amadey | 872b1599a3b0e5ecbe19bc902781396eb4c57592c45fa38df764da59426cc416

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
06/09/2024, 23:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
872b1599a3b0e5ecbe19bc902781396eb4c57592c45fa38df764da59426cc416.exe
Size 1.8MB
Sample240906-3h4hbatdkf
SHA256 872b1599a3b0e5ecbe19bc902781396eb4c57592c45fa38df764da59426cc416
MD5 1ad9cf4af31ff2d341a03bc67b2fc18f
SHA1 7953a720316fe591bd22a88bc4da7c23f89fba37
SHA512 72ba4e28a2030769ed7aa36842c730cc6f4bc70a66fec0f2cc7632da87b0c367507fef3426204c3476cc90ed4751b9dc20c674be425bff083d088b70c3ee97f9
SSDEEP 49152:Ido0WUxJs9ar8c3Wffz8k3eDc1LYK7XVjQq5LO3Ai6w:OrNxJswz3WfrKc18GNoo
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey stealc c7817d leva discovery evasion execution persistence stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

c7817d

http://31.41.244.10

Attributes

install_dir
0e8d0864aa
install_file
svoutse.exe
strings_key
5481b88a6ef75bcf21333988a4e47048
url_paths
/Dem7kTu/index.php

rc4.plain

Extracted

Family

stealc

Botnet

leva

http://185.215.113.100

Attributes

url_path
/e2b1563c6670f193.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Stealc
Stealc is an infostealer written in C++.
stealer stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	872b1599a3b0e5ecbe19bc902781396eb4c57592c45fa38df764da59426cc416.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	svoutse.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	3416de225a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	05cab9c1a1.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	svoutse.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	svoutse.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	svoutse.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 14 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	3416de225a.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	3416de225a.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	872b1599a3b0e5ecbe19bc902781396eb4c57592c45fa38df764da59426cc416.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	05cab9c1a1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	05cab9c1a1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svoutse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	872b1599a3b0e5ecbe19bc902781396eb4c57592c45fa38df764da59426cc416.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svoutse.exe

Executes dropped EXE 6 IoCs

pid	Process
4164	svoutse.exe
3308	3416de225a.exe
2436	05cab9c1a1.exe
3076	svoutse.exe
4192	svoutse.exe
1184	svoutse.exe

Identifies Wine through registry keys 2 TTPs 7 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000\Software\Wine	svoutse.exe
Key opened	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000\Software\Wine	872b1599a3b0e5ecbe19bc902781396eb4c57592c45fa38df764da59426cc416.exe
Key opened	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000\Software\Wine	svoutse.exe
Key opened	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000\Software\Wine	3416de225a.exe
Key opened	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000\Software\Wine	05cab9c1a1.exe
Key opened	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000\Software\Wine	svoutse.exe
Key opened	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000\Software\Wine	svoutse.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000\Software\Microsoft\Windows\CurrentVersion\Run\05cab9c1a1.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000030001\\05cab9c1a1.exe"	svoutse.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs

pid	Process
500	872b1599a3b0e5ecbe19bc902781396eb4c57592c45fa38df764da59426cc416.exe
4164	svoutse.exe
3308	3416de225a.exe
2436	05cab9c1a1.exe
3076	svoutse.exe
4192	svoutse.exe
1184	svoutse.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\svoutse.job	872b1599a3b0e5ecbe19bc902781396eb4c57592c45fa38df764da59426cc416.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2040	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	05cab9c1a1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	872b1599a3b0e5ecbe19bc902781396eb4c57592c45fa38df764da59426cc416.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svoutse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3416de225a.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
500	872b1599a3b0e5ecbe19bc902781396eb4c57592c45fa38df764da59426cc416.exe
500	872b1599a3b0e5ecbe19bc902781396eb4c57592c45fa38df764da59426cc416.exe
4164	svoutse.exe
4164	svoutse.exe
3308	3416de225a.exe
3308	3416de225a.exe
2436	05cab9c1a1.exe
2436	05cab9c1a1.exe
3076	svoutse.exe
3076	svoutse.exe
2040	powershell.exe
2040	powershell.exe
2320	msedge.exe
2320	msedge.exe
4492	msedge.exe
4492	msedge.exe
1912	identity_helper.exe
1912	identity_helper.exe
356	msedge.exe
356	msedge.exe
4192	svoutse.exe
4192	svoutse.exe
1184	svoutse.exe
1184	svoutse.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2040	powershell.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
500	872b1599a3b0e5ecbe19bc902781396eb4c57592c45fa38df764da59426cc416.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 500 wrote to memory of 4164	500	872b1599a3b0e5ecbe19bc902781396eb4c57592c45fa38df764da59426cc416.exe	81
PID 500 wrote to memory of 4164	500	872b1599a3b0e5ecbe19bc902781396eb4c57592c45fa38df764da59426cc416.exe	81
PID 500 wrote to memory of 4164	500	872b1599a3b0e5ecbe19bc902781396eb4c57592c45fa38df764da59426cc416.exe	81
PID 4164 wrote to memory of 3308	4164	svoutse.exe	82
PID 4164 wrote to memory of 3308	4164	svoutse.exe	82
PID 4164 wrote to memory of 3308	4164	svoutse.exe	82
PID 4164 wrote to memory of 2436	4164	svoutse.exe	83
PID 4164 wrote to memory of 2436	4164	svoutse.exe	83
PID 4164 wrote to memory of 2436	4164	svoutse.exe	83
PID 4164 wrote to memory of 2040	4164	svoutse.exe	85
PID 4164 wrote to memory of 2040	4164	svoutse.exe	85
PID 4164 wrote to memory of 2040	4164	svoutse.exe	85
PID 2040 wrote to memory of 4492	2040	powershell.exe	87
PID 2040 wrote to memory of 4492	2040	powershell.exe	87
PID 4492 wrote to memory of 4484	4492	msedge.exe	88
PID 4492 wrote to memory of 4484	4492	msedge.exe	88
PID 4492 wrote to memory of 4872	4492	msedge.exe	89
PID 4492 wrote to memory of 4872	4492	msedge.exe	89
PID 4492 wrote to memory of 4872	4492	msedge.exe	89
PID 4492 wrote to memory of 4872	4492	msedge.exe	89
PID 4492 wrote to memory of 4872	4492	msedge.exe	89
PID 4492 wrote to memory of 4872	4492	msedge.exe	89
PID 4492 wrote to memory of 4872	4492	msedge.exe	89
PID 4492 wrote to memory of 4872	4492	msedge.exe	89
PID 4492 wrote to memory of 4872	4492	msedge.exe	89
PID 4492 wrote to memory of 4872	4492	msedge.exe	89
PID 4492 wrote to memory of 4872	4492	msedge.exe	89
PID 4492 wrote to memory of 4872	4492	msedge.exe	89
PID 4492 wrote to memory of 4872	4492	msedge.exe	89
PID 4492 wrote to memory of 4872	4492	msedge.exe	89
PID 4492 wrote to memory of 4872	4492	msedge.exe	89
PID 4492 wrote to memory of 4872	4492	msedge.exe	89
PID 4492 wrote to memory of 4872	4492	msedge.exe	89
PID 4492 wrote to memory of 4872	4492	msedge.exe	89
PID 4492 wrote to memory of 4872	4492	msedge.exe	89
PID 4492 wrote to memory of 4872	4492	msedge.exe	89
PID 4492 wrote to memory of 4872	4492	msedge.exe	89
PID 4492 wrote to memory of 4872	4492	msedge.exe	89
PID 4492 wrote to memory of 4872	4492	msedge.exe	89
PID 4492 wrote to memory of 4872	4492	msedge.exe	89
PID 4492 wrote to memory of 4872	4492	msedge.exe	89
PID 4492 wrote to memory of 4872	4492	msedge.exe	89
PID 4492 wrote to memory of 4872	4492	msedge.exe	89
PID 4492 wrote to memory of 4872	4492	msedge.exe	89
PID 4492 wrote to memory of 4872	4492	msedge.exe	89
PID 4492 wrote to memory of 4872	4492	msedge.exe	89
PID 4492 wrote to memory of 4872	4492	msedge.exe	89
PID 4492 wrote to memory of 4872	4492	msedge.exe	89
PID 4492 wrote to memory of 4872	4492	msedge.exe	89
PID 4492 wrote to memory of 4872	4492	msedge.exe	89
PID 4492 wrote to memory of 4872	4492	msedge.exe	89
PID 4492 wrote to memory of 4872	4492	msedge.exe	89
PID 4492 wrote to memory of 4872	4492	msedge.exe	89
PID 4492 wrote to memory of 4872	4492	msedge.exe	89
PID 4492 wrote to memory of 4872	4492	msedge.exe	89
PID 4492 wrote to memory of 4872	4492	msedge.exe	89
PID 4492 wrote to memory of 2320	4492	msedge.exe	90
PID 4492 wrote to memory of 2320	4492	msedge.exe	90
PID 4492 wrote to memory of 4196	4492	msedge.exe	91
PID 4492 wrote to memory of 4196	4492	msedge.exe	91
PID 4492 wrote to memory of 4196	4492	msedge.exe	91
PID 4492 wrote to memory of 4196	4492	msedge.exe	91
PID 4492 wrote to memory of 4196	4492	msedge.exe	91
PID 4492 wrote to memory of 4196	4492	msedge.exe	91

C:\Users\Admin\AppData\Local\Temp\872b1599a3b0e5ecbe19bc902781396eb4c57592c45fa38df764da59426cc416.exe
"C:\Users\Admin\AppData\Local\Temp\872b1599a3b0e5ecbe19bc902781396eb4c57592c45fa38df764da59426cc416.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:500
- C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
  "C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4164
- - C:\Users\Admin\AppData\Roaming\1000026000\3416de225a.exe
    "C:\Users\Admin\AppData\Roaming\1000026000\3416de225a.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3308
- - C:\Users\Admin\AppData\Local\Temp\1000030001\05cab9c1a1.exe
    "C:\Users\Admin\AppData\Local\Temp\1000030001\05cab9c1a1.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2436
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\AppData\Local\Temp\1000031041\do.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
      4⤵
      Enumerates system info in registry
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:4492
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffced0a3cb8,0x7ffced0a3cc8,0x7ffced0a3cd8
        5⤵
        
        PID:4484
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1932,17894192650819289965,14375347411327554704,131072 --disable-features=TranslateUI --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1960 /prefetch:2
        5⤵
        
        PID:4872
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1932,17894192650819289965,14375347411327554704,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2356 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2320
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1932,17894192650819289965,14375347411327554704,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8
        5⤵
        
        PID:4196
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,17894192650819289965,14375347411327554704,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
        5⤵
        
        PID:5092
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,17894192650819289965,14375347411327554704,131072 --disable-features=TranslateUI --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
        5⤵
        
        PID:2776
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,17894192650819289965,14375347411327554704,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3756 /prefetch:1
        5⤵
        
        PID:428
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,17894192650819289965,14375347411327554704,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3888 /prefetch:1
        5⤵
        
        PID:2920
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,17894192650819289965,14375347411327554704,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4020 /prefetch:1
        5⤵
        
        PID:4460
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,17894192650819289965,14375347411327554704,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4152 /prefetch:1
        5⤵
        
        PID:2420
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,17894192650819289965,14375347411327554704,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4164 /prefetch:1
        5⤵
        
        PID:580
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,17894192650819289965,14375347411327554704,131072 --disable-features=TranslateUI --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4320 /prefetch:1
        5⤵
        
        PID:2756
    - - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1932,17894192650819289965,14375347411327554704,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7624 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1912
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1932,17894192650819289965,14375347411327554704,131072 --disable-features=TranslateUI --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7472 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:356
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1932,17894192650819289965,14375347411327554704,131072 --disable-features=TranslateUI --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4516 /prefetch:2
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3372
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\52aschke\52aschke.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      PID:880
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA884.tmp" "c:\Users\Admin\AppData\Local\Temp\52aschke\CSC95AFA8B4FE204929A6C03DE2C83D7FD1.TMP"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3076

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1928

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1656

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4192

C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat
Size 152B
SHA256 84b4f6eecc8332ccf08e16b5672a8476e70f1e3cc3fa1951b1f9dabf9350cf00
MD5 54d37b7d73e26f34ae310f62cefa0208
SHA1 e0c1160f5183cb2691aa76641e9896ea602f0060
SHA512 5faf88a4cb84c9da9ca1aa935590318337056f726fa816f346a66ddfe1041d5b3fbb8640fb340c0792ed24099ff3168a9e39eaebd991dfeb36f105f238ab6d34
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat
Size 152B
SHA256 751d6d31ab87a02aece13aaafdc3b632a32a61779becdfed4488bc937233dff2
MD5 59f7d44fa2bcae58e60e12045d6ee952
SHA1 235c6f2c91bebfad18e8090a020543d8087ac068
SHA512 c3ed004872956a40c472356256d38916b162aa07af229905dfab8c0aaf1b4812d51564b12f8903d7cd5763d9ade3b737918cf21dcbebcae290b846892c5a4b3c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat
Size 152B
SHA256 934d65884019eefdd41c1efb4415d7a78d7dd114bd40664de157b04ce43f7710
MD5 8e2c397f29523d4c3ae9406d6c99c23a
SHA1 095db78b767900a23c0a5a6f46a6ed7a88e36f30
SHA512 59b058736d60b7f0b1eefa605d5c855d6a53cad7ef065dc571491d14618dc2c4ad3f34d61d4a8ab4c481dc449b44471ac0338766dfb08405d56be0da7f2ef5fd
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 291fdea911c3b9d263a1a6eca95195f071e08dc5a3ebb38ad7d61fe9dcaaeb0b
MD5 0c66812243906aef9d39c3ea40426da2
SHA1 e809905a769b1e8b2662afe001343152650ac184
SHA512 e69925aff78b214028293acac2c2378a69cc92b9b1dad7b21d6a339cd7ebf30cd5a63e19cb4849beba9ec786dca3f4f90074b344398389b11e367e447bba26ae
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index-dir\the-real-index
Size 336B
SHA256 efc4a9168a48e76d38cb83c2dea15ffc61b3504503e2162007ccbfc4b9a8132a
MD5 b69bee80cd83e5cdbf3e5face7edaea8
SHA1 1f7dbeb578146fb0c69a70754f6f3a11826fef16
SHA512 7d107d4991782bdff541191d4f735025c43dc49c99c3c7a5b358be60c0795a08717268b7bfa7a466e22adac2b4a0f74d7e90598da30478bce66f7a322aea393f
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Microsoft Edge.lnk

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Microsoft Edge.lnk
Size 1KB
SHA256 f6d405193d0ed94a16a0add5ae8cdffabe72e699c6744f06d401581b2686696e
MD5 58305e2a97b768d73629068c5392dc46
SHA1 7078e3371e1f7d7b0ce4fd3e695a2171182afa78
SHA512 daabbfcb3f6ee9403d6c5dc32d271ee418fa3a19c8210ea35591d725a008ad1805a1c394b7dbe56d137824d694babcf4457889798e61f7fc559d2f148878d3fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network Persistent State
Size 1KB
SHA256 8db9da7bb3d2c7037758208200032106a12c2a7272bbbf20c69322a3edb22cf0
MD5 e9dae4e164a8a126bf7682cb553ee414
SHA1 41b0068407e03b5694a8862b71334ef5796d6e93
SHA512 a570f9420605f1ed06de5c825579257b538165d893ea4329350716b46bcbad157c14d968178cc1ac49658e0ee8f45ba40bcaac156201163e37b0975634afedc9
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network Persistent State
Size 1KB
SHA256 88abe293cfd7ac6a4c3e53f38e17008dbb186eca45290f5ff7ca8c6379f82e1d
MD5 ae4e4c67d52484b6cf31c4f39ee694f0
SHA1 e8ce422ba1350e64b3969611764691cdd5b4e5dd
SHA512 340fe860645806edf2f96b52927918c745c0e72261beb5332ff560ad65c52563d1373a60e0adbffa7d5c7c58873391b98c9a2eedfc6b5ef6decfa6fd0d6365df
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences
Size 3KB
SHA256 b1d97189c752cff9bf1b40514919063371bbb0c39297667d1e1390cfb475867d
MD5 8d5be44c95ecb99ae746e226e7a54967
SHA1 d36bc4d671b6e5ae380fd908a83cccf0b9dc4454
SHA512 9c42fa69deb84f0005e5625c18ef2d2bc26c5823142f753c114c1f75752f858aecb9fff4e941e2a1c335706d88786861c7a37e2ab3c4b046c515f69a153682eb
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences
Size 4KB
SHA256 8b75495fd4e390ed08907a4eaf358b061421cee7016e313853162501d0ab4620
MD5 d671dad2936e8e152d45bc0e5ed481a7
SHA1 a4385bf0c767828260986939be7a9e50f3496122
SHA512 2d3c70adbba15d58c56a03390ebaf8eacef023b56eb1b39b4d9aeffc1e7cbe0367c40952500d31ea8b5a666d65537d22f3142f4f3a25d2ad838f73821a43c2d1
SSDEEP 96:nyv+E7Dok4S4U0MoiVmdGu91jI3UBPVpAiX3wI3:nyvZokAU0MVu9hIoj93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences
Size 4KB
SHA256 09f2da291b69e92592fc73a3c5f16d71a8c61caa6c36979ed0e90c9472d79404
MD5 b4a457026d51d992077243954b572b49
SHA1 a91f5706447b73013b17e03ed78eb9405ea8144a
SHA512 c3058301b26eee291facdd4bbde6c52fd6f8ee4b0f476d50ecf842fee0fba3239651766c3338f9c1b2f23f82761c6cc051f08fc1bb2acb985ef657dfbf642ed9
SSDEEP 96:nyv+E7Dok4S4U0MoiVmdGu91jIjUBPVpAiX3wI3:nyvZokAU0MVu9hIcj93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences~RFe57a325.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RFe57a325.TMP
Size 3KB
SHA256 a7b1c59dee8557a6153b6b9ab2d7a2ee4621c75c4c2f95cc1fdc60955d9f2928
MD5 24a6bb0a712926dcc3268471c216d6c9
SHA1 0c3f772bda142ac47198c794428e7f784007625e
SHA512 3cdcbd90b5f831efbbfea1c4f6fddb01be24036108e19f3b33f26a32b8c30283fe54f3b8b4c84ec38ad50c03daba4b24291a32d3e5bfe5489109a5ef31346fa4
MD5 SHA1 SHA512

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences
Size 26KB
SHA256 125da8342ac1bd364f513023330dda0dd7462c6723bb1005469365e52d4c8d64
MD5 9022074fcd3fe50c83d1576687511ebf
SHA1 a48d431b2bc3b42198d1599de7b201e6a9ecf4be
SHA512 30d45a7152f2ebaff00a3d6fcbd03950d9584bf156461ab7d275dc9b5e8c475f924f9338f9459db90a482a5af2e9137710b83ee94546ef340406ba843650e02b
SSDEEP 768:nF58o2+WReQY8F1+UoAYDCx9Tuqh0VfUC9xbog/OV35Ll/X0yprUpE:nF58o2+WReQYu1jaK5LpkyypE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences~RFe57c999.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences~RFe57c999.TMP
Size 25KB
SHA256 1178dc198c4aa56ee6c2c5014b9e2dcae0615829e3bf771117a5d4a3a6dc53c5
MD5 6a386579631bf833c7ab786d5ab2b4a2
SHA1 86cf16887a368f74443dc3304865ea91aa536be8
SHA512 4b86a64d2179e6da2c7d0a4b2eb64021eefe7102638df91bdca0a2a2ff506060a4b4f5d15e8d51ec6a30651b7af60bd096138e5884e1656f4d83cae426766ca8
SSDEEP 768:N58o2+WRvQq8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3vLl/X0y9rUpcN:N58o2+WRvQqu1jaKvLpkyWp8
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\TransportSecurity
Size 203B
SHA256 1bbf300682dfe42ed3b786e586263f86411e61bd15cb15f6e3c4d7dca60016ed
MD5 e65ecf78edf7e7e33fac2cc0fbba6a49
SHA1 361969de05738c66c04874b608c04d2da36fd95d
SHA512 01e857017a9a92f63ce4ea89460645af52163d490ed83d149a89309ac0fdbea6f20c0ee6d5fdcaee11e0e786bd43587b790594f059afa4a6c2f206bcb02bc281
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe58cd1f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\TransportSecurity~RFe58cd1f.TMP
Size 203B
SHA256 30398d4f10a649b8f4d8a229f9634a7fbbb222ed97a96928121ad092b050453a
MD5 486d18c56ec8e6c9c6097a6023429d89
SHA1 c54440d63e5e0bbb9ff3f8ad6bdf505a5fb7c3ce
SHA512 3eef9917a01ca32dbab6a2b823f98dd4e6d4c60b5b51c9e6cfe1580f6e9b91e7a11b79873bcb32aac9ff5ffc953a6a23e845c7c8a2242b320fb891aa885cdea8
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

dbf08669-1d93-42c6-b2b6-9fea10351ba5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Kiosk\dbf08669-1d93-42c6-b2b6-9fea10351ba5.tmp
Size 9KB
SHA256 c411165ca199a29c3b79eb58834687fb78365528fed59c047a2d13413463078e
MD5 c69e0e1f1b5313f3b794a1c4c2a6db68
SHA1 2106cce59f50ab3e7ca16134449d0b0c26908f19
SHA512 677e8ee923d5cb331ee80de6330656f88da221a3d6934e9008561b443d67c5ab069de5435f3619adabb2c2e6cb37890014e4bb24543442e665e6355922ce9824
SSDEEP 192:aoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAS0eMRUEOJnmW7mh8AEdvwi:e9iIxuERzA83h09RZxASw7smW7m8vei
MD5 SHA1 SHA512 SSDEEP

Submit Download

svoutse.exe

Path C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
Size 1.8MB
SHA256 872b1599a3b0e5ecbe19bc902781396eb4c57592c45fa38df764da59426cc416
MD5 1ad9cf4af31ff2d341a03bc67b2fc18f
SHA1 7953a720316fe591bd22a88bc4da7c23f89fba37
SHA512 72ba4e28a2030769ed7aa36842c730cc6f4bc70a66fec0f2cc7632da87b0c367507fef3426204c3476cc90ed4751b9dc20c674be425bff083d088b70c3ee97f9
SSDEEP 49152:Ido0WUxJs9ar8c3Wffz8k3eDc1LYK7XVjQq5LO3Ai6w:OrNxJswz3WfrKc18GNoo
MD5 SHA1 SHA512 SSDEEP

Submit Download

do.ps1

Path C:\Users\Admin\AppData\Local\Temp\1000031041\do.ps1
Size 2KB
SHA256 a25a4b587f073d464c1dc31b23b751be1ab586986a2491a158e538079c34c850
MD5 73858f170d0aa9e324b12427d8025f41
SHA1 17095e22fa380f5be286319a956f68fab2eded5c
SHA512 46792418f06c9bbd125a507da0b5b549327488861ee66d53c115b37dd61a26868eda7101696d7d1f15a0401acec5110e0e59d48f165103b91bb90b745a28755c
MD5 SHA1 SHA512

Submit Download

52aschke.dll

Path C:\Users\Admin\AppData\Local\Temp\52aschke\52aschke.dll
Size 3KB
SHA256 ee72c3968449a61de6ebf38ebc7fa0dbea6223a0a31e9067aa076eb7d6e6fe72
MD5 a5e13571c821969960f20e74a1f03f50
SHA1 c21a0cd4c43f6247d0a93cb2bdf6fd50c306df76
SHA512 e697c38b904637f4572e8b3309e43f68effbe37d11f066826083c8e07cd0bc11876fd6876041669c440d41c1560685b9693349491d7b6ead328e37b17e0bd0b3
MD5 SHA1 SHA512

Submit Download

RESA884.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESA884.tmp
Size 1KB
SHA256 835f484cbcb7f903833890784f562b896e5ac1a3bb6e4fd75e0a6d569dc6ed08
MD5 e72550a5b7f95c9390a6377ffaef58aa
SHA1 d949e8b20b2521b70178e949799c543885a76a3f
SHA512 bc82e0d454690f61d80541fc0676ac97b5f765853652eef1ffb46359e226a9d5eb9b959e388f1b78a0696fe1ff1e40a9f5875b939c7de51a0c6d4f3f8e5cdc81
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_dz0exqs2.gnu.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dz0exqs2.gnu.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

3416de225a.exe

Path C:\Users\Admin\AppData\Roaming\1000026000\3416de225a.exe
Size 1.7MB
SHA256 91c86693907d909a3ef07342646e7fb5e5fbd1b0f3d3d115ab3caed32dce3fa9
MD5 11d689a745d97a37a7f4386d31e062b3
SHA1 54db74a03c51874478ce1654ad17ff9318245d44
SHA512 7dd8b0e08d4f22d7e3c46de19c82b1dc2b8ba570109e69265b0783310e417b33244459462d0d8495de63d1897b634064750851013d2787af3c7fe5f790cb4e92
SSDEEP 49152:uokfEBedRYSHpOsxR6jy/Gj3CC67RgFGJ5XL:uoiE+4s2y/GZ6F4GbXL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft Edge (2).lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Microsoft Edge (2).lnk
Size 1KB
SHA256 c8617a0c018e4610a9fce662965e42d5452dc11bf79796f651860591df0c2c27
MD5 5a855f939ead07792a4fc42f59b53a25
SHA1 3d92e602ca0d52d5060402f35d61333507c743e5
SHA512 5751e56a5da098db89d4288cfd52b6045025160c18c60d7708d660a2497be7b4ddf1f175e0422a340aae1af8979c1a1812cd2dea1616ee8f471ae15193f99d2a
MD5 SHA1 SHA512

Submit Download

52aschke.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\52aschke\52aschke.0.cs
Size 580B
SHA256 940b2536894a381f4eaeeda3289a969ef8c50e2c3988ffdee26b4fc70cc18f37
MD5 d83df3d6161b621f56402401dddd6195
SHA1 4a658a72eae666d8e1431bec08cf8be55a4180c4
SHA512 b7280b953c85e054387a6e5429aef3e607c6332621983cdfbd01277c40fb54af07a2badb0743270104a5d17c99eaa9438072abbda728f8104ea634642fff6a2d
MD5 SHA1 SHA512

Submit Download

52aschke.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\52aschke\52aschke.cmdline
Size 369B
SHA256 bc7098cc6203a14158e326dc911f610e590785d3d7e74b822a7b82c9453f0baa
MD5 4f6b228c8f4e7a61b6e76785253f8685
SHA1 ab339e063765d91c1201e603296e98b59caea97e
SHA512 1554a21a2f697229008709f44af2c42d0018295aa88d18a184c9d2c62039a7b6e409be44eed0f6c40447950c5fd2d073be822e1e6d1acd035bca0031b7e010a8
MD5 SHA1 SHA512

Submit Download

CSC95AFA8B4FE204929A6C03DE2C83D7FD1.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\52aschke\CSC95AFA8B4FE204929A6C03DE2C83D7FD1.TMP
Size 652B
SHA256 442a7ebebb6c2f7e2e8d366546daafa35b84b762c36bdc030eb2ef7be8daad7d
MD5 7b6bb787710a656bfa9b04ea62f917db
SHA1 d01510c8868f7e5394d035c4c6e30e9175941b27
SHA512 923d67afa34e8cc7d2ca3ba7b44b972531722bea8f8bad2293264600851535c722453eefacd618d4e52e2c3767d1bebbdbf5d8b3a8c8a06dc83b4b730b038282
MD5 SHA1 SHA512

Submit Download

memory/500-5-0x0000000000CE0000-0x00000000011A2000-memory.dmp

Download

memory/500-18-0x0000000000CE0000-0x00000000011A2000-memory.dmp

Download

memory/500-1-0x0000000077B46000-0x0000000077B48000-memory.dmp

Download

memory/500-2-0x0000000000CE1000-0x0000000000D0F000-memory.dmp

Download

memory/500-3-0x0000000000CE0000-0x00000000011A2000-memory.dmp

Download

memory/500-0-0x0000000000CE0000-0x00000000011A2000-memory.dmp

Download

memory/1184-446-0x0000000000200000-0x00000000006C2000-memory.dmp

Download

memory/1184-447-0x0000000000200000-0x00000000006C2000-memory.dmp

Download

memory/2040-226-0x00000000056D0000-0x00000000056D8000-memory.dmp

Download

memory/2040-97-0x0000000008AC0000-0x000000000913A000-memory.dmp

Download

memory/2040-83-0x0000000006430000-0x0000000006787000-memory.dmp

Download

memory/2040-84-0x0000000006850000-0x000000000686E000-memory.dmp

Download

memory/2040-85-0x00000000068F0000-0x000000000693C000-memory.dmp

Download

memory/2040-69-0x0000000003080000-0x00000000030B6000-memory.dmp

Download

memory/2040-71-0x0000000005B30000-0x000000000615A000-memory.dmp

Download

memory/2040-88-0x0000000006DF0000-0x0000000006E0A000-memory.dmp

Download

memory/2040-72-0x00000000059B0000-0x00000000059D2000-memory.dmp

Download

memory/2040-87-0x0000000007840000-0x00000000078D6000-memory.dmp

Download

memory/2040-73-0x00000000062D0000-0x0000000006336000-memory.dmp

Download

memory/2040-74-0x0000000006340000-0x00000000063A6000-memory.dmp

Download

memory/2040-90-0x0000000007E90000-0x0000000008436000-memory.dmp

Download

memory/2040-89-0x0000000006E10000-0x0000000006E32000-memory.dmp

Download

memory/2436-248-0x0000000000CD0000-0x000000000134A000-memory.dmp

Download

memory/2436-55-0x0000000000CD0000-0x000000000134A000-memory.dmp

Download

memory/3076-58-0x0000000000200000-0x00000000006C2000-memory.dmp

Download

memory/3076-61-0x0000000000200000-0x00000000006C2000-memory.dmp

Download

memory/3308-37-0x0000000000580000-0x0000000000BFA000-memory.dmp

Download

memory/3308-60-0x0000000000580000-0x0000000000BFA000-memory.dmp

Download

memory/4164-53-0x0000000000200000-0x00000000006C2000-memory.dmp

Download

memory/4164-20-0x0000000000200000-0x00000000006C2000-memory.dmp

Download

memory/4164-376-0x0000000000200000-0x00000000006C2000-memory.dmp

Download

memory/4164-377-0x0000000000200000-0x00000000006C2000-memory.dmp

Download

memory/4164-378-0x0000000000200000-0x00000000006C2000-memory.dmp

Download

memory/4164-70-0x0000000000200000-0x00000000006C2000-memory.dmp

Download

memory/4164-389-0x0000000000200000-0x00000000006C2000-memory.dmp

Download

memory/4164-450-0x0000000000200000-0x00000000006C2000-memory.dmp

Download

memory/4164-403-0x0000000000200000-0x00000000006C2000-memory.dmp

Download

memory/4164-16-0x0000000000200000-0x00000000006C2000-memory.dmp

Download

memory/4164-348-0x0000000000200000-0x00000000006C2000-memory.dmp

Download

memory/4164-19-0x0000000000201000-0x000000000022F000-memory.dmp

Download

memory/4164-21-0x0000000000200000-0x00000000006C2000-memory.dmp

Download

memory/4164-22-0x0000000000200000-0x00000000006C2000-memory.dmp

Download

memory/4164-440-0x0000000000200000-0x00000000006C2000-memory.dmp

Download

memory/4164-441-0x0000000000200000-0x00000000006C2000-memory.dmp

Download

memory/4164-442-0x0000000000200000-0x00000000006C2000-memory.dmp

Download

memory/4164-443-0x0000000000200000-0x00000000006C2000-memory.dmp

Download

memory/4164-445-0x0000000000200000-0x00000000006C2000-memory.dmp

Download

memory/4164-287-0x0000000000200000-0x00000000006C2000-memory.dmp

Download

memory/4164-57-0x0000000000200000-0x00000000006C2000-memory.dmp

Download

memory/4192-391-0x0000000000200000-0x00000000006C2000-memory.dmp

Download

memory/4192-390-0x0000000000200000-0x00000000006C2000-memory.dmp

Download