/2000-88-0x0000000006A40000-0x0000000006A62000-memory.dmp

Download

memory/2000-70-0x00000000055F0000-0x0000000005612000-memory.dmp

Download

memory/2000-71-0x0000000005EE0000-0x0000000005F46000-memory.dmp

Download

memory/2000-72-0x0000000005F50000-0x0000000005FB6000-memory.dmp

Download

memory/2000-242-0x00000000052D0000-0x00000000052D8000-memory.dmp

Download

memory/2000-96-0x00000000086C0000-0x0000000008D3A000-memory.dmp

Download

memory/2000-68-0x0000000002CA0000-0x0000000002CD6000-memory.dmp

Download

memory/2000-89-0x0000000007A90000-0x0000000008036000-memory.dmp

Download

memory/2156-0-0x00000000003B0000-0x0000000000870000-memory.dmp

Download

memory/2156-5-0x00000000003B0000-0x0000000000870000-memory.dmp

Download

memory/2156-3-0x00000000003B0000-0x0000000000870000-memory.dmp

Download

memory/2156-2-0x00000000003B1000-0x00000000003DF000-memory.dmp

Download

memory/2156-1-0x0000000077B76000-0x0000000077B78000-memory.dmp

Download

memory/2156-18-0x00000000003B0000-0x0000000000870000-memory.dmp

Download

memory/3112-251-0x0000000000960000-0x0000000000FCB000-memory.dmp

Download

memory/3112-57-0x0000000000960000-0x0000000000FCB000-memory.dmp

Download

memory/4576-378-0x00000000004F0000-0x00000000009B0000-memory.dmp

Download

memory/4812-439-0x00000000004F0000-0x00000000009B0000-memory.dmp

Download

memory/4812-82-0x00000000004F0000-0x00000000009B0000-memory.dmp

Download

memory/4812-19-0x00000000004F1000-0x000000000051F000-memory.dmp

Download

memory/4812-388-0x00000000004F0000-0x00000000009B0000-memory.dmp

Download

memory/4812-389-0x00000000004F0000-0x00000000009B0000-memory.dmp

Download

memory/4812-399-0x00000000004F0000-0x00000000009B0000-memory.dmp

Download

memory/4812-411-0x00000000004F0000-0x00000000009B0000-memory.dmp

Download

memory/4812-15-0x00000000004F0000-0x00000000009B0000-memory.dmp

Download

memory/4812-316-0x00000000004F0000-0x00000000009B0000-memory.dmp

Download

memory/4812-214-0x00000000004F0000-0x00000000009B0000-memory.dmp

Download

memory/4812-21-0x00000000004F0000-0x00000000009B0000-memory.dmp

Download

memory/4812-20-0x00000000004F0000-0x00000000009B0000-memory.dmp

Download

memory/4812-46-0x00000000004F0000-0x00000000009B0000-memory.dmp

Download

memory/4812-449-0x00000000004F0000-0x00000000009B0000-memory.dmp

Download

memory/4812-56-0x00000000004F0000-0x00000000009B0000-memory.dmp

Download

memory/4812-367-0x00000000004F0000-0x00000000009B0000-memory.dmp

Download

memory/4812-454-0x00000000004F0000-0x00000000009B0000-memory.dmp

Download

memory/4812-455-0x00000000004F0000-0x00000000009B0000-memory.dmp

Download

memory/4812-456-0x00000000004F0000-0x00000000009B0000-memory.dmp

Download

memory/4812-459-0x00000000004F0000-0x00000000009B0000-memory.dmp

Download

memory/4812-58-0x00000000004F0000-0x00000000009B0000-memory.dmp

Download

memory/4812-469-0x00000000004F0000-0x00000000009B0000-memory.dmp

Download